Privacy Policy · PlacePoint

How PlacePoint SIA collects, uses, and protects information about you when you use the PlacePoint mobile app, website, and related services.

1. Who we are

PlacePoint is operated by PlacePoint SIA, a private limited company registered in Latvia, with its registered address at [STREET, RIGA, LATVIA, POSTAL CODE]. For questions about this policy or to exercise your rights, contact us at privacy@placepoint.lv. Our Data Protection Contact is reachable at the same address. We have not appointed a formal Data Protection Officer at v1 because we do not currently meet the GDPR Article 37 thresholds requiring one.

2. What this policy covers

This policy applies to:

The PlacePoint mobile app (iOS and Android).
The PlacePoint website at https://placepoint.lv.
Any feature accessed through the above (search, listings, messaging, viewings, payments).

It does not cover third-party services you reach via links from the app (for example, the website of a real-estate agency that has listed property with us). Their privacy practices are their own.

3. What data we collect, and why

We have organized this section by what you do rather than by type of data, because that is how the data is actually generated.

3.1 When you create an account

Email address — required, used as your login identifier and to send transactional messages (verification, password reset, viewing reminders).
Password — stored only as a salted Argon2id hash; we never see or store the plaintext.
Display name — optional. Shown to other users alongside your listings and messages.
Phone number — optional, encrypted at rest. Used only if you enable phone verification or if you choose to share it on a listing.
Account type — whether you signed up as a property seeker, an owner, a realtor, or a company.
Sign-in provider identifier — if you use Google or Apple Sign-In, we store the provider’s subject ID so we can recognize you on return.

Lawful basis: performance of the contract you enter into when you create an account (GDPR Art. 6(1)(b)).

3.2 When you create a listing

Listing content — title, description, price, address text, number of rooms, area, property type, offer type (rent/sale).
Property photos — stored in Cloudflare R2 object storage in the EU region.
Geographic coordinates — derived from the address you enter, used to plot the property on the map. Stored as a precise lat/long pair.

Lawful basis: performance of the contract; for the address and coordinates, also our legitimate interest in operating a usable real-estate marketplace (Art. 6(1)(f)).

3.3 When you message another user

Message content — what you typed.
Timestamps — when the message was sent, delivered, read.
Attached images — same storage as listing photos.

Lawful basis: performance of the contract; you specifically asked us to deliver the message.

3.4 When you book a viewing

Viewing slot — date, time, duration.
Optional message to the seller — what you wrote.
Cancellation history — for fraud prevention (chronic cancellers are throttled).

Lawful basis: performance of the contract.

3.5 When you pay for a listing boost

Receipt identifier — from Apple App Store, Google Play, or Stripe.
Boost duration purchased — 7 or 30 days.
Activation timestamps — when the boost was started and when it ends.

We do not receive your card number, CVV, or expiry. Those go directly to Apple, Google, or Stripe and never touch our servers. Lawful basis: performance of the contract.

3.6 Automatically, when you use the Services

For security, fraud prevention, and basic operation, we automatically collect:

IP address — used to enforce rate limits and to detect abuse patterns. Retained in audit logs for 90 days, then deleted.
Device user-agent string — same purpose, same retention.
Approximate location derived from IP address — only used if you have not granted us a precise location.
Precise location — only if you grant the iOS / Android location permission and only while the app is in use. Used to center the map on your current location. We do not retain precise location history; the value is used at request time and discarded.
Push notification token — only if you enable push notifications. Used to send chat-message alerts and listing updates you have opted into.
Crash reports — anonymized stack traces sent to Sentry. Stripped of personally identifying information before transmission.
Audit logs — record of admin actions (approvals, bans, banner publications) and security-relevant user actions (login, password reset, two-factor enrollment).

Lawful basis: legitimate interest in operating, securing, and improving the Services (Art. 6(1)(f)). We have run a Legitimate Interest Assessment for each of these and concluded that the processing does not override your rights.

3.7 When you contact support

We collect the contents of your message, your email, and any information you choose to include. We retain support tickets for 2 years after resolution.

4. What we do NOT collect

We want this to be unambiguous:

We do not track you across other apps or websites.
We do not sell your data to anyone, ever.
We do not share your data with advertisers.
We do not run targeted advertising inside the app.
We do not infer your sexual orientation, religion, political opinion, race, ethnicity, health status, biometrics, or genetics from any signal we receive. We have no use for that data and collect none of it.

5. Who we share data with

We share data only with the following categories of recipients, and only the data minimally necessary for the stated purpose:

Recipient	What	Why
Other PlacePoint users	Profile, listings, messages	The whole point of a marketplace
Cloudflare R2 (object storage)	Listing photos, avatars	Image hosting
Resend (email service)	Transactional emails	Verification, reminders, alerts
Twilio (SMS service)	Phone OTP codes	Phone verification
Mapbox	Map tile requests	Rendering the map
Sentry	Anonymized error reports	Diagnosing crashes
Apple / Google / Stripe	Receipt identifiers	Verifying boost purchases
Latvian state authorities	Only if legally compelled	Legal obligations

All recipients listed above are bound by Data Processing Agreements that meet GDPR standards. Mapbox and Sentry process data outside the EU under Standard Contractual Clauses (SCCs); we do not transfer any other category of data outside the EU.

