1. What this version changes
This version changes optional analytics for signed-in users. After a new affirmative analytics choice, selected activity is linked to your account ID, display name and email address in our self-hosted Umami instance. A previous analytics acceptance does not authorise this additional collection. The separate Session Replay choice and its existing capture limits continue to apply. The rest of our privacy information continues to apply.
You can read the preceding notice at Privacy Policy version 2026-10-16-umami-replay-v2.
Controller and Processor Roles. Emvadon remains the controller for accounts, authentication, and payments, as well as billing, security, support and consented product analytics. Where an organisation provides Customer Content containing third-party personal data, that organisation is normally the controller and Emvadon acts as processor on its documented instructions; a data processing agreement may be requested for Enterprise orders. Do not upload special-category personal data without a defined written agreement and lawful basis.
We process billing legal name, billing address, VAT/tax identification number where provided, invoice and tax records. Our payment processor provides invoicing and tax compliance support. The preceding notice identifies operational recipients used for transactional email delivery, MaxMind login risk and geo enrichment, Cloudflare Turnstile and the first-party browser/device security signal during sign-in, organisation sign-in (SSO), and related MFA flows. It also identifies HERE mapping, Cal.com scheduling, and Instatus status communications. The security technologies support account protection and are independent of your analytics choice. Where transfers occur outside the EEA, the preceding notice describes use of the EU–US Data Privacy Framework, Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism as applicable.
2. Optional identified analytics
We use a self-hosted Umami instance to measure selected page views and product events only after affirmative analytics consent. Guest activity carries no account profile details. For a signed-in user, we send the account ID and, where available, the display name and email address from the signed-in profile as session properties. We also retain the existing stable, hashed analytics identifier to link activity across visits and devices. This can associate earlier recorded activity linked to the same identifier with your account details. This is identifiable personal data, not anonymous data. A signed-in label records the state reported when activity was collected; it does not indicate that the person is currently online or provide an authentication audit.
Account ID, display name and email address are confined to the identified session properties. We do not send authentication credentials, organisation identifiers, security fingerprints, raw search queries, arbitrary free text, exact coordinates, parcel or property identifiers, full dynamic URLs, URL fragments, titles or raw referrers for this analytics purpose. Session Replay is a separate purpose described below.
3. Optional Session Replay
Session Replay is an optional video-like reconstruction of interactions with selected pages. It is separate from optional analytics. We do not start Replay unless you make the separate Replay choice in Cookie Settings; agreeing to analytics alone does not authorise Session Replay. Agreeing to an earlier Replay version does not authorise this version of Session Replay.
Replay is limited to the public homepage, About and pricing pages, and the signed-in dashboard, Portfolio, listings index, Market Intelligence and Planning Explorer. It records readable visible on-page text and sampled image frames when you interact with a map. The captured text and map frames may include displayed personal, account or property information, property locations and map areas on an eligible page. Form controls and input values, including credentials, other media, and content explicitly marked as a private region are excluded. Account, authentication, billing, client, document and dynamic-detail routes are excluded from replay.
Each replay recording is limited to five minutes and starts only after the person has expressly consented. Map frames are sampled at no more than one per second and may be less frequent under recording budgets; they are not a full-motion map recording or a complete route video. Heatmaps are not enabled. Replay is available only to the existing restricted owner role. The exclusions limit what the recorder can collect; they do not mean that future page changes are automatically safe to record.
4. Purpose, access and retention
We use optional analytics and Session Replay to understand how selected parts of the Service are used and to improve them. Identified analytics lets the restricted owner role recognise which consenting account performed the recorded activity. Access to the analytics dashboard, account session properties and replay is limited to that existing restricted owner role. Account details are stored with the analytics session in our self-hosted Umami instance and can remain visible with earlier activity after you sign out or change your profile. Properties show the latest values reported for each session; they are not a profile-change history. An unavailable name or email is recorded as an empty property value.
Analytics and replay records in our self-hosted Umami instance have no automatic expiry under the current configuration, and there is no current automatic deletion schedule. You may use the contact route in section 6 to make an applicable data-protection rights request.
5. Your choices
You can reject or withdraw analytics and Session Replay choices separately at any time in Cookie Settings in the site or signed-in app footer. Choosing not to allow analytics does not prevent use of the Service. Withdrawing analytics stops future analytics collection and replay capture; withdrawing Replay alone stops future replay capture. Withdrawal or signing out does not itself erase session properties or records already collected, or affect the lawfulness of processing before withdrawal. A previous rejection remains respected. A previous analytics acceptance requires a fresh affirmative choice before account profile details are collected.
These preferences do not affect essential cookies needed for login, security or remembering your privacy choice. They do not control the separate security technologies described in the preceding notice.
6. Contact and rights
Applicable rights include access, rectification, erasure, restriction, Data portability, objection and Withdraw consent. For questions about this processing or to exercise applicable data-protection rights, contact . Use Cookie Settings to withdraw optional analytics or Replay consent. The preceding notice's retention terms, including up to 12 months for security, login and operational logs and up to 7 years for contract, acceptance, withdrawal, invoice, tax, refund and dispute evidence, continue to apply.