Privacy policy

The data controller is Royal Sybaris LLC, a Florida (United States) limited liability company, EIN 35-2983352, 2125 Biscayne Blvd, Ste 204 #27492, Miami, FL 33137, United States ("Royal Sybaris").

Contact for any question relating to personal data: privacy@royal-sybaris.com. As Royal Sybaris is not established in the European Union, it has designated Albert Satre as its representative within the meaning of Article 27 of the GDPR, who can be reached at privacy@royal-sybaris.com.

A professional who processes, on its own behalf, contact details received through the platform (contact request, off-market access request) acts as a separate controller.

• Account: last name, first name, email address, password (stored in hashed form), language, country of connection derived from the IP address at registration, account type, security settings, login dates.
• Professional profile: organization name, line of business, registration number, VAT number, address, telephone number, website, presentation, photographs, team members, professional validation information.
• Listings and content: listings, photographs and documents, public location chosen by the professional, magazine articles and author profile, reviews and review disputes.
• Contacts: contact requests (name, email address, telephone number, message), off-market access requests and confidentiality undertakings, favorites and alerts.
• Assistance tools: written or dictated answers to the AI Interview, voice recordings sent for transcription, texts submitted for rewriting or translation.
• Billing: company name, billing address, VAT number, Stripe customer identifiers and payment references, invoices, subscription and purchase history. Full card or bank account details are collected and stored by Stripe, never by Royal Sybaris.
• Referrals and partners: referral or affiliate link from which a registration originates, commissions, partners' payment references, access keys to the distribution interface.
• Communications: newsletter subscription, answers to questionnaires, exchanges with support and attachments.
• Technical data: IP address, connection and security logs, device and browser information, error reports, audit log of sensitive actions and, with consent, audience measurement data.

Data relating to the directory of professionals is described in Article 11.

• Creating and managing accounts, publishing listings and profiles, contacts, off-market access, reviews, the magazine and assistance tools: performance of the contract (terms of use).
• Sale of paid offers, payment, invoicing, subscription management, referral and affiliate programmes: performance of the contract (general sales terms) and legal accounting and tax obligations.
• Validation of professional status, content moderation, handling of reports and disputes: legitimate interest of Royal Sybaris in ensuring the reliability of the platform, and legal obligations.
• Security, prevention of fraud, abuse and automated registrations, request rate limiting, audit log and error tracking: legitimate interest.
• Service emails and onboarding emails for new accounts: performance of the contract and legitimate interest.
• Newsletter: consent, collected with confirmation of the email address.
• Questionnaires: consent of the person who chooses to answer them.
• Audience measurement and browsing analysis: consent.
• Directory of professionals: legitimate interest (Article 11).
• Responding to requests from authorities and to requests to exercise rights: legal obligations.

Data is accessible only to authorized Royal Sybaris personnel, within the limits of their duties. It is also disclosed:

• to the professional concerned, for the contact and off-market access requests addressed to it;
• to the public, for content intended for publication (listings, professional profiles, articles, reviews);
• to Royal Sybaris distribution partners, for listings and public professional information distributed on their websites;
• to administrative or judicial authorities, where required by law.

Royal Sybaris uses the following service providers, which act on its instructions:

• Vercel Inc. (United States): hosting of the platform and, with consent, cookieless audience measurement;
• Neon: database hosting;
• Amazon Web Services: file storage (photographs, documents, audio files) and machine translation (Amazon Translate);
• Stripe: payment, invoicing and subscription management portal;
• Brevo (France): sending service emails, the newsletter and onboarding messages;
• OpenAI (United States): artificial intelligence tools (AI Interview, voice transcription, text rewriting, audio versions of articles);
• Sentry (United States): detection and diagnosis of technical errors;
• Google: audience measurement (Google Analytics, Google Tag Manager), with consent, and recording of questionnaire answers (Google Sheets);
• Microsoft (Clarity), with consent: browsing analysis (heatmaps and session replay);
• OpenStreetMap Foundation (Nominatim) and Esri (ArcGIS): geocoding and map tiles, loaded from the visitor's browser when a map is displayed, which transmits the visitor's IP address to them.

Royal Sybaris does not sell personal data and does not disclose it for targeted advertising purposes.

• Account: for as long as the account is used; after closure, data is deleted or anonymized as soon as possible, except data that the law requires to be kept (invoices, accounting records).
• Account never confirmed or used: deleted 7 days after registration, a reminder being sent after 3 days.
• Contact requests: anonymized 24 months after the last exchange, unless a dispute is ongoing.
• Deleted organizations: kept for 30 days before final erasure, so that an error can be corrected.
• Exchanges with support: 3 years at most; messages classified as unwanted may be deleted after 30 days.
• Billing data: for the period required by applicable accounting and tax rules.
• Audit log of sensitive actions: kept without any possibility of modification, for as long as necessary for security, evidence and compliance with legal obligations.
• Technical logs and error reports: 3 years at most.
• Newsletter: until unsubscription. Questionnaire answers: 3 years at most.
• Cookies: 6 months for the consent choice, 90 days for referral and affiliate cookies; audience measurement cookies have the lifetime set by their provider.
• Directory of professionals: see Article 11.

