Privacy Policy for AcrossEstate

Effective date: 23 August 2026

1. Scope and applicable data protection framework

This Privacy Policy explains how personal data is processed when AcrossEstate is used.

AcrossEstate is an international real estate platform operated by Black Coast Capital LLC, which has its legal seat in Georgia. The platform is intended for users, prospective buyers, purchasers, developers, brokers, distribution partners and other business partners in Georgia and in other countries, including the European Union and the European Economic Area.

Personal data is processed in accordance with the data protection laws that apply to the relevant processing activity. These include, in particular, the Law of Georgia on Personal Data Protection. Where the requirements of its territorial scope are met, the General Data Protection Regulation of the European Union also applies, including where AcrossEstate deliberately offers services to individuals in the European Union. The application of the General Data Protection Regulation is not limited to Germany.

Personal data means any information relating to an identified or identifiable natural person. This may include, in particular, a name, contact details, account data, profile data, inquiry information, usage data, technical connection data and information relating to real estate interests.

2. Controller

The controller responsible for the processing of personal data in connection with AcrossEstate is:

Black Coast Capital LLC

Legal Address:
Georgia, Tbilisi
Nadzaladevi District
Erosi Manjgaladze Street N 75a

Identification Number: 400459240

Privacy inquiries: privacy@acrossestate.com
Support: support@acrossestate.com
Legal inquiries: legal@acrossestate.com
Telephone: +995 599 201 329

Black Coast Capital LLC determines the purposes and essential means of processing unless this Privacy Policy expressly describes another party as independently responsible for a particular processing activity.

3. Principles of processing

Personal data is processed lawfully, fairly and transparently and only for specified, explicit and legitimate purposes. Processing is limited to what is necessary for the relevant purpose. Data should be accurate and, where necessary, kept up to date. It is not retained for longer than required by the relevant purpose or by a legal obligation.

AcrossEstate takes data protection into account when designing and developing technical functions and applies appropriate technical and organisational measures to protect personal data.

4. Legal bases for processing

Depending on the processing activity, personal data is processed on one or more grounds permitted under Georgian data protection law. These may include the consent of the data subject, necessity for a contract or pre-contractual measures, compliance with legal obligations, protection of legitimate interests and other grounds expressly permitted by applicable law.

Where the General Data Protection Regulation applies, processing is carried out in particular on the following grounds:

1. Article 6(1)(a) for processing based on consent.
2. Article 6(1)(b) for processing necessary for the performance of a contract or in order to take steps at the request of the data subject before entering into a contract.
3. Article 6(1)(c) for processing necessary to comply with a legal obligation.
4. Article 6(1)(f) for processing necessary for legitimate interests, unless the interests or fundamental rights of the data subject override those interests.

Legitimate interests may include, in particular, the secure and stable operation of the platform, prevention of fraud and misuse, protection of accounts and documents, proper handling and documentation of real estate inquiries, quality assurance of project information, establishment, exercise and defence of legal claims and the appropriate development of the platform.

5. Required and voluntary information

Forms and account functions indicate which information is required for the relevant function. If required information is not provided, the relevant function may not be available. This may include, for example, an email address for creating an account or contact information necessary to handle a specific real estate inquiry.

Other information is voluntary. Failure to provide voluntary information will generally not result in the refusal of an otherwise available core function. Unless expressly stated otherwise for a specific collection activity, there is no general statutory obligation to provide personal data to AcrossEstate. Certain information may, however, be contractually required or necessary in order to take pre-contractual steps requested by the user.

6. Technical provision and server logs

When AcrossEstate is accessed, technically necessary information is processed. This may include, in particular:

1. IP address.
2. date and time of access.
3. requested address and resource.
4. browser type and browser version.
5. operating system and device information.
6. referrer information.
7. language settings.
8. technical error data.
9. security events.
10. connection and server logs.

This processing serves, in particular, to deliver the platform, establish technical connections, protect against attacks and misuse, analyse errors, ensure availability and maintain technical security.

