Privacy Policy

This policy explains what personal information Sun City Real Estate (סאן סיטי נדל"ן) collects, why we use it, who we share it with, and what rights you have. It is written to describe accurately what our system actually does.

1. Who we are and who controls your data

The data controller is Sun City Real Estate, שמואל הנציב 20, נתניה, Israel. Real estate broker licence no. 30723354. For any privacy matter, contact us at 052-5551200 · kalifeli.suncity@gmail.com.

2. Summary at a glance

• Details you type into our contact forms are sent as a WhatsApp message from your own device — they are not stored in our database.
• Personal data is stored when you open an account or set up a saved search with alerts.
• There is no Meta Pixel, no Google Analytics, no tag manager, and no advertising tracking on this site.
• Our Facebook and Instagram connection is an internal tool for the agency's own administrators. It is not Facebook Login for site visitors.
• We do not sell personal data and we do not share it with third parties for their own marketing.

3. What information we collect

Information you send through site forms. Name, phone number, subject and free text. Pressing send opens WhatsApp on your device with the message prepared, and you send it to us. These fields do not pass through our server and are not stored in our database.

Account data. Email address and full name (profilestable) and account permissions (user_roles). Authentication is handled by Supabase Auth.

Saved searches and alerts. When you set up a personal search agent we store your search criteria (city, neighbourhoods, deal type, price and room ranges, safe room, lift, parking, balcony, notes), your alert preferences, and the WhatsApp number you provided for alerts (search_profiles and listing_notifications).

Agent and administrator data. Site and personal-page settings, listings, images and translations, sold properties, candidates found by our listing-scout agent, and Facebook/Instagram connections.

AI usage metering. For each AI operation we record the feature name, model, token counts, cost and status (ai_usage_events). The content of the prompt or the response is not stored in that record.

Technical data. Operational server and infrastructure logs, used for security and troubleshooting.

4. Purposes and legal basis

• Providing the service and managing your account — performance of our contract with you.
• Sending property alerts by email and WhatsApp — your consent (given by ticking the form checkbox or enabling alerts in your personal area), which you may withdraw at any time via the agency or your personal-area settings.
• Answering enquiries and matching properties — legitimate interests and pre-contractual steps taken at your request.
• Securing the system and preventing abuse — legitimate interests.
• Meeting legal obligations and transaction record-keeping — legal obligation.

For visitors resident in the European Union these are the bases set out in Article 6 GDPR. For all visitors, the Israeli Privacy Protection Law 5741-1981 and the Privacy Protection (Data Security) Regulations 5777-2017 apply.

5. Meta (Facebook & Instagram) integration

This is a business publishing tool used only by the agency's own authorised administrators. It is not Facebook Login for site visitors. Visitors are never asked to sign in with Facebook, and we never collect any visitor's public_profile or email address through Meta.

An authorised administrator connects the agency's own Facebook business Page through Meta's OAuth flow. What we store is the Page ID, the Page name, the ID of the linked Instagram business account, and a long-lived Page access token. That token is read and used exclusively server-side and is never sent to the browser.

These are the permissions we request and exactly what we do with each:

• pages_manage_posts — publish a property post to the agency's own business Page, initiated by an administrator.
• pages_read_engagement — read the Page name and ID so we can show the administrator which Page is connected.
• instagram_basic — identify the Instagram business account linked to that Page.
• instagram_content_publish — publish the same property to the business Instagram account.
• ads_management and business_management — create an advertising campaign promoting a property. Campaigns are always created in PAUSED state and never go live without the administrator manually approving them in Meta Ads Manager.

We do not retrieve or store personal data about followers, commenters or customers from Facebook or Instagram. There is no Meta Pixel, no Conversions API, and we build no custom audiences from site visitors. Our handling of data received from Meta complies with the Meta Platform Terms and Developer Policies. For disconnection and deletion instructions see our data deletion page.

6. Cookies & measurement

We use cookies and local storage necessary to maintain your signed-in session in the personal area (Supabase Auth) and to remember display preferences (such as language). We also measure site usage with a first-party system only: pages viewed and clicks (for example on WhatsApp or phone buttons) are recorded with a random, hashed session identifier — no name, no phone number and no cross-site tracking. There are no analytics, advertising or third-party tracking cookies on this site, and no Meta Pixel.

7. Service providers we share data with

• Supabase — database, file storage and authentication.
• Lovable — site hosting.
• Meta Platforms — Page and Instagram publishing and campaign creation, administrator-initiated only.
• Green API — outbound WhatsApp alerts.
• Resend — email alerts.
• Anthropic — AI services for content translation, smart search and the listing-scout agent.
• Google Maps — embedded map on property pages.
• OpenStreetMap — map tiles and address geocoding.

These providers process data on our behalf and on our instructions. We do not sell personal data and we do not disclose it to any third party for their own marketing. We disclose data to a competent authority only where the law requires it.

8. International data transfers

Some of the providers listed above operate servers outside Israel and outside the European Economic Area. Such transfers rely on recognised safeguards, including the European Commission's Standard Contractual Clauses or adequacy decisions, where applicable.

9. How long we keep data

• Account data — while the account is active, and up to 12 months after a closure request.
• Saved searches and alerts — until you delete them or close your account.
• Facebook and Instagram connections — until an administrator disconnects, at which point the record is deleted immediately.
• Records we are legally required to keep — for the period the law prescribes.

10. Security

Data is protected by TLS in transit, row level security policies in the database, a strict separation between server and browser code so that secrets and access tokens are never sent to the client, and an HMAC-signed state parameter in the Meta OAuth flow. Access to the admin area is limited to authorised users. No system is completely secure, and we keep improving ours.

11. Your rights

You have the right to access the data we hold about you, correct it, request its deletion, object to or restrict processing, receive it in a portable format, and withdraw consent you previously gave — without affecting the lawfulness of processing carried out beforehand.

In Israel, the rights of access and correction are set out in sections 13 and 14 of the Privacy Protection Law 5741-1981, and you may lodge a complaint with the Israeli Privacy Protection Authority. For EU residents, the rights are set out in Articles 15 to 22 GDPR, and you may lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at 052-5551200 · kalifeli.suncity@gmail.com. We respond within 30 days at the latest.

12. Deleting your data

Full instructions — including how to disconnect a Facebook or Instagram connection — are on our data deletion instructions page.

13. Children

This service is not directed at anyone under 18 and we do not knowingly collect data about them. If you believe a minor has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The updated version is published here with a new last-updated date, and registered users are notified of material changes.

15. Contact us

Sun City Real Estate, שמואל הנציב 20, נתניה, Israel. 052-5551200 · kalifeli.suncity@gmail.com. Broker licence 30723354.