Legal
Privacy Policy
What BuyerIQ collects, the lawful basis for each use, every company that receives it, how long we keep it, and the eight rights you hold over it. Written to be read rather than to be survived.
01
Who is responsible
BuyerIQ is the data controller for everything described here. We are an independent property analytics service operating from Dublin, and this policy covers the website at buyeriq.ie and the API behind it.
Anything about this policy or your data goes through our contact form, or by email to privacy@buyeriq.ie.
02
What we collect
- Account data. Your email address, and a password hash held by our authentication provider. We never see the password itself.
- Searches. The addresses you look up, which pages you open, and which features you use. Your searches are how the service works, and they are also the most sensitive thing we hold, because the property you are researching says something about your intentions.
- Payment data. Handled end to end by Stripe. We never receive or store a card number. What reaches us is your Stripe customer ID, your subscription status and your billing email.
- Alert preferences. Saved searches and the notification settings attached to them.
- Technical data. IP address, browser, operating system and screen size, collected by the measurement scripts listed in section four and used to keep the service working and to count usage.
What we do not collect
We ask for an email address and nothing else. No name, no phone number, no address of your own, no income, no employment details, and no documents. The affordability tools run entirely in your browser and the figures you enter are never transmitted to us.
03
What we use it for, and under which lawful basis
Article 6 requires a specific lawful basis for each purpose rather than one basis for everything, so they are set out separately.
| Purpose | Lawful basis |
|---|---|
| Producing reports, valuations, comparables and alerts | Performance of a contract (Art. 6(1)(b)) |
| Taking payment and managing your subscription | Performance of a contract (Art. 6(1)(b)) |
| Transactional email: verification, password reset, receipts, alerts you asked for | Performance of a contract (Art. 6(1)(b)) |
| Keeping records for tax | Legal obligation (Art. 6(1)(c)) |
| Rate limiting, fraud and abuse prevention, service health | Legitimate interests (Art. 6(1)(f)) |
| Aggregated, anonymised market statistics | Legitimate interests (Art. 6(1)(f)) |
| Analytics, product measurement and advertising attribution | Consent (Art. 6(1)(a)), and see the note below |
| Marketing email | Consent (Art. 6(1)(a)), withdrawable at any time |
We do not sell your personal data, to anyone, in any form. We have never done so and the business does not depend on it.
Correcting the record
The measurement and advertising scripts described in our cookie policy require your consent, and they now wait for it: nothing in that group loads until you accept, and Accept all and Reject all are offered with the same weight.
An earlier version of this policy said we ran no advertising and used no tracking cookies. That was inaccurate, and it had been for some time. We would rather say so here than quietly restate it.
04
Who else receives it
The first group are processors: they handle data on our instructions, under contract, and for no purpose of their own.
- Authentication and database (EU region). Holds your account and everything the service stores against it.
- Stripe. Payments. Stripe is an independent controller for its own fraud and compliance purposes.
- Website hosting and delivery. Serves the pages you are reading.
- API hosting. Runs the analysis behind each report.
- Error monitoring (EU region). Diagnostics when something breaks. Reports carry a message, a stack trace and a page domain, never a full URL, an address or a token, and are deleted after 90 days.
- Website analytics (EU-hosted). Cookieless, and described in full in the cookie policy.
The second group are independent controllers. They decide their own purposes for what their scripts collect, and they process it under their own policies rather than ours:
- Google (Google Analytics 4). Audience and conversion measurement.
- Microsoft (Clarity). Interaction and layout diagnostics.
- Reddit (Reddit Ads pixel). Advertising attribution.
Beyond these, we share nothing. We will disclose data if compelled by a court or by law, and we will tell you if we are permitted to.
05
International transfers
Our database, error monitoring and website analytics all hold data in the European Union, so no transfer arises there. Payment processing, website hosting and API hosting may process outside the European Economic Area under Standard Contractual Clauses.