7. Technical infrastructure and service providers

AcrossEstate uses external technical service providers to operate the platform. At present, these include in particular:

1. Lovable Cloud for production cloud functions, authentication integration and transactional communications.
2. Supabase for database, authentication, storage and backend functions.
3. Cloudflare for DNS, network, security, content delivery and comparable infrastructure functions.
4. Infomaniak for domain, email or infrastructure services where the relevant function is operated through that provider.
5. Hostinger for hosting or infrastructure services where the relevant function is operated through that provider.
6. Mapbox for maps and geographic visualisation.
7. Google and, where applicable, Apple when a user voluntarily selects the corresponding external sign in method.

Where a service provider processes personal data solely on behalf of Black Coast Capital LLC, it is engaged as a processor or in a comparable role under applicable law. Where a provider processes personal data for its own purposes, it may be an independent controller for that processing.

The technical architecture may evolve over time. Material changes that are relevant to users will be reflected in this Privacy Policy.

8. Cloud region

The central cloud and backend infrastructure of AcrossEstate is currently operated in the Europe region.

Use of a European cloud region does not mean that every individual processing operation takes place exclusively within the European Union or the European Economic Area. Individual service providers, subprocessors, support systems or project-related recipients may process data in other countries. International transfers are explained in section 26.

9. Registration and user account

The following data may be processed to create and manage an AcrossEstate account:

1. first name and last name.
2. email address.
3. telephone number.
4. country or country of residence.
5. preferred language.
6. preferred currency.
7. internal user identifier.
8. registration and confirmation timestamps.
9. account status.
10. authentication and security information.
11. records of consent and acknowledgement where documentation is required.

The data is processed to establish the account, authenticate the user, protect account security, provide personalised functions and manage settings selected by the user.

Passwords are not stored by AcrossEstate in plain text. Technical processing of sign in credentials is carried out through the authentication infrastructure used by the platform.

10. Sign in through external identity providers

AcrossEstate may allow users to sign in through external identity providers, in particular Google and, where applicable, Apple.

If a user selects such a sign in method, information required for authentication is exchanged between the chosen identity provider, the authentication infrastructure used by AcrossEstate and AcrossEstate itself. The information transferred depends on the provider, the technical configuration and the settings selected by the user with that provider.

The independent processing carried out by Google, Apple or another identity provider is also subject to the privacy information of the respective provider.

11. User profile, language, currency and settings

Signed in users may enter or change profile and preference information. This may include, in particular, name, telephone number, country of residence, language, currency and other account settings.

This data is processed to manage the user account, prefill inputs, adapt the user interface and provide requested functions.

12. Saved projects, units, comparisons and search functions

Signed in users may save projects or individual units and, where offered, compare them or use saved search configurations.

The data processed may include a user identifier, saved project, saved unit, time of saving, search parameters, comparison selections and function-related settings.

This processing is carried out solely to provide the platform functions requested by the user and to restore personal working states.

13. Real estate inquiries

Users may submit inquiries through AcrossEstate regarding projects, units or available real estate opportunities.

Depending on the inquiry, the following data may be processed in particular:

1. first name and last name.
2. email address.
3. telephone number.
4. preferred language and contact method.
5. message and voluntary information.
6. project concerned.
7. unit type or specific unit concerned.
8. time of the inquiry.
9. processing status.
10. responsible organisation or project partner.

The data is processed to record the inquiry, assign it to the correct project, respond to it, enable follow up questions and prepare further handling by the contact responsible for the relevant opportunity.

A real estate inquiry does not constitute consent to general marketing communications.

14. Handling and forwarding of real estate inquiries

Real estate inquiries are generally first recorded through AcrossEstate and may be handled by Black Coast Capital LLC or by employees and service providers acting on its behalf.

Depending on the project, an inquiry may subsequently be forwarded to the developer, broker, distribution partner or other contact responsible for the specific opportunity. For projects that are available through or serviced by Black Coast Capital LLC, Black Coast Capital LLC may handle the inquiry itself and coordinate further communication with the relevant developer.

Black Coast Capital LLC maintains its own distribution relationships for certain projects and may hold exclusive distribution rights for individual projects, regions or markets. Such exclusivity is stated only where it actually exists for the relevant project.

Data is forwarded only where this is objectively necessary and legally permitted for the specific inquiry, the requested communication or the initiation of further steps.

