隐私政策
版本 1.0 · 自 2026-09-28 起生效
本文件的正式、具有法律约束力的版本为英文版。中文翻译将另行发布。
2.1 Controller
The controller responsible for the processing described in this Privacy Policy is:
2.2 Scope
This Privacy Policy applies when a person:
- visits FindMePlace;
- creates or uses an account;
- publishes, edits, views or deletes a listing;
- uses internal messaging;
- reveals a seller telephone number;
- adds or follows an external link;
- contacts FindMePlace;
- submits an illegal-content report;
- reports a message;
- is affected by a moderation decision;
- uses authentication, security or account-recovery functions.
2.3 Categories of personal data
Depending on how the Service is used, FindMePlace may process the following categories.
A. Account and identity data
- email address;
- account identifier;
- first name and surname where provided;
- display name or nickname where provided;
- account role/type;
- password in protected/hashed form;
- account creation and status information.
B. Optional contact and profile data
- telephone number;
- Facebook profile URL;
- Instagram profile URL;
- for business/agency profiles, website or other social URLs where the interface permits them;
- country and other optional profile information.
The Facebook/Instagram/social-profile fields stored in account settings are not currently published through the ordinary public profile interface.
C. Public external-offer links
A user may separately add links to the user's offers on external services. These external_links are intentionally public and may be visible to any visitor, including a person who is not logged in.
This is different from a social-profile URL stored in private account settings.
D. Listing and property data
- listing title and description;
- property type and characteristics;
- price and currency;
- property location information;
- listing status and timestamps;
- photographs;
- public external links;
- other information the user chooses to include in a listing.
Because listings are intended to be public, users must not include unnecessary sensitive or private personal data in listing text or photographs.
E. Communications
- internal messages;
- message timestamps and participant identifiers;
- support communications;
- legal/privacy communications;
- illegal-content reports;
- reported-message content;
- moderation decisions and reasons;
- notifications concerning moderation.
F. Technical and security data
Depending on the function used:
- IP address;
- request/access information;
- session identifier;
- authentication/security tokens;
- timestamps;
- browser/device/network information generated by normal web operation;
- security events;
- rate-limit counters;
- anti-abuse information.
G. Transactional email data
Brevo is used for transactional email. The processing may include:
- recipient email address;
- delivery status;
- bounce/failure information;
- technical email-delivery metadata.
Brevo transactional-log retention for FindMePlace has been configured to 30 days.
2.4 Public and non-public data
Property listings are intended to be publicly available unless the interface expressly says otherwise.
Listing text, property information, property photographs and public external-offer links may therefore be visible without login.
The account email address is not displayed to ordinary users.
A seller's telephone number is not included in the public listing HTML. It is returned only after a separate server request and only where:
- the requester is logged in; and
- the seller separately enabled telephone display.
The telephone-display setting is OFF by default and may be withdrawn.
The current system limits reveals to 60 per hour per requesting account.
Optional social-profile URLs stored in account settings are not currently shown publicly through the ordinary profile interface.
2.5 Purposes and legal bases
FindMePlace processes personal data for the following purposes.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Create and operate an account | email, account ID, profile information, authentication data | Art. 6(1)(b) GDPR — performance of the user agreement / steps requested by the user |
| Publish and display listings | listing text, property data, photos, external links | Art. 6(1)(b) GDPR |
| Internal messaging | participants, message content, timestamps | Art. 6(1)(b) GDPR |
| Display a seller telephone number after the seller enables the option | telephone number, display setting | Art. 6(1)(a) GDPR where the display is based on consent |
| Send transactional service emails | email address, delivery metadata | Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR for operational/security communications |
| Protect the Service, prevent abuse and investigate security events | IP, security logs, session data, rate limits | Art. 6(1)(f) GDPR — legitimate interests in securing the Service, users and legal rights |
| Handle illegal-content notices and moderation | report details, content, reporter contact where provided, decision records | Art. 6(1)(c) GDPR where processing is required by law; Art. 6(1)(f) GDPR for platform integrity, dispute handling and enforcement |
| Handle legal/privacy requests | contact data, request content, evidence | Art. 6(1)(c), Art. 6(1)(f) and other applicable GDPR provisions |
| Establish, exercise or defend legal claims | relevant records and communications | Art. 6(1)(f) GDPR and other applicable provisions |
Where processing relies on consent, the user may withdraw the consent. Withdrawal does not affect processing that was lawful before withdrawal.
2.6 No advertising profiling and no AI moderation
FindMePlace does not currently intentionally use:
- Google Analytics;
- Meta Pixel;
- Hotjar;
- comparable advertising/behavioural trackers.
FindMePlace does not currently build advertising profiles from Portal use.
FindMePlace does not currently use AI or automated content-classification systems to decide whether a listing or message violates the rules.
Moderation decisions are made by a human administrator.
Current listing ordering is not personalised.
2.7 Message moderation and privacy
A recipient may report a specific internal message.
When a message is reported, the administrator can see the reported message in the moderation queue for the purpose of handling that report.
The implemented moderation flow is designed so that handling a specific report does not require general browsing of arbitrary private conversations.
If a message is hidden following moderation:
- its content is no longer shown to the two conversation participants in the normal conversation view;
- a replacement notice is shown;
- the author may be notified;
- the underlying record is not necessarily physically deleted merely because it is hidden.
