Privacy policy

proQer is a real-estate platform for buyers, sellers (agents, developers and owners), service providers and companies. It is run by [company name], [registered address], [company registration number] ("we", "us"). We decide how and why your personal data is used on proQer, so we are responsible for it.

This policy covers the proQer website and the proQer mobile app, which is still being tested. [to confirm]The data protection laws that apply (for example the EU and UK GDPR, Turkey's KVKK, the UAE's PDPL) and whether we need a representative or a data protection officer.

• We collect what you give us (your account, profile, preferences, listings, posts and messages) and what happens when you use proQer (searches, views, saves).
• We use it to run the service: to show you homes, to connect buyers and sellers, to answer you with Anya and to keep proQer safe.
• A buyer's email and phone number reach a seller only after the buyer agrees to it in a contact request.
• We do not sell your personal data. We do not store your card number: Stripe handles payments.
• Our AI features (Anya, automatic translation, voice in the test app) currently use Google's free Gemini tier. Google's terms let Google use what we send to improve its products, and people at Google may review it. Please don't put personal details into Anya.
• Buyers can download their data and delete their account in their dashboard; sellers, providers and companies can delete theirs in Settings. A deleted account can be restored for 30 days, then it is erased.

For each kind of data we say why we use it. [to confirm with counsel]The legal basis for each use (contract, legitimate interest, consent, legal obligation).

Your account

• Your name, email address, a password (stored only as a one-way hash, never in plain text), your role (buyer, seller, service provider or company) and, for sellers, the seller type (agent, developer or owner). Optional: phone number and gender.
• Google sign-in: if you sign in with Google, Google sends us your name, email address, whether Google has verified that email, and your profile photo. We ask Google for nothing else. You can turn Google sign-in off for your account.
• Sign-in records: when you last signed in, which sign-in methods your account uses, and a session version that lets you sign out on every device at once.
• Why: to create and secure your account and to let you sign in.

Your profile and privacy settings

• Photo, bio, city, languages and, for sellers, providers and companies, a business profile: company name, website, office address, experience, specialties, service areas, social links, cover photo and certificates you upload.
• Buyer profiles are private by default: other people see only your name and photo. You can make chosen parts (city, bio, who you follow) visible to signed-in members or to anyone with the link. Your budget, your brief, saved homes and searches, search history, Anya chats, plan, credits, email, phone and full address are never shown on your profile.
• Seller, provider and company profiles are public. Their business email and phone number are shown unless the owner hides them.
• Why: to show your profile to the people you choose, and to let buyers find professionals.

Buyer preferences and the Buyer Guide

• What you tell us about the home you want: goal (to live in, to invest, residency), budget, payment preference, property types, timeline, the markets you look at, and the country and city you live in.
• If you choose "use my location" in the Buyer Guide, your browser asks your permission, then sends us only an approximate point (rounded to about 1 km). Our server looks up the country and city with Mapbox, and we keep the city, the country and that approximate point.
• In the app's listing form, "Use my location" asks for your precise location only when you tap it, to place the map pin. Our server looks up the address with Mapbox, and we keep only the pin and address on your draft or listing.
• Settings: language, currency, area unit and theme.
• Why: to show you matching homes and prices in your currency, and to let Anya answer with your brief in mind.

Listings and photos

• The listings sellers publish: address and position on the map, price and currency, size, rooms, features, description, photos and videos, and drafts. Photos, videos, avatars, cover photos and certificate files are stored by Cloudinary, our media host.
• To place a listing on the map and describe its area, we send its address or position to Mapbox (geocoding) and to Google Maps Platform (places nearby, off today). We may use AI (Google Gemini) to analyse listing data and the market around it. That analysis uses listing data, not data about buyers (what other AI features send is listed under "Outside services we use").
• Unpublished listings (draft or pending) are visible only to their owner and our admins.
• Why: to publish listings, to help buyers compare them and to keep the information right.