15. Project partners as independent controllers

Developers, sellers, brokers or other project partners may process personal data for their own purposes after receiving an inquiry, for example to verify availability, prepare an offer, prepare a contract or continue customer communications.

Where such a partner independently determines the purposes and means of its further processing, it is independently responsible for that processing. Its own privacy information and the legal requirements applicable to it then apply in addition.

AcrossEstate seeks to identify the relevant partner in a transparent manner in connection with the inquiry or on the relevant project page.

16. Professional accounts for developers and brokers

AcrossEstate may allow professional users to register as developers, brokers, distribution partners or other industry partners.

Additional data processed for this purpose may include, in particular, company name, business contact details, position, authority to represent the company, registration or identification information, website, project assignment, submitted documents, communication history and verification status.

Registration does not create an automatic right to approval or publication. AcrossEstate may verify information and authority before a professional account or content is made public.

17. Partner verification and personal data from other sources

For the verification of professional partners and project information, data may also be obtained from other sources. These may include publicly accessible registers, official company websites, documents provided by the relevant company, developers, brokers, business partners or other reliable sources.

Where personal data is not collected directly from the data subject, Black Coast Capital LLC informs the data subject about the processing, the relevant categories of data and the source in accordance with applicable law, unless a statutory exception applies. Under Georgian data protection law, this information is provided within a reasonable period and generally no later than ten working days after obtaining the data unless a statutory exception applies. Where the General Data Protection Regulation applies, the information requirements of Article 14 are also observed.

The processing serves, in particular, identity and company verification, quality assurance, fraud prevention, verification of publication rights and the provision of reliable platform information.

18. Documents, downloads and access logs

AcrossEstate may provide project documents, floor plans, brochures, price lists, payment plans or other materials. Certain documents may be available only to signed in users or after an access check.

For secure provision, the data processed may include a user identifier, document identifier, project reference, time of access, authorisation status and technical security information.

Access may be logged in order to enforce permissions, prevent misuse, trace the source of sensitive materials and investigate security incidents.

19. Support and general communications

If users contact AcrossEstate by email, telephone, form or another communication channel offered by the platform, the data they provide is processed.

This may include, in particular, name, contact details, content of the message, projects concerned, attachments, time of communication and previous communication history.

The data is processed to handle the request, document the communication, carry out necessary follow up steps and, where required, establish, exercise or defend legal claims.

20. Aubrey Company Germany

Aubrey Company Germany supports AcrossEstate and Black Coast Capital LLC, in particular with communications, marketing, content preparation and operational support in the German speaking and European environment.

Where Aubrey Company Germany processes personal data solely on the instructions of Black Coast Capital LLC and for its purposes, the processing is carried out as a service provider or processor in accordance with applicable law. Access is limited to the data required for the relevant task.

Aubrey Company Germany may carry out service communications, project communications or organisational communications on behalf of AcrossEstate. Personal data is not used for independent advertising purposes merely because an individual has submitted a real estate inquiry.

21. Marketing and promotional communications

General marketing communications are kept separate from the handling of specific real estate inquiries.

Where consent is required for marketing, promotional communications are sent only on the basis of valid consent. Consent is voluntary and may be withdrawn at any time with effect for the future.

Under Georgian data protection law, personal data is generally processed for direct marketing only with the consent of the data subject. Withdrawal must be easy to exercise. Processing for direct marketing is discontinued within a reasonable period after a valid withdrawal is received and, under Georgian data protection law, no later than seven working days. Evidence of the granting and withdrawal of marketing consent is documented in accordance with statutory record keeping requirements.

Project related responses, status information and communications necessary to handle a specific inquiry are not treated as general marketing solely because they relate to a commercial real estate opportunity.

22. First-Party Analytics and Project Engagement

AcrossEstate operates its own first-party measurement of platform use, known as Analytics and Engagement. It runs only after consent to the "Analytics and engagement" category in the consent manager and can be withdrawn at any time.

No Google Analytics, no Meta Pixel, no TikTok Pixel and no other external analytics or advertising service is used. There is no cross-site advertising tracking, no session recording, no advertising identifier and no advertising profile.

Legal basis. Consent (Article 6(1)(a) of the General Data Protection Regulation where applicable, the corresponding provisions of Georgian data protection law, and Article 5(3) of the ePrivacy Directive for storing and reading information on the device). No measurement takes place before consent.