6. How long we keep your data

Data	Retention
Account record	Until you delete your account (then 30 days, then erased)
Listings	Until you delete them, or 12 months after archiving
Chat messages	Until both participants have deleted them, then 30 days
Audit logs (security)	12 months
Audit logs (admin actions)	5 years (legal record)
IP-address request logs	90 days
Crash reports (Sentry)	90 days
Support tickets	2 years after resolution
Payment receipts	7 years (Latvian accounting law)
Banned-IP entries	Indefinitely (security)

When you delete your account, we anonymize your historical activity (chat messages still visible to the other party show "Deleted user") rather than removing it entirely, because deleting one side of a conversation would also delete it from the other person’s account. The legal basis for this retention is balancing your right to erasure against the rights of the other party.

7. Your rights under GDPR

You have the right to:

Access — the personal data we hold about you.
Rectify — inaccurate data — most fields are editable in the app.
Erase — your data ("right to be forgotten") — Settings → Delete Account.
Restrict — processing in specific circumstances.
Port — your data to another service in a machine-readable format.
Object — to processing based on legitimate interest.
Withdraw consent — for any processing based on consent (e.g., push notifications) — Settings → Notifications.
Lodge a complaint — with the Latvian Data State Inspectorate (DVI, https://www.dvi.gov.lv) or your local supervisory authority.

To exercise these rights, email privacy@placepoint.lv. We respond within 30 days, extendable by 60 days for complex requests (we will tell you if that applies).

8. Children

PlacePoint is intended for users 18 and older. We do not knowingly collect personal data from children under 18. If you believe a child has provided us data, email privacy@placepoint.lv and we will delete it.

9. Security

We protect your data with:

HTTPS everywhere (TLS 1.2+).
Argon2id password hashing.
AES-256-GCM field-level encryption for phone numbers and biographies.
Per-user rate limiting and IP-based abuse detection.
Two-factor authentication (TOTP) available in Settings.
Audit logs for all admin actions.
Database backups encrypted at rest, retention 30 days.

No security system is perfect; we will notify you and the Latvian Data State Inspectorate within 72 hours if a personal data breach affects your data.

10. Changes to this policy

If we change this policy materially, we will:

Update the "Last updated" date above.
Notify you at least 30 days in advance via email or in-app banner.
For changes that require new consent (e.g., a new processing purpose), ask for that consent before applying the change to you.

Non-material changes (typos, restructuring) are made without notice.

11. Contact

Privacy questions — privacy@placepoint.lv
Support — support@placepoint.lv
Postal mail — PlacePoint SIA, [STREET, RIGA, LATVIA, POSTAL CODE]

1. Who we are

2. What this policy covers

This policy applies to:

The PlacePoint mobile app (iOS and Android).
The PlacePoint website at https://placepoint.lv.
Any feature accessed through the above (search, listings, messaging, viewings, payments).

It does not cover third-party services you reach via links from the app (for example, the website of a real-estate agency that has listed property with us). Their privacy practices are their own.

3. What data we collect, and why

We have organized this section by what you do rather than by type of data, because that is how the data is actually generated.

3.1 When you create an account

Email address — required, used as your login identifier and to send transactional messages (verification, password reset, viewing reminders).
Password — stored only as a salted Argon2id hash; we never see or store the plaintext.
Display name — optional. Shown to other users alongside your listings and messages.
Phone number — optional, encrypted at rest. Used only if you enable phone verification or if you choose to share it on a listing.
Account type — whether you signed up as a property seeker, an owner, a realtor, or a company.
Sign-in provider identifier — if you use Google or Apple Sign-In, we store the provider’s subject ID so we can recognize you on return.

Lawful basis: performance of the contract you enter into when you create an account (GDPR Art. 6(1)(b)).

3.2 When you create a listing

Listing content — title, description, price, address text, number of rooms, area, property type, offer type (rent/sale).
Property photos — stored in Cloudflare R2 object storage in the EU region.
Geographic coordinates — derived from the address you enter, used to plot the property on the map. Stored as a precise lat/long pair.

Lawful basis: performance of the contract; for the address and coordinates, also our legitimate interest in operating a usable real-estate marketplace (Art. 6(1)(f)).

3.3 When you message another user

Message content — what you typed.
Timestamps — when the message was sent, delivered, read.
Attached images — same storage as listing photos.

Lawful basis: performance of the contract; you specifically asked us to deliver the message.

3.4 When you book a viewing

Viewing slot — date, time, duration.
Optional message to the seller — what you wrote.
Cancellation history — for fraud prevention (chronic cancellers are throttled).

Lawful basis: performance of the contract.

3.5 When you pay for a listing boost

Receipt identifier — from Apple App Store, Google Play, or Stripe.
Boost duration purchased — 7 or 30 days.
Activation timestamps — when the boost was started and when it ends.

We do not receive your card number, CVV, or expiry. Those go directly to Apple, Google, or Stripe and never touch our servers. Lawful basis: performance of the contract.