Posts, reels, inquiries and comments

• Sellers, providers and companies can publish posts and reels (photos and videos). Everyone can publish inquiries (text only, with optional city or district, budget range, property type and purpose) and comments.
• A buyer's inquiry is shown anonymously (for example "A buyer from Germany") unless the buyer's privacy settings show their name. Inquiries are shown first to sellers in the matching market.
• Email addresses, phone numbers and links are removed automatically from inquiries and comments and replaced with "[contact removed]" or "[link removed]".
• Likes, saves, follows, views of posts and the people you follow.
• Why: to run the social feed and to let buyers ask the market in public without giving away their contact details.

Chats, contact requests and leads

• Contact requests (free plan): a buyer asks one seller to get in touch, after a consent step. The seller sees the request without contact details, and a short preview of the buyer's recent browsing: up to 3 areas, the property types and how many developers, never which listings. Only if the seller accepts (which costs the seller credits) do we share the buyer's name, email and phone with that seller, and we tell the buyer who received them. The buyer can withdraw a request until then. Requests expire after 14 days (a setting we can change).
• Direct messages (paid plans): a chat between a buyer and a seller. A seller can't start a chat with a buyer: the buyer starts it. In every message we hide email addresses, phone numbers, links and words such as "WhatsApp". You can block or mute people.
• Leads: when a buyer contacts a seller (a message, a contact request, or interest or a comment on the seller's post), that seller gets a lead. The lead shows the buyer's budget range, the city and type they look for, the listings they asked about and their activity on that seller's listings. A seller who accepts your request sees the areas and property types you browsed, never which listings. Until a seller buys the lead or accepts the request, they see when you were active only as "today", "this week" or "earlier". While an account waits out its 30 days after a deletion request, sellers don't see it among their leads. The name appears once the seller claims the lead; email and phone only with an accepted contact request. A buyer who only browsed never becomes a lead. Buyers can see every seller who knows about them, and what that seller sees, in their dashboard.
• Our admins can see chats (including the start of the latest message) to keep the service safe and to handle complaints.
• Why: to let buyers and sellers talk while the buyer stays in control of their contact details.

Payments, plans and credits

• Payments go through Stripe's checkout pages. We never see or store your card number. We keep a Stripe customer id, your plan and its status and dates, and a record of each payment (type, amount, currency, status, date).
• We use payment signals to prevent fraud.
• Credits: your balance, and a log of what you bought, used, received back (for example a boost refund) and what expired.
• Why: to bill you, to give you what you paid for and to keep accounting records.

Notifications

• In-app notifications (new messages, comments, contact requests, leads, plan changes) are stored with your account. We don't send emails yet. [to confirm]The email provider and push notifications for the app, and which emails we will send.

Your activity, and what we learn from it

• Searches (filters and places), homes you view, save and compare, saved searches and their alerts. Visitors who aren't signed in get a random visitor id in their browser, so their searches and views can be counted.
• From this activity we build a preference profile and a lead score that we use to rank homes for you and to tell a seller you contacted how close your interest is. Buyers can clear their search history and make us forget what we learned, in their dashboard. The brief you wrote yourself (Buyer Guide) stays until you change it.
• Sellers see anonymous counts of views and saves on their listings and posts, never who browsed.
• Promoted posts and ads: we count views and clicks to charge the advertiser. For visitors who aren't signed in we never store the IP address: to count each viewer once, we keep a salted one-way hash of it for 6 hours, then delete it. The salt changes every 30 days and the old one is deleted. Rate limits and view counts in our server's memory use the same kind of hash, never the address.
• We don't use third-party advertising networks inside proQer. Analytics through Google Tag Manager: see "Cookies and browser storage".

Anya is proQer's assistant. When you write to Anya we send Google's Gemini API your message, the last few turns of the conversation, your saved preferences and budget when they matter, and the listing and market data Anya answers from. We don't send your email address or phone number. Your Anya conversations are saved with your account, so you can come back to them; you can rename or delete one chat, or all of them. Our team can read saved conversations to check answers and fix problems.

Automatic translation: texts that sellers, providers and companies publish (listing titles and descriptions, business profiles) and texts proQer writes are translated automatically with Gemini, and the translations are kept so the same text isn't sent twice. Posts, comments and messages are not translated.