Consent record. Each acceptance is recorded on the server as a consent receipt containing the consent version, the categories accepted, the language shown and the time of acceptance. The receipt records the decision of the browser that gave it and is not linked to a user account. Every measurement event is verified against a valid receipt before it is stored; without a valid receipt nothing is recorded.

Events measured. Exactly the following factual events, and nothing else:

1. opening a project page;
2. opening a comparison;
3. saving or unsaving a project;
4. saving or unsaving a unit;
5. measured engagement, meaning the time a page was genuinely visible in the active browser tab.
6. sustained meaningful visibility of a named project section for about 1.2 seconds;
7. active viewing of an item in the full media viewer, excluding thumbnail impressions;
8. explicit interaction with a unit type, such as opening its details, interiors or available units.

An event may additionally carry the project, unit, media, unit-type or closed section reference, the language, the internal path and a random session identifier that exists only for the current browsing session.

Not processed as analytics data: free text, search terms, message content, IP addresses stored as event data, device fingerprints, advertising identifiers and special categories of data. Submitting an inquiry, creating or using a personal share link, resolving a share link and accessing a document are functional processes described elsewhere in this Privacy Policy. They are not analytics events and do not depend on analytics consent.

Signed-in users. Whether an event is associated with an account is decided at the moment the event occurs, on the basis of the sign-in session verified at that moment. Where a user is signed in, these factual signals may be linked to the account and made visible to authorised AcrossEstate staff, so that advice is based on facts rather than assumptions. Events recorded while nobody was signed in are not attached to an account afterwards.

Withdrawal and retention. See the sections on retention periods and on withdrawal and objection.

Technically necessary server, security and operational logs are not affected by this statement. They serve the operation and security of the platform and not the creation of marketing profiles.

Certain calculations, filters, comparisons and scenario functions may run locally on the user's device. Where input values are processed exclusively locally and are not transmitted to AcrossEstate or an external service, Black Coast Capital LLC does not process those input values on its servers.

23. Mapbox and map functions

AcrossEstate uses Mapbox to display interactive maps and geographic information.

When a Mapbox map is loaded, technically necessary requests are sent to Mapbox systems. Personal data processed in this context may include IP address, device and browser information, session information, requested map resources, map positions and technical usage information.

Where a function is intended to use the current device location, that location is used only after the browser or operating system grants the relevant permission. Simply viewing a map does not automatically mean that AcrossEstate accesses the precise location of the device.

According to information published by Mapbox, certain IP-related log data may be stored for a limited period. Independent processing by Mapbox is also subject to Mapbox's own privacy information.

24. Cookies and local storage

AcrossEstate uses technically necessary storage mechanisms and local browser functions where they are required for sign in, security, consent management, language, currency, restoration of user preferences or other functions requested by the user.

The consent manager currently offers exactly three categories: Necessary, Preferences, and Analytics and engagement. Marketing is not active and is not offered, and no external marketing or analytics pixel is used.

Consent administration is distinguished from behavioural analytics storage:

1. acrossestate.cookies — consent administration. The categories chosen, the consent version and the time of the decision.
2. acrossestate.analyticsReceipt — consent administration. The identifier of the server-side consent receipt issued for this browser, together with a one-time withdrawal key, so that the consent can be verified and withdrawn. It measures nothing itself.
3. acrossestate.analyticsWithdrawalPending — consent administration. Kept only where a withdrawal could not yet be confirmed by the server, so that it can be completed later. It never enables analytics.
4. ae.visitor.session — analytics and engagement. A random session identifier created only after consent, removed when the browsing session ends or consent is withdrawn.

Other locally stored information may include a currency preference, an indication of whether that preference was explicitly selected, and temporary claim or linking tokens.

Storage or access mechanisms that are not necessary are activated only after consent where applicable law requires such consent.

Further details are provided in the information on cookies and local storage.

