1. Who we are
My 5th Star is operated by Elit Virtual LLC, 1942 Broadway, Ste 314C, Boulder, CO 80302, USA. For privacy questions, contact partners@my5thstar.com or +32 499 40 97 70.
2. Two different roles
This distinction matters, because it decides who you should contact about your data.
- We are the controller for the accounts of our own customers — the estate agencies and agents who subscribe to the service — and for our website visitors.
- We are a processor for everything an agency stores about its own clients and enquirers. The agency decides what to collect and why; we only process it on their instructions. If you enquired about a property and want your data removed, contact the agency you dealt with — or write to us and we will pass it on.
3. What we process
| Whose data | What | Why |
|---|---|---|
| Account users (the agency and its team) | Name, email address, password hash, profile photo, role, phone number, professional registration numbers (e.g. BIV/IPI, BRN), billing details. | To provide the service, authenticate users, and bill the subscription. |
| Leads and enquirers (the customer's own contacts) | Name, phone number, email address, message content across the connected channels, budget, preferred area and property requirements, viewing appointments, notes, and — where voice calling is enabled — call recordings, transcripts and AI summaries. | To answer enquiries, qualify the enquiry and book viewings on the customer's behalf. |
| Website visitors | Pages viewed, referrer, an anonymous visitor identifier, and IP address (used for rate limiting and abuse prevention). | To show the customer which listings attract interest, and to protect the service. |
4. You are talking to an AI
The assistant that answers messages and phone calls is artificial intelligence, not a person. We tell people this, and our customers are contractually required not to hide it. Where the assistant makes phone calls, the caller is informed at the start of the call that they are speaking to an automated assistant and that the call is recorded and transcribed.
The assistant does not make decisions with legal or similarly significant effects. It answers questions, records what someone is looking for, and books appointments. A human at the agency remains responsible for every actual decision.
5. Legal bases
- Contract — to provide the service to our customers and bill for it.
- Legitimate interests — to keep the service secure, prevent abuse, and answer enquiries sent to us. We balance this against your rights.
- Consent — where required, for example marketing messages or recording a call in jurisdictions that require it. Consent can be withdrawn at any time.
- Legal obligation — to keep accounting records.
6. Where data is processed
The database and file storage are hosted in the European Union (Paris, France), and the application runs in the same region.
Some sub-processors operate outside the EEA. Where they do, transfers rely on the European Commission’s Standard Contractual Clauses together with additional safeguards, or on an adequacy decision where one exists. The following categories may involve a transfer outside the EEA: DeepSeek; OpenAI; Google (Gemini); Anthropic; Meta Platforms (Facebook, Instagram, WhatsApp); Twilio; Telegram; Resend; Vapi; ElevenLabs; AssemblyAI / Groq; Cloudinary; fal.ai / Kling / Runway / HeyGen; Stripe; Google (OAuth, Maps, Places/Reviews); TikTok / YouTube; Orgo.
AI model processing. By default, message content is processed by DeepSeek, which processes data in China — a country without an EU adequacy decision. Customers who require all processing to remain in the EU can request that their account uses Mistral AI (France) instead. See the sub-processor list for the full picture.
7. How long we keep it
- Customer account data — for the life of the account, then deleted within 90 days of closure, except records we must keep for accounting (7 years).
- Lead and conversation data — retained for as long as the customer keeps it. Deleted items go to a recycle bin and are purged automatically thereafter.
- Call recordings and transcripts — retained for as long as the customer keeps them; they can be deleted individually at any time.
- Rate-limiting records — minutes.
8. Your rights
Under the GDPR you may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests.
Write to partners@my5thstar.com. We respond within one month. If the data belongs to an agency’s records, we forward the request to that agency, who decides on it as the controller.
You also have the right to complain to a supervisory authority. In Belgium that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels.
9. Security
- Encryption in transit (HTTPS/TLS) and at rest.
- Every record is scoped to a single agency; the application checks ownership on every request.
- Row-level security on the database, so tables are not readable through the storage API.
- Passwords stored using bcrypt. Webhooks are signature-verified.
- Access to production data is limited to the people who need it.
10. Cookies
We use cookies that are strictly necessary to sign you in and keep your session secure. We do not use advertising cookies, and we do not sell personal data.
11. Changes
If we make a material change we will tell customers by email before it takes effect.