Google's free tier. Today these features use the free ("unpaid") tier of the Gemini API. Under Google's Gemini API terms, for unpaid services Google may use what we send and what it answers to provide, improve and develop Google products and machine-learning technology, and human reviewers may read and annotate it (Google says it first disconnects it from our account and project). Google also asks that sensitive, confidential or personal information not be sent to unpaid services. So please don't write personal details (your phone number, ID numbers, health or money matters that identify you) into Anya. Google's own use of this data is described in its privacy policy.

[to confirm]We plan to move Anya, translation and voice to a paid AI service before launch. Google's terms also say that apps offered to users in the European Economic Area, Switzerland or the UK may use only paid services. Which provider and when; until then, this section stays.

Voice

• Mobile test app: recordings sent from the mobile test app are sent to Google's Gemini to be turned into text, and are not stored on our servers: the recording is kept in memory only while it is being transcribed, and we log only numbers (such as its length and size), never the audio or the text. This is a temporary testing feature; the iPhone app will later use the phone's own speech recognition. Because it uses Google's free tier, Google's terms may let Google keep and review these recordings, as described above.
• Website: the microphone button uses your browser's own speech recognition. The audio does not reach our servers; depending on your browser, its maker may process it (Chrome, for example, sends it to Google).

Other people on proQer

• What you publish (listings, posts, reels, inquiries, comments, public profiles) is visible to others, following your privacy settings.
• Sellers you contact see a lead about you, as described above. Your email and phone reach a seller only through an accepted contact request.
• The people you chat with see your messages.

Outside services we use

They run parts of proQer for us. For each: what reaches them, and why. Taken from our code (round 12); a service marked "off today" is built in but switched off.

• MongoDB Atlas (database): everything in your account and your activity, including messages. Why: to store it.
• Google Gemini API (AI, from our server): your messages to Anya with the last few turns, the page or search you are on, your saved preferences and budget when they matter, and any image you attach; search text, to understand what you look for; your budget, markets and preferences, to write your buyer insight; for a seller's lead advice, a buyer's city, country, budget range and interest level (never the name, email or phone); listing and profile texts, for analysis and automatic translation; and voice recordings from the mobile test app. Why: Anya, search, translation and voice. See "Anya, AI features and voice" for the free tier. [to confirm]Which translation provider is switched on at launch.
• Google sign-in: if you choose "Continue with Google", Google tells us your name, email, whether Google verified it, and your profile photo's address. That photo stays on Google's servers: whoever sees it on proQer loads it from Google. In the app, our server checks the sign-in with Google's public keys (no data about you is sent for that).
• Stripe (payments): your name, email and our account id, to create your customer record; then checkout, subscriptions and the billing portal run on Stripe's pages. Your card details go to Stripe only; we never see them.
• Cloudinary (media): the photos, videos, avatars, cover photos and certificate files you upload, to store and deliver them. Your browser loads some of them straight from Cloudinary, which then sees your IP address.
• Mapbox (maps): your browser loads map styles and tiles from Mapbox, which sees your IP address and the area you look at. The map library also sends Mapbox anonymous usage events (events.mapbox.com). Our server sends Mapbox the address you type or the pin you place when you create a listing, to find its position, and the approximate point (about 1 km) from the Buyer Guide's "use my location", to find your city (both from our server, so not your IP address).
• OpenStreetMap Nominatim: our server asks it for area boundaries by place name (no data about you). Your browser never contacts it.
• Google Maps Platform (places near a listing, travel times): a listing's position, from our server. Off today.
• Google Tag Manager: only after you accept analytics and marketing (see "Cookies and browser storage").[to confirm]Which tags the container runs.
• Spline (the 3D scene on the pricing page): your browser loads it from prod.spline.design, its viewer fromunpkg.com and, for some scenes, a decoder from www.gstatic.com (Google). Each sees your IP address.
• Unsplash: stand-in photos where a listing or profile has none. Your browser may load them from Unsplash, which sees your IP address.
• ExchangeRate-API (open.er-api.com): our server fetches currency rates once a day. Nothing about you is sent.
• Fonts: served from our own site; no font service is contacted.
• Built in but off today: a short-lived cache service (Redis), and sign-in with Facebook, X or Apple. [to confirm]Our hosting provider and any cache service at launch, data processing agreements with each company above, and the countries they process data in.