25. Recipients and categories of recipients

Personal data may be disclosed, where necessary for the relevant purpose and legally permitted, in particular to the following recipients or categories of recipients:

1. employees and internally authorised persons of Black Coast Capital LLC.
2. Aubrey Company Germany in connection with commissioned communications and operational support.
3. cloud, database, authentication, email, hosting, security and infrastructure service providers.
4. Mapbox for map functions.
5. external identity providers where the user voluntarily selects their sign in method.
6. developers, sellers, brokers and distribution partners where this is necessary to handle a specific inquiry.
7. professional advisers, auditors, legal advisers or public authorities where there is a legal obligation or a legitimate legal reason.

Black Coast Capital LLC does not sell personal data to data brokers as a separate business model.

26. International processing and data transfers

Black Coast Capital LLC has its legal seat in Georgia. AcrossEstate's principal technical infrastructure is operated in the Europe region. At the same time, because of the international structure of the platform, personal data may be processed or transferred between Georgia, Member States of the European Union, States of the European Economic Area and other countries.

Georgia currently does not benefit from an adequacy decision of the European Commission under Article 45 of the General Data Protection Regulation. Where personal data protected by the General Data Protection Regulation is transferred from the European Union or the European Economic Area to recipients in Georgia or another third country without an adequacy decision, the transfer is carried out only on a lawful basis under Chapter V of the General Data Protection Regulation. Depending on the circumstances, this may include appropriate safeguards such as Standard Contractual Clauses or a statutory derogation.

Where Georgian data protection law applies to a transfer to another country or an international organisation, the requirements and safeguards provided by that law are also observed.

Individual technical providers may use systems or subprocessors outside Europe. Mapbox, for example, also operates technical infrastructure in the United States. Information about safeguards used for a specific transfer may be requested from privacy@acrossestate.com where the data subject has a corresponding right to receive that information.

27. Retention periods

Personal data is retained only for as long as necessary for the relevant purpose or for as long as legal, contractual or legally recognised documentation requirements justify further retention.

The following criteria apply in particular:

1. account data is generally retained for the duration of the user account and is deleted or anonymised after termination unless retention is required.
2. saved projects, units and personal search functions are generally retained until deleted by the user or until the account is terminated.
3. real estate inquiries and related communications are retained for handling and afterwards for an appropriate documentation period where necessary for evidence, potential claims or legal obligations.
4. support communications are retained for handling and an appropriate evidentiary period.
5. security and access logs are retained only for as long as required for security, evidentiary and misuse prevention purposes.
6. evidence of consent to and withdrawal from direct marketing is documented under Georgian data protection law for the duration of the direct marketing and for one year after it has ended.
7. external service providers may apply their own purpose-related retention periods. According to currently published information, Mapbox may retain certain IP-related log data for up to 30 days.
8. consent-based analytics and engagement events are retained for a maximum of 180 days from the time they occurred and are then deleted. Withdrawing analytics consent deletes the events recorded under the withdrawn consent receipt earlier than that. Minimal evidence of consent and of its withdrawal may be retained separately for accountability and for legal claims; it contains no behavioural history.

Data is deleted or anonymised when the processing purpose ceases to exist and there is no legal basis for further retention.

28. Rights under Georgian data protection law

Subject to the requirements of Georgian data protection law, data subjects have rights including rights to receive information about processing, obtain access to their data, receive copies, have inaccurate or incomplete data corrected, updated or completed, request termination of certain processing, request erasure or destruction, request blocking, exercise data portability in the cases provided by law, withdraw consent and receive protection against certain solely automated decisions.

The precise scope of each right depends on the statutory conditions and applicable exceptions. Georgian data protection law provides specific response periods for various data subject requests.

Requests may be sent to privacy@acrossestate.com.

29. Rights under the General Data Protection Regulation

Where the General Data Protection Regulation applies, data subjects have, subject to the statutory requirements, in particular the following rights:

1. access under Article 15.
2. rectification under Article 16.
3. erasure under Article 17.
4. restriction of processing under Article 18.
5. notification in connection with rectification, erasure or restriction under Article 19.
6. data portability under Article 20.
7. objection under Article 21.
8. protection in relation to solely automated decisions under Article 22.
9. withdrawal of consent with effect for the future.

Requests are handled within the periods required by law. Under the General Data Protection Regulation, information on action taken on a request is generally provided within one month unless a legally permitted extension is necessary.

30. Withdrawal and objection

Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before the withdrawal.

