Privacy Policy

This Privacy Policy explains how Isle & Key(“we,” “us,” or “the portal”) handles information collected from people who visit isle-and-key.vercel.app, submit inquiries to listing agencies, or register as an agency to publish listings. We designed this portal so most browsing happens without you having to identify yourself, and so any information you do share goes only where it needs to go.

Who we are

Isle & Key is a property classifieds portal focused on St Kitts & Nevis. We are the controller of the personal data described below for the purpose of operating the portal.

Information we collect

From buyers and visitors

• Inquiry informationyou submit through a listing's contact form — name, email, optional phone, message, budget range, and whether you have expressed interest in the Citizenship by Investment program.
• Contact form messages sent through our contact page.
• Technical data automatically logged by our hosting provider, including IP address, user-agent string, and timestamps. We use these to prevent abuse and operate the service.

From agencies

• Account information you provide during registration — agency name, slug, business email, phone, the islands you cover, and a public description.
• Authentication data when you log in (handled by Auth.js; OAuth tokens from Google are exchanged but not stored long-term).
• Billing data, if you subscribe to a paid plan, handled by Stripe. We retain the Stripe customer and subscription identifiers; we do not store card numbers.

How we use it

• Deliver buyer inquiries to the listing agency directly.
• Confirm receipt of inquiries to the buyer and provide a record of the conversation.
• Operate the agency dashboard, billing, and moderation workflows.
• Send transactional notifications (lead alerts, payment receipts, plan changes, moderation outcomes, weekly performance reports for paid plans).
• Detect and prevent fraud or abuse.
• Comply with legal obligations.

We do not use your data for advertising, do not sell it, and do not perform automated profiling that produces legal effects on you.

Who we share it with

• The listing agencyyou contacted. Inquiry contents are delivered to that agency's email and (where applicable) WhatsApp.
• Service providers who operate parts of the portal under our instructions: Vercel (hosting and edge network), Supabase (database), Stripe (billing), Resend (transactional email), and Twilio (optional WhatsApp alerts).
• Authorities when required by valid legal process.

How long we keep it

Inquiries are retained for as long as the listing agency's account remains active, plus 24 months. Agency accounts are retained for the duration of the agreement and for up to seven years afterwards where commercial records must be kept. You can request earlier deletion (see “Your rights”).

Your rights

You can ask us to:

• Confirm what data we hold about you and provide you with a copy.
• Correct anything that is inaccurate.
• Delete data we no longer need to retain (subject to applicable record-keeping requirements).
• Restrict or object to certain processing.
• Receive your data in a portable format.

To exercise any of these, email us at hello@isleandkey.com. We aim to respond within thirty days.

Cookies and tracking

We use a small number of strictly-necessary cookies to keep you logged in, to protect against cross-site request forgery, and to remember your session. We do not use third-party advertising cookies. If we ever add aggregated analytics (Vercel Analytics, GA4 with IP anonymisation), we will list them here and respect your “Do Not Track” preference where supported.

Security

We follow current good practice: encryption in transit (HTTPS everywhere), encryption at rest on our database, the principle of least privilege for internal access, and server-side validation on every form. No system is bulletproof — if you suspect a vulnerability, please email us instead of publishing it.

International transfers

Our infrastructure is hosted with providers operating in the United States and the European Union. Inquiry data therefore moves across borders. Our providers commit to industry-standard data protection contracts.

Children

The portal is not directed at people under sixteen and we do not knowingly collect their data. If you are a parent and believe your child has submitted data, please contact us and we will remove it.

Changes

We may update this Policy. Material changes will be highlighted on this page and, where appropriate, sent by email to account holders before they take effect.

Contact

Privacy questions, requests, and complaints: hello@isleandkey.com.