Google, Microsoft and Reddit are United States companies, and data their scripts collect is transferred to the United States. Each relies on its own transfer mechanism, published in its own privacy policy, which is the EU-US Data Privacy Framework or Standard Contractual Clauses depending on the provider. Because we do not control those transfers, the surest way to prevent yours is to decline the scripts, by any of the methods on the cookie page. That stops the transfer from happening at all.
06
How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Account data | While the account is active, then erased within 30 days | To operate the account |
| Search history | 12 months, then anonymised | Service improvement |
| Purchased reports | While the account is active | You paid for continued access |
| Payment records | 7 years | Required by Irish tax law |
| Error diagnostics | 90 days | Diagnosing faults |
Deleting your account removes the account data on the schedule above. Payment records survive it, because a legal obligation to retain them overrides erasure. This is the one case where we cannot honour a deletion request in full, and we would rather tell you now than at the point of asking.
07
Your rights
You hold eight rights over your data, and exercising any of them is free. They are set out in full, with what each one means in practice, on our GDPR page.
- Access a copy of everything we hold about you.
- Rectify anything inaccurate.
- Erase your data, subject to the tax exception above.
- Port it to another service in a machine-readable format.
- Restrict processing while a dispute is resolved.
- Object to processing we base on legitimate interests.
- Withdraw consent at any time, without affecting what came before.
- Complain to the Data Protection Commission.
Use the contact form, or email privacy@buyeriq.ie. We reply within 30 days, as Article 12 requires, and in practice much sooner.
08
Cookies and tracking
Two cookies keep you signed in and are strictly necessary. Three further cookies come from Google Analytics, Microsoft Clarity and the Reddit Ads pixel, and are not. Each one is listed by name, purpose and lifetime, with instructions for refusing it, in our cookie policy.
09
How we protect it
- Encrypted in transit. TLS everywhere, including between our own services.
- Passwords are hashed with bcrypt by our authentication provider. We cannot read yours, and neither can anyone who obtained the database.
- Restricted production access, limited to those who need it to operate the service.
- Row-level isolation so one account cannot reach another's data.
No system is beyond compromise. If a breach affects your rights we will notify the Data Protection Commission within 72 hours and tell you directly where the regulation requires it.
10
Property data is not personal data
The sales, valuations and area statistics BuyerIQ publishes come from public records: the Property Price Register, published by the Property Services Regulatory Authority; the SEAI building energy rating register; Central Statistics Office data; and mapping and environmental datasets from the Office of Public Works, the Environmental Protection Agency and Ordnance Survey Ireland.
Those records describe properties, not people. The Property Price Register deliberately omits the names of buyers and sellers, and we neither hold nor infer them. If you believe an entry about a property is wrong, tell us through the contact form and we will investigate. Where the error originates in the public record itself, it has to be corrected at source with the body that published it.
11
The withdrawn browser extension
BuyerIQ previously offered a Chrome extension that added a valuation panel to Daft.ie and MyHome.ie listings. It was withdrawn from the Chrome Web Store in September 2026 and is no longer distributed, supported or available to install.
This clause remains because anyone who installed it before it was withdrawn may still have it running. For as long as it does, it behaves as it always did: it reads the public listing fields on the page you are viewing (address, asking price, bedrooms, BER, floor area, agent reference), sends those over HTTPS to api.buyeriq.ie to return a valuation, and keeps your tokens and watchlist in chrome.storage on your own machine. It carries no analytics, telemetry or advertising SDK, and reads nothing outside those domains.
Uninstalling it deletes everything it stored on your device immediately, and we would encourage you to do so — the web app is where the product is now maintained. If you want the data it sent us erased, use our contact form.
12
Children
BuyerIQ is intended for adults buying property and is not directed at anyone under 18. We do not knowingly collect data from minors, and we will delete it if we discover we have.
13
Changes to this policy
We update this policy when what we do changes. The date at the top always reflects the current version, and material changes are announced by email or by a notice on the service before they take effect.
14
Contact and complaints
Write through the contact form, or to privacy@buyeriq.ie. If our answer does not satisfy you, you have the right to complain to the supervisory authority, which for Ireland is the Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
dataprotection.ie
You can complain to them directly. You do not have to raise it with us first, though we would prefer the chance to put it right.