Royal Sybaris is established in the United States, and several of its service providers process data there. For individuals located in the European Economic Area or the United Kingdom, these transfers are subject to appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission and, for the United Kingdom, the International Data Transfer Agreement (UK IDTA), together with supplementary measures where necessary.

A copy of the applicable safeguards can be obtained from privacy@royal-sybaris.com.

On the first visit, a banner allows visitors to accept or refuse non-essential trackers; none is enabled by default. The choice can be changed at any time through the "Cookie settings" link in the footer.

• Essential trackers, set without consent: session and login security cookies, a cookie recording the consent choice (6 months), cookies attributing a registration to the referral or affiliate link through which the visitor arrived (90 days), and browser local storage used to keep a questionnaire draft or to avoid recording a purchase twice.
• Audience measurement, with consent: Google Analytics and Google Tag Manager, Vercel Web Analytics (cookieless) and Microsoft Clarity (recording of browsing interactions, loaded only after consent). The Google tag is present on pages in consent mode: without consent, it sets no cookies.
• Advertising: no advertising trackers are used; Google's advertising signals remain denied.

Pages that display a map use third-party mapping services (OpenStreetMap, Esri), which receive the visitor's IP address in order to display the map.

In accordance with the GDPR and applicable laws, every individual has the right of access, rectification, erasure, restriction of processing, objection, in particular to direct marketing, and data portability, as well as the right to withdraw consent at any time, without affecting the lawfulness of prior processing. Individuals residing in France may also set out instructions regarding the handling of their data after their death.

Account holders exercise these rights from the "Privacy" section of their personal space (data export, deletion request, objection), or by writing to privacy@royal-sybaris.com. A response is provided within one month, which may be extended under the conditions laid down by the GDPR. Royal Sybaris may request proof of identity in case of reasonable doubt. Deletion of an account is preceded by a check of legal obligations, payments and ongoing disputes. Every newsletter email contains an unsubscribe link.

Residents of certain US states, including California, have the right to know, delete and correct their data and to opt out of its sale or sharing; Royal Sybaris does not sell or share personal data within the meaning of those laws.

Royal Sybaris implements technical and organizational measures appropriate to the risk: encryption of exchanges (HTTPS), passwords stored in hashed form, two-factor authentication available for all accounts and required for administration, role- and permission-based access control, a tamper-proof audit log of sensitive actions, request rate limiting and protection against automated registrations, session revocation and the selection of service providers offering sufficient guarantees. Payment data is processed by Stripe. As no system is perfectly secure, Royal Sybaris notifies personal data breaches to the supervisory authority and, where appropriate, to the individuals concerned, under the conditions laid down by law.

For any question or request: privacy@royal-sybaris.com, or by post to Royal Sybaris LLC, 2125 Biscayne Blvd, Ste 204 #27492, Miami, FL 33137, United States. The representative in the European Union is mentioned in Article 1.

Any individual may lodge a complaint with the supervisory authority of their place of residence, place of work or place of the alleged infringement, in particular, in France, the Commission nationale de l'informatique et des libertés (CNIL, www.cnil.fr) and, in Spain, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

This policy may be amended, in particular to reflect changes to the platform or to regulations. The version in force is published on this page with its date of update; professionals are informed of changes the next time they log in to the professional space.

Royal Sybaris publishes a directory of luxury professionals. It includes pre-listed profiles of real estate agents, real estate agencies and notaries, compiled from the information that these professionals make public on their own website. Published data: name, profession, city, country, website, languages and network. No email address, no telephone number and no data taken from listing portals is published. Each listed professional's business email address is kept internally, never published, to verify a claim or a removal request; it is erased when the listing is removed. Purpose: to present the professionals of the directory and allow them to claim their listing free of charge. Legal basis: legitimate interest, as the data are public professional data. Listed professionals may receive an email informing them of their listing; it contains a claim link and a removal link.

Visibility: as long as it is unclaimed, or while it is being claimed, a listing carries the "Listed" label, is not indexed by search engines and does not appear in the sitemap.

Claim: the claimant creates an account and is signed in immediately; if their email address is the listing's contact address and is not shared with other listings, or if the domain of their address matches that of the professional's website and is not shared with other listings, the listing is assigned to them once they confirm their address through the link received (within 7 days, failing which the claim is cancelled); otherwise, an administrator reviews the request.

Removal: each unclaimed listing offers the link "Request removal of this listing". If the address provided is the listing's contact address and is not shared with other listings, or if its domain matches that of the professional's website and is not shared with other listings, a signed removal link is sent to that address; otherwise, an administrator reviews the request, and the requester's address is erased once the request has been decided. A removed listing disappears from the site: its name, city, country, contact email address and imported data are erased. Only the professional's website address and a technical identifier of the listing, derived from its name, its country and, for short names, its city, are kept, solely to prevent the listing from being published again by a later import.

Retention: an unclaimed listing is deleted automatically 12 months after the last update of its imported data. This data is not processed by artificial intelligence.