Consent to Analytics and engagement can be withdrawn at any time through "Manage cookies". Withdrawal stops any further measurement in that browser immediately, revokes that browser's analytics consent receipt and deletes the behavioural events recorded under it. Core platform functions are not affected, and withdrawal does not require being signed in.

Where the General Data Protection Regulation applies and processing is based on legitimate interests, the data subject may object on grounds relating to their particular situation where the statutory conditions are met.

Under the General Data Protection Regulation, a data subject may object to direct marketing at any time. Where Georgian law requires consent for direct marketing, its specific withdrawal rules also apply.

31. Rectification, erasure and account deletion

Users may change certain account and profile data directly through the account functions provided.

Requests for rectification or erasure may also be sent to privacy@acrossestate.com.

Where AcrossEstate provides a direct account deletion function, it may be used. Alternatively, deletion of an account may be requested through the privacy contact.

Deletion of an account does not necessarily result in immediate deletion of every related item of information. Data may continue to be retained where this is necessary and lawful for compliance with legal obligations, completion of open matters, fraud and security prevention or the establishment, exercise or defence of legal claims.

32. Complaints

Data subjects may contact privacy@acrossestate.com at any time with privacy questions or complaints.

Under Georgian data protection law, data subjects may apply to the State Audit Office of Georgia where it has jurisdiction over the relevant data protection matter.

Where the General Data Protection Regulation applies, Article 77 also provides a right to lodge a complaint with a competent supervisory authority in the European Union. This right may in particular be exercised in the Member State of the data subject's habitual residence, place of work or place of the alleged infringement, subject to the statutory requirements.

33. Data security

Black Coast Capital LLC applies appropriate technical and organisational measures to protect personal data according to the relevant risk.

These measures may include, in particular:

1. role-based access permissions.
2. authentication and authorisation controls.
3. technical database rules limiting access.
4. logging of security-related operations.
5. protected document access.
6. encrypted transmission where technically implemented.
7. measures to ensure confidentiality, integrity and availability.
8. organisational rules for employees and service providers.
9. backup and recovery measures within the infrastructure used.
10. regular review and adjustment of security measures according to risk.

Complete technical security configurations are not published for security reasons.

34. Personal data breaches

Security incidents involving personal data are documented, assessed and handled in accordance with the applicable legal requirements.

Where the requirements of Georgian data protection law are met, Black Coast Capital LLC generally notifies the State Audit Office of Georgia of a reportable incident no later than 72 hours after identifying it. Where notification of affected individuals is legally required, this is also carried out in accordance with the applicable rules.

Where the General Data Protection Regulation applies, the obligations under Articles 33 and 34 are observed in addition.

35. Minors

Publicly accessible content on AcrossEstate may generally be viewed without registration.

Registration of a regular user account and use of contractual, inquiry-related or future payment-related functions are generally intended for individuals aged 18 or over.

AcrossEstate is not designed as a service for children and does not intentionally process personal data of minors for marketing purposes. If personal data relating to a minor is processed, the specific safeguards required by applicable law are observed.

36. No AI decisions and no legally significant automated decisions

AcrossEstate currently does not use artificial intelligence to make legally binding assessments of users, determine whether a user may purchase a property or make other decisions producing legal or similarly significant effects solely by automated means.

Search filters, sorting, comparisons, local calculations, scenario functions or general recommendations do not by themselves constitute a legally binding decision about a user.

If AcrossEstate introduces processing in the future that qualifies as automated decision making under applicable data protection law, the required information and safeguards will be implemented before that processing is introduced.

Project views, visit counts and measured engagement may be shown to authorised AcrossEstate staff as factual information about what an interested person actually looked at. AcrossEstate does not currently derive a buyer score, a hot or cold rating, a purchase probability or an automated eligibility decision from these signals.

37. Changes, language versions and version status

This Privacy Policy will be updated where processing activities, technical systems, service providers or legal requirements change materially.

AcrossEstate provides maintained versions of this Privacy Policy in German, English and Georgian. For other platform languages, the English version may be displayed. The language versions are intended to communicate the same data protection information. Mandatory rights of data subjects are not restricted by differences in language.

The current version and its effective date are available on AcrossEstate.