Privacy Policy and Data Protection Notice

Data controller

• Controller: HousesVia
• Email: [email protected]

Data we process

Account data: email address, an irreversible hash of your password (argon2), your name if provided, preferred language and currency, and a verified phone number.

Listing data: the listing text, price, location, photos and contact preferences you enter. EXIF metadata in photos — including GPS coordinates — is stripped on upload.

Usage data: events such as views, phone reveals, WhatsApp clicks and favourites. IP addresses and browser strings are NEVER stored in raw form; only an irreversible keyed hash (HMAC) is kept.

Enquiries: when you message an advertiser, your name, email and/or phone number and your message are forwarded to them and stored.

Purposes and legal bases

• Performance of a contract: creating an account, publishing listings, connecting buyers and sellers.
• Legal obligation: obligations arising from the Turkish Electronic Listing Verification System (EİDS) and statutory retention periods.
• Legitimate interests: fraud and spam prevention, rate limiting, service security and aggregate (non-identifying) statistics.
• Consent: only for non-essential cookies (see the Cookie Policy).

Transfers and processors

We never sell your data for advertising. The following providers are used to operate the service:

• Cloudflare: content delivery, bot protection (Turnstile) and object storage for photos (R2). Servers are located outside Türkiye.
• Google (Firebase Phone Authentication): SMS for phone verification, used only while verifying your number.
• MapTiler / OpenStreetMap: serving map tiles.
• Google (Gemini API): machine translation of listing text. Only the listing title and description are sent; no personal contact details.

Some of these providers are established abroad, so their use constitutes an international transfer.

Retention

• Account data: while your account exists; after a deletion request, data not subject to a legal retention duty is erased.
• Raw usage events: 90 days, after which they are reduced to daily aggregates and the raw records are deleted.
• Enquiries: for a reasonable period after the listing goes offline, in case of disputes.
• Backups: continuous replication is kept 7 days, the off-site copy 30 days, then rotates out automatically.

Your rights

You may request access, rectification, erasure, restriction, objection and a copy of your data.

Send requests to [email protected]. We respond within 30 days at the latest.

You also have the right to lodge a complaint with the competent supervisory authority.

Security

All traffic is encrypted with TLS. Passwords are hashed with argon2 and never stored in plain text; passwords found in known breaches are rejected.

Session tokens live in httpOnly cookies and rotate on every use; if a stolen token is replayed, the entire session family is revoked.

If you set a listing’s location to “approximate”, the exact coordinates never appear in any API response — the map shows a point shifted by 300–500 metres.