Others

• We do not sell your personal data, and we don't share it with advertisers.
• We may disclose data when the law requires it, to protect people's safety, or if proQer is sold or merged (the buyer would be bound by this policy). [to confirm with counsel]Wording of these cases.

proQer stores a few things in your browser. Most are needed for the site to work; you can clear them in your browser at any time.

Your choice. On your first visit the website asks, in a banner, whether you accept analytics and marketing. There are two categories: necessary (always on: everything in the list below except Google Tag Manager, and the visitor id only for the open tab) and analytics and marketing (off until you accept). "Reject" and "Accept" are the same size and one click each. Until you choose, and after you reject, nothing for analytics or marketing loads: no Google Tag Manager and no request to Google for it. We remember your choice in a cookie de_consent on our own site for 6 months; then we ask again. You can change it at any time with "Cookie settings" at the bottom of the page or here. When you reject, we delete the analytics cookies Google had set on our site and the stored visitor id. The app asks the same question once, when you first open it, with the same choices: necessary always on, measurement off until you accept, ads always off, and "Reject" as easy as "Accept". Until you choose, and after you reject, the app measures nothing. It keeps your choice on your phone for 6 months, and you can change it at any time in Me → Privacy. When you reject, the app deletes the visitor id it kept.

Cookie settings

• Signing in: your sign-in token and basic account details, in local storage if you chose "Remember me" (a token lasts 7 days) or in session storage otherwise (gone when you close the tab). If you chose "Remember me", also your email, to fill in the next sign-in. We never store your password in the browser.
• Google sign-in: the sign-in library sets its own cookies: next-auth.session-token (the session, up to 7 days), next-auth.csrf-token (its security check) and next-auth.callback-url (the page to return to). On a secure connection their names start with __Secure- or __Host-.
• Restoring a deleted account: if you sign in with Google within 30 days of deleting your account, a cookie deepestate_restore holds the offer to restore it for at most 15 minutes. Only our own site can read it.
• Language: a cookie deepestate_ui_language (one year), so pages come in your language.
• Preferences on this device: theme, currency and area unit, your comparison list, listing-form drafts, Buyer Guide progress, a question you asked Anya before signing in, and small "seen this" markers.
• Visitor id: a random id (deepestate_visitor_session_id) sent with views, saves, searches and messages to count demand and sponsored views. Without your consent it lives only in the open tab (session storage) and is gone when you close it; if you accept analytics, it is kept in local storage between visits.
• Your cookie choice: a cookie de_consent (6 months) that remembers whether you accepted or rejected analytics and marketing.
• Google Tag Manager (analytics and marketing, only if you accept): the website then loads Google Tag Manager, which can load Google measurement tools that set their own cookies (for example _ga). We use Google Consent Mode: everything starts "denied", and accepting allows only measurement cookies (analytics and ad measurement); sending your data to Google for advertising and personalised ads stay off. [to confirm]Which tags the container runs.
• Content from other sites: pages load maps from Mapbox, images from Cloudinary and Unsplash, Google profile photos from Google, and a 3D scene from Spline (with its viewer from unpkg.com and possibly a decoder from www.gstatic.com) on the pricing page. These sites receive your IP address when your browser loads them. Our fonts are served from our own site.

• Our servers write technical logs (errors, timings and some account ids) to find and fix problems. [to confirm]Where logs are kept at launch and for how long.
• To stop abuse we limit how often an IP address or an account can do certain things (for example sign in, sign up, use Anya, comment, follow). These counters are kept in memory only, for minutes, and are not stored.
• Passwords are hashed. Every session ends when you change your password or choose to sign out everywhere.
• No system is perfectly secure. [to confirm with counsel]Our process for telling you and the authorities about a data breach.

