This Privacy Policy explains how Island Homes ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use Island Homes (the "Service"). We are established in the Isle of Man and process personal data in accordance with the General Data Protection Regulation as applied in the Isle of Man (Application of GDPR Order 2018) and the Data Protection Act 2018 (Isle of Man).

1. Data controller

Island Homes

2. Personal data we collect

Depending on how you use the Service, we may process:

• Account data: name, email address, password (hashed), email verification status, two-factor authentication data if enabled.
• Preferences: saved property searches, favorites, per-listing change notifications, and email alert settings.
• Communications: property enquiry messages between buyers and sellers, and in-app notifications.
• Private seller listings: property address, phone number, listing content, photographs, and utility bill documents submitted for verification.
• Viewings: booking name, email, phone, notes, and calendar sync metadata if you connect Google or Microsoft calendar.
• Usage data: pages viewed, properties viewed or shared, approximate location derived from IP (country), session identifier, referrer, and browser user agent.
• Mortgage calculator: if you use our affordability tool without an account, financial and personal details you enter are stored separately and are not automatically linked to a user account.
• Technical data: session cookies required to operate the site when you are logged in or use certain features; and security verification signals processed by Cloudflare Turnstile when you submit protected forms.

3. How we use your data

• To provide and secure your account and the Service, including bot and abuse prevention on public forms.
• To send property alerts and notifications you have requested or opted into.
• To facilitate enquiries, messages, and viewing bookings.
• To review and publish private seller listings.
• To sync confirmed viewings with your connected calendar, where you have chosen that integration.
• To understand aggregate usage and improve search and map features.
• To comply with legal obligations and respond to lawful requests.

4. Lawful bases

We rely on the following lawful bases under GDPR:

• Contract: processing necessary to provide the Service you request (account, alerts, messages, listings, viewings).
• Consent: marketing-style email alerts where required, calendar OAuth connection, and acceptance of terms at registration.
• Legitimate interests: fraud prevention, security (including Cloudflare Turnstile on public forms), service improvement, and limited analytics, balanced against your rights.
• Legal obligation: where we must retain or disclose data to comply with law.

5. Map tiles, security verification, and third parties

Map tiles are loaded from a third-party CDN when you use map features. No cookies are set by the tile provider; your IP address is processed to deliver map images.

When you submit certain forms (for example register, log in, contact us, send an enquiry, or book a viewing), we load Cloudflare Turnstile to help block bots and abuse. Turnstile may process your IP address, browser user agent, and similar technical signals. It is used only for security verification, not for advertising or cross-site tracking. No consent is required because this processing is strictly necessary to protect the Service.

We use self-hosted fonts and do not load fonts from third-party CDNs on the public site. Agency staff may use separate admin tools that rely on additional third-party services.

6. Sharing your data

We may share personal data with:

• Estate agents and private sellers when you enquire about or book a viewing for their listing.
• Infrastructure providers that host our application and databases (processors under contract).
• Cloudflare, when Turnstile is enabled, to verify that protected form submissions are not automated abuse (processor under contract).
• Google or Microsoft if you choose to connect calendar sync.
• Authorities or regulators when required by law.

We do not sell your personal data.

7. International transfers

Some processors or connected services (for example calendar providers) may process data outside the Isle of Man or EEA. Where this occurs, we ensure appropriate safeguards such as adequacy decisions or standard contractual clauses.

8. Retention

We retain personal data only as long as necessary:

• Account data: until you delete your account, then deleted or anonymised as described in our deletion process.
• Property view and share logs: 90 days.
• Inactive sessions: 14 days.
• Sent notification digest items: 30 days.
• Mortgage affordability submissions without an account: 365 days.
• Activity logs (admin actions): up to 365 days.

9. Your rights

Under GDPR you have the right to:

• Access and receive a copy of your data (download from Settings → Privacy).
• Rectify inaccurate data (Settings → Profile).
• Erase your data (Settings → Delete account).
• Restrict or object to certain processing (Settings → Notifications).
• Withdraw consent where processing is consent-based.
• Lodge a complaint with Information Commissioner, Isle of Man.

10. Security

We use technical and organisational measures including encryption in transit, hashed passwords, encrypted OAuth tokens, access controls, and staff authentication for admin areas.

11. Children

The Service is not directed at children under 16. We do not knowingly collect data from children.

12. Changes

We may update this policy. Material changes will be reflected by an updated version date. Where required, we will ask you to accept the updated policy on your next sign-in.

13. Contact