1. Who we are
Imobria is a product of Cod3Labs LLC, a company registered in New Mexico, USA (registered address: 1209 Mountain Road PL NE, Ste N, Albuquerque, NM 87110). Cod3Labs LLC is the controller of the personal data described in this policy (the “data controller” under the GDPR). In this policy, “we”, “us” and “Imobria” mean Cod3Labs LLC.
This policy covers this website, customer accounts, orders and billing, support requests, the contact form, demo bookings and our own business communications. It does not cover the Imobria platform itself: when a client uses the platform, the client decides why and how their users' data is processed, and we act on their behalf under a separate agreement.
For any privacy question, write to legal@cod3labs.com. We are not required to appoint a Data Protection Officer; this address is the contact point for all data protection matters.
2. What we collect and why
Visiting the site does not require an account or any information from you. We only process personal data in the situations below. Where the GDPR applies, each one has a lawful basis (Article 6).
| When | Data | Why we use it | Lawful basis |
|---|---|---|---|
| You create or use a customer account | Name, email, company, phone number, selected product and listing-plan preferences, account identifier and authentication/session information. Passwords are handled by our authentication provider and are not sent to Odoo. | To verify your email, sign you in, recover account access and connect you to your own customer records. | Steps at your request before a contract and performance of our agreement (Art. 6(1)(b)); our legitimate interest in account security (Art. 6(1)(f)). |
| You place an order, pay an invoice or contact support | Agreed scope, terms acceptance, orders, invoices, payment status, billing contact details and support tickets. Payment providers handle payment credentials; the website does not store full card details. | To deliver your service, maintain billing records, reconcile payments and respond to support and cancellation requests. | Performance of our agreement (Art. 6(1)(b)), applicable recordkeeping obligations (Art. 6(1)(c)) and our legitimate interest in resolving requests (Art. 6(1)(f)). |
| You send a message through the contact form | Full name, email, company, phone number, topic, how you found us, your message, the time you agreed to this policy. Also recorded with it: IP address, approximate location (country, region and city), time zone and, only if you allowed analytics, the page or campaign that brought you here. | To read and answer your message, send you a confirmation, keep a record of the conversation, and protect the form from spam and abuse. | Your consent (the box you tick) and our legitimate interest in running and securing a business contact channel (Art. 6(1)(a), (f)). |
| You book a demo | Name, email, company and anything you enter while booking, handled by Cal.com. We receive the booking details. | To schedule and run the demo, and to follow up about it. | Steps at your request before a contract (Art. 6(1)(b)) and our legitimate interest (Art. 6(1)(f)). |
| You browse the site | Privacy-friendly statistics through Cloudflare Web Analytics (pages viewed, referrer, country, device type). No cookies, and it does not follow you across sites. | To keep the site working and understand overall traffic. | Our legitimate interest (Art. 6(1)(f)). |
| You allow analytics | Google Analytics 4: pages viewed, approximate location, device and browser, identifiers stored in cookies (see section 3). | To see which pages are useful and where to improve. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Always, when the site is served | Technical data any web server receives: IP address, browser, requested page, time. Kept in security and performance logs by our infrastructure provider. | To deliver the site and keep it secure. | Our legitimate interest (Art. 6(1)(f)). |
| We are legally required to | Any of the above, as far as the law demands. | To meet legal obligations or lawful requests from authorities. | Legal obligation (Art. 6(1)(c)). |
Providing your details is voluntary, but without a name, email and message we cannot answer you. We do not ask for sensitive data, such as health information or government IDs, so please do not send any. We do not use your data for automated decision-making or profiling, and we do not sell it.
5. Transfers outside Europe
Contact form messages are stored by Supabase; Contact and Support tickets are processed in Odoo. Cod3Labs LLC is based in the United States, and our providers (including Google, Resend, Cloudflare, Sanity and Cal.com) may process data in the United States or other countries outside the European Economic Area (EEA) and the United Kingdom. Where they do, the transfer relies on an approved safeguard: the European Commission's Standard Contractual Clauses, or the provider's certification under the EU–US Data Privacy Framework where it applies. You can ask us for a copy of the safeguards at legal@cod3labs.com.
6. How long we keep data
- Contact form messages and inquiry records: up to 3 years from our last contact with you, then deleted or anonymized. Earlier if you ask.
- Messages that never lead to a conversation (for example spam or an unanswered inquiry) are not kept longer than this either.
- Customer accounts and support: retained while needed to provide your service and resolve outstanding requests. Account closure does not remove records that must be retained for accounting or legal obligations.
- Orders, invoices and payment records: retained for applicable accounting, tax and legal recordkeeping requirements.
- Booking records: kept by us with the related inquiry (up to 3 years) and by Cal.com under its own retention policy.
- Google Analytics data: 14 months, then deleted automatically. Cookies last up to 2 years but are only set with your consent.
- Server and security logs: kept by our infrastructure provider for a short period, generally no more than 12 months.
- Your cookie choice: 12 months on your own device.
We may keep data longer where the law requires it or where it is needed to establish or defend a legal claim.
7. Your rights
If the GDPR or UK GDPR applies to you, you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is inaccurate or incomplete.
- Erase your data (“right to be forgotten”) in the cases the law provides.
- Restrict how we use your data while a question is being resolved.
- Data portability: receive the data you gave us in a structured, machine-readable format.
- Object at any time to processing based on our legitimate interests, and to direct marketing.
- Withdraw consent at any time, for example for analytics (footer “Cookie settings”) or for being contacted about your inquiry. This does not affect anything done before you withdrew.
To use any of them, email legal@cod3labs.com. We answer within one month (we may extend by two more months for complex requests and will tell you if so), and we may need to confirm it is really you first. There is no charge unless a request is clearly unfounded or excessive. If you are outside the EEA and the UK, we apply the same rights wherever we reasonably can.
8. Security
We protect personal data with encrypted connections (HTTPS), restricted access for staff and providers, secrets kept out of the public website, bot and rate-limit protection on the contact form, and providers that maintain their own security programs. No system is completely secure. If a breach affects your rights, we notify you and the authorities as the law requires.
9. Business outreach
Besides people who contact us, we may contact companies in the real estate sector that we think could benefit from Imobria. For them we process a business contact's name, work email, job title and company, taken from public business sources such as company websites and professional listings, on the basis of our legitimate interest in business-to-business communication (Art. 6(1)(f)).
Every such email says who we are and where we found you, and contains an unsubscribe link. You can object or unsubscribe at any time and we stop contacting you right away; we then keep only your address on a suppression list so we do not write again. You can also email contact@mail.imobria.com or legal@cod3labs.com to unsubscribe, ask where we got your details or have them deleted.
10. Children
The site is for business professionals. We do not knowingly collect data from anyone under 18. If you think a child has sent us personal data, contact legal@cod3labs.com and we will delete it.
11. Changes to this policy
We update this policy when our practices or the law change, and show the date at the top. If a change affects how we use your data in a way you would not expect, or adds tracking that needs your consent, we tell you in a clear way (for example by asking again in the cookie banner) rather than expecting you to reread it.
12. Contact and complaints
Cod3Labs LLC (Imobria)
Registered address: 1209 Mountain Road PL NE, Ste N, Albuquerque, NM 87110, USA
Privacy and data requests: legal@cod3labs.com
General questions: contact@mail.imobria.com
If you have a concern about your data, please contact us first so we can put it right. You also have the right to lodge a complaint with your local data protection authority.