Privacy policy

1. Who is the controller

The controller of your personal data is Serhii Fursenko, JDG, NIP 5252941609, ul. Jerzego Holzera 4/227, 02-972 Warszawa. For privacy matters write to [email protected].

When a client sends an enquiry through an agent's link, the agent who sent the link is the controller of that data; we process it on the agent's behalf, under the processing terms the agent accepts in their account (the "Data processing terms" page).

2. What data we process

• Account: from Google we receive your e-mail address, name, profile picture and Google account identifier. We never receive your Google password. We also keep the role you choose (buyer, seller, investor, agent), your language and, for agents, an agent card, client links and saved flats.
• Sign-in session: an HttpOnly cookie; we keep only its hash, with the times it was created and last used.
• Abuse protection: we count requests per day against a hash of your network address (not the IP address itself), to limit automated scraping. This applies to every visitor.
• Daily address limit: for signed-in people we keep the addresses analysed that day, to apply the plan's limit.
• Client enquiries: the name, phone, e-mail and flat address a client types into an agent link's form.
• Client links: the report an agent sends a client is stored with the agent's card. We count opens of a link only as a time and the type of device (phone or computer), with no IP address.
• In your browser we store choices (language, workplace address, comparison list). For signed-in people some of them are also kept with the account so they follow you to every device.

3. Purposes and legal bases

• Running the account and the features you use (sign-in, language, links, comparison): performance of a contract, Art. 6(1)(b) GDPR.
• Security and abuse prevention (hashed network address) and the daily limit for accounts: legitimate interest, Art. 6(1)(f) GDPR.
• Answering your messages and defending claims: legitimate interest, Art. 6(1)(f) GDPR.
• Tax and accounting duties if you buy a paid plan: legal obligation, Art. 6(1)(c) GDPR.

4. Who receives the data

We do not sell personal data or use it for advertising.

• Google: sign-in. Google's button and script load only after you click "Sign in". Google is an independent controller of your Google account.
• CARTO (basemaps.cartocdn.com): map tiles are loaded from CARTO's servers, which therefore see your IP address and the map area you view.
• Hosting provider (Hetzner Online GmbH (Falkenstein, Germany)): processes data on our behalf.
• Cloudflare, Inc.: DNS, content delivery and attack protection in front of our server. It processes traffic to the service on our behalf, so it sees your IP address and requests.
• The agent whose link you opened: receives the enquiry you send.

5. Transfers outside the EEA

Google, CARTO and Cloudflare may process data outside the European Economic Area, including the United States. They rely on safeguards they publish themselves (such as the EU–US Data Privacy Framework or standard contractual clauses).

6. How long we keep data

• Account: until you delete it, or until 24 months after you last signed in (unless a paid plan is running); it is then deleted with its agent card, links and client enquiries.
• Sign-in sessions: up to 30 days.
• Request counters by hashed network address: 90 days. Addresses analysed that day (accounts): two days.
• Client enquiries: 12 months.
• Client links: until the agent deletes them or the agent's account is deleted.

7. Your rights

You have the right to access your data and get a copy, to have it corrected, erased or restricted, to data portability, and to object to processing based on legitimate interest. You can do much of this yourself on the account page: "Download my data" (a JSON file) and "Delete my account". For anything else write to [email protected].

We make no automated decisions that have legal effects on you.

You may complain to the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or to the supervisory authority in your own country.

8. Cookies

• We use one cookie, hd_session: it keeps you signed in (HttpOnly, up to 30 days) and is necessary for the account to work. Visitors without an account get no cookie from us.
• We use no analytics or advertising cookies. After you click "Sign in", Google's button may set cookies of its own. Cloudflare may set a security cookie when it needs to tell people from automated traffic.

9. Changes

We will announce material changes to this policy on this page; the date of the last update is at the top.