3.6 Automatically, when you use the Services

For security, fraud prevention, and basic operation, we automatically collect:

IP address — used to enforce rate limits and to detect abuse patterns. Retained in audit logs for 90 days, then deleted.
Device user-agent string — same purpose, same retention.
Approximate location derived from IP address — only used if you have not granted us a precise location.
Precise location — only if you grant the iOS / Android location permission and only while the app is in use. Used to center the map on your current location. We do not retain precise location history; the value is used at request time and discarded.
Push notification token — only if you enable push notifications. Used to send chat-message alerts and listing updates you have opted into.
Crash reports — anonymized stack traces sent to Sentry. Stripped of personally identifying information before transmission.
Audit logs — record of admin actions (approvals, bans, banner publications) and security-relevant user actions (login, password reset, two-factor enrollment).

3.7 When you contact support

We collect the contents of your message, your email, and any information you choose to include. We retain support tickets for 2 years after resolution.

4. What we do NOT collect

We want this to be unambiguous:

We do not track you across other apps or websites.
We do not sell your data to anyone, ever.
We do not share your data with advertisers.
We do not run targeted advertising inside the app.
We do not infer your sexual orientation, religion, political opinion, race, ethnicity, health status, biometrics, or genetics from any signal we receive. We have no use for that data and collect none of it.

5. Who we share data with

We share data only with the following categories of recipients, and only the data minimally necessary for the stated purpose:

Recipient	What	Why
Other PlacePoint users	Profile, listings, messages	The whole point of a marketplace
Cloudflare R2 (object storage)	Listing photos, avatars	Image hosting
Resend (email service)	Transactional emails	Verification, reminders, alerts
Twilio (SMS service)	Phone OTP codes	Phone verification
Mapbox	Map tile requests	Rendering the map
Sentry	Anonymized error reports	Diagnosing crashes
Apple / Google / Stripe	Receipt identifiers	Verifying boost purchases
Latvian state authorities	Only if legally compelled	Legal obligations

6. How long we keep your data

Data	Retention
Account record	Until you delete your account (then 30 days, then erased)
Listings	Until you delete them, or 12 months after archiving
Chat messages	Until both participants have deleted them, then 30 days
Audit logs (security)	12 months
Audit logs (admin actions)	5 years (legal record)
IP-address request logs	90 days
Crash reports (Sentry)	90 days
Support tickets	2 years after resolution
Payment receipts	7 years (Latvian accounting law)
Banned-IP entries	Indefinitely (security)

7. Your rights under GDPR

You have the right to:

Access — the personal data we hold about you.
Rectify — inaccurate data — most fields are editable in the app.
Erase — your data ("right to be forgotten") — Settings → Delete Account.
Restrict — processing in specific circumstances.
Port — your data to another service in a machine-readable format.
Object — to processing based on legitimate interest.
Withdraw consent — for any processing based on consent (e.g., push notifications) — Settings → Notifications.
Lodge a complaint — with the Latvian Data State Inspectorate (DVI, https://www.dvi.gov.lv) or your local supervisory authority.

To exercise these rights, email privacy@placepoint.lv. We respond within 30 days, extendable by 60 days for complex requests (we will tell you if that applies).

8. Children

9. Security

We protect your data with:

HTTPS everywhere (TLS 1.2+).
Argon2id password hashing.
AES-256-GCM field-level encryption for phone numbers and biographies.
Per-user rate limiting and IP-based abuse detection.
Two-factor authentication (TOTP) available in Settings.
Audit logs for all admin actions.
Database backups encrypted at rest, retention 30 days.

No security system is perfect; we will notify you and the Latvian Data State Inspectorate within 72 hours if a personal data breach affects your data.

10. Changes to this policy

If we change this policy materially, we will:

Update the "Last updated" date above.
Notify you at least 30 days in advance via email or in-app banner.
For changes that require new consent (e.g., a new processing purpose), ask for that consent before applying the change to you.

Non-material changes (typos, restructuring) are made without notice.

11. Contact

Privacy questions — privacy@placepoint.lv
Support — support@placepoint.lv
Postal mail — PlacePoint SIA, [STREET, RIGA, LATVIA, POSTAL CODE]

PlacePoint Privacy Policy

1. Who we are

2. What this policy covers

3. What data we collect, and why

3.1 When you create an account

3.2 When you create a listing

3.3 When you message another user

3.4 When you book a viewing

3.5 When you pay for a listing boost

3.6 Automatically, when you use the Services

3.7 When you contact support

4. What we do NOT collect

5. Who we share data with

6. How long we keep your data

7. Your rights under GDPR

8. Children

9. Security

10. Changes to this policy

11. Contact

PlacePoint Privacy Policy

1. Who we are

2. What this policy covers

3. What data we collect, and why

3.1 When you create an account

3.2 When you create a listing

3.3 When you message another user

3.4 When you book a viewing

3.5 When you pay for a listing boost

3.6 Automatically, when you use the Services

3.7 When you contact support

4. What we do NOT collect

5. Who we share data with

6. How long we keep your data

7. Your rights under GDPR

8. Children

9. Security

10. Changes to this policy

11. Contact