Our database runs on MongoDB Atlas. [to confirm]The region is chosen at launch. The companies listed above may process data in other countries, including the United States. [to confirm with counsel]The safeguards for international transfers (for example standard contractual clauses).

• Your account and what you publish: while your account exists. Posts you delete are hidden from everyone at once and removed from our database when your account is erased.
• Listings you delete are hidden from everyone at once but stay in our database, and their photos stay with Cloudinary while your account exists. [to confirm]When deleted listings and their photos are removed for good while the account still exists.
• Photos and videos: while your account exists. When the account is erased (30 days after you delete it), the photos and videos stored on it are deleted from Cloudinary: listing photos, posts and reels, profile and cover photos, company logos and certificate files. A file that another account also uses is kept. If Cloudinary can't be reached, we try again later. [to confirm]How long Cloudinary keeps backup copies of deleted files.
• Anya conversations, saved homes and saved searches: until you delete them or your account.
• Search history and activity: until you clear them or your account is erased. Rows used for market counts are kept without your account.
• Contact requests: they expire after 14 days if no one answers; the record stays until your account is erased.
• Payment, invoice and credit records: kept for accounting even after erasure, linked only to an anonymous "Deleted user" record.
• Translations of published texts: kept, so the same text isn't translated twice.
• Voice recordings from the test app: not kept.

[to confirm with counsel]Fixed retention periods for each kind of data (for example inactive accounts, logs, chats and payment records under tax law), and how long database backups keep erased data.

• Buyers can delete their account in their dashboard; sellers, service providers and companies under Settings, "Account & deletion". Everyone confirms with their password, or with a fresh Google sign-in. The account is switched off at once: you can't sign in, every session ends, your public profile, posts and comments disappear. A buyer's paid plan stops renewing at the end of its period; sellers, providers and companies turn renewal off in Billing first.
• 30 days to change your mind: signing in again within 30 days offers to restore the account. A restore brings back your profile, posts and comments; a paid plan's renewal stays off until you turn it on again.
• After 30 days the account is erased: your posts, comments, likes, follows, notifications, saved homes and searches, history, what we learned, Anya chats, chats with sellers, contact requests and inquiries are deleted, and your photos and videos are deleted from Cloudinary, our media host. A lead a seller paid for stays with that seller, with your details replaced by "Deleted user". The account becomes an anonymous record, so payments and audits still add up.
• Sellers, providers and companies: at once, their live listings show as "no longer available" and leave search, maps and saved lists; contact requests still waiting are closed; chats stay readable for the buyer but closed; ad campaigns pause. A company owner with other members first hands the company to a member. After 30 days their listings are removed, and the leads they bought, with the buyers' details, are deleted (the payment record stays). Boosts, credits and campaign budgets are not refunded; before you confirm, the page shows what you would lose, with your own numbers. [to confirm]Refunds of unused boosts, credits or campaign budgets when an account is deleted.

Depending on where you live, you may have the right to:

• get a copy of your data: buyers can download everything we hold about them, as one file, in their dashboard;
• correct it: most of it you can edit in your profile and settings;
• delete it: see "Deleting your account"; buyers can also clear their search history and what we learned;
• object to or limit some uses, and withdraw consent you gave (for example to a contact request, before the seller accepts);
• move your data to another service;
• complain to your data protection authority. [to confirm with counsel]Which authority, and the full list of rights under each applicable law.

Other choices: your buyer profile's visibility, hiding a seller profile's email or phone, blocking and muting people, turning off Google sign-in, and signing out everywhere. Sellers, providers and companies can ask us for a copy of their data: see "Contact us".

proQer is for adults. You must be at least 18 to use it, and we don't knowingly collect data about children; if you think a child has an account, contact us and we will delete it. [to confirm]The minimum age (Google's Gemini terms require it to be 18 for apps using its API). Sign-up asks people to confirm they are 18 or older; it does not check it.

When we change this policy we will update the date at the top, and tell you in proQer before an important change applies. [to confirm with counsel]How far in advance, and when we need new consent.

Questions or requests about your data: [privacy email address], or by post to [company name], [registered address]. [to confirm]How fast we answer (for example within 30 days). See also our terms of use.