2.8 Processors and infrastructure providers
netcup
Function: VPS/server infrastructure.
A separate netcup data-processing agreement (AVV/DPA) is in force.
Cloudflare
Functions currently used:
- R2 Object Storage for property images;
- DNS;
- Cloudflare Tunnel / Zero Trust connectivity;
- Turnstile anti-bot protection.
Cloudflare's current Customer Data Processing Addendum is Version 6.4, effective 3 April 2026.
Brevo / Sendinblue
Function: transactional email delivery.
FindMePlace uses the free Brevo service for transactional email. Brevo's DPA is incorporated into its service terms.
The Brevo legal materials identify Sendinblue SAS, France, as a Brevo legal entity. The Service may use relevant Brevo group companies and subprocessors in accordance with Brevo's applicable terms and DPA.
FindMePlace has configured transactional-log retention in Brevo to 30 days.
2.9 International transfers
Some infrastructure or service-provider processing may involve access to or processing of personal data outside the European Economic Area.
Where Chapter V GDPR applies, FindMePlace relies on a transfer mechanism permitted by the GDPR, as applicable, such as:
- an adequacy decision;
- Standard Contractual Clauses;
- another lawful transfer mechanism.
Service-provider transfer terms and subprocessor arrangements may change over time. FindMePlace periodically reviews the relevant provider documentation.
2.10 Retention
FindMePlace does not use one single retention period for all data. The current production retention model is:
| Data/system | Current retention / deletion rule |
|---|---|
| Active account and related service data | retained while needed to provide the active Service, subject to the more specific rules below |
| Account after user deletion | account becomes inactive immediately; hard deletion from the active database after 30 days |
| Rotating database backups | 14 days from creation; data deleted from the active database may remain in an older rotating backup for up to approximately 14 additional days |
| Practical maximum for deleted-account data (active system + rotating backup) | approximately 44 days, depending on backup timing |
| Security-event log in database | 90 days from the event |
| Rate-limit counters | approximately 25 hours |
| Temporary Google/Facebook OAuth registration record | approximately 15 minutes |
| Background-job logs | 14 days |
| Application container logs | size-based rotation (approximately 50 MB per service), not a fixed number of days |
| Tunnel/system logs | according to the applicable server operating-system rotation/configuration |
| Brevo transactional email logs | 30 days |
| Listing image, listing manually deleted | source image removed immediately from R2; a previously cached Cloudflare edge copy may remain available for up to approximately 4 hours |
| Listing image, active account, listing not manually deleted | up to approximately 180 days under the current listing lifecycle (90-day listing life + up to 90 days after expiry) |
| Listing/account data represented in a database backup | may remain until the relevant rotating backup expires, up to 14 additional days |
| Image after account deletion | removed from source storage as part of the hard-deletion process after the 30-day account-deletion period; edge cache may persist temporarily as described above |
| Illegal-content/moderation records | retained separately from the listing where needed for auditability, compliance, dispute handling, abuse prevention or legal claims; deletion of the underlying listing does not automatically delete the moderation case |
FindMePlace may retain particular information longer where required by law or where reasonably necessary for the establishment, exercise or defence of legal claims.
2.11 Account deletion
When a user deletes an account:
- the account becomes inactive immediately;
- public access to the deleted account/listings is disabled according to the implemented deletion flow;
- the active database record is scheduled for hard deletion after 30 days;
- related records and R2 source images are deleted through the hard-deletion process;
- older rotating database backups expire according to the 14-day backup-retention cycle.
A user may contact [email protected] concerning deletion or privacy rights.
2.12 External links
Public external links intentionally added by a user may be visible to any visitor.
External destination sites are separate controllers/operators for their own processing once the visitor leaves FindMePlace.
FindMePlace validates user-submitted links for security, but this does not make FindMePlace responsible for the destination site's privacy practices.
Users should review the destination site's own privacy information before submitting personal data there.
2.13 Cookies and similar technologies
FindMePlace does not currently intentionally use advertising or analytics cookies.
The Portal uses first-party session, language and authentication-related storage described in the Cookie and Similar Technologies Policy.
The optional IP-based language-lookup function is currently disabled. If it is enabled in the future, FindMePlace will first complete the required legal review and update the relevant public information before activation.
2.14 Data-subject rights
Subject to the GDPR's conditions and exceptions, a person may have rights to:
- access personal data;
- rectify inaccurate data;
- erase data;
- restrict processing;
- receive portable data where the right applies;
- object to processing based on legitimate interests;
- withdraw consent where processing is based on consent;
- lodge a complaint with a supervisory authority.
Requests may be sent to: [email protected]
FindMePlace may need to verify the requester's identity before acting on a request.
2.15 Supervisory authority
The Bulgarian supervisory authority for personal-data protection is:
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
https://cpdp.bg/en/
A person may lodge a complaint with the CPDP or, where applicable under the GDPR, another competent supervisory authority.
2.16 Security
FindMePlace uses technical and organisational measures intended to protect personal data against unauthorised access, alteration, loss, destruction or disclosure. Measures include, depending on the function:
- authenticated sessions;
- server-side access controls;
- rate limiting;
- anti-bot protection;
- HTTPS;
- backup and restore procedures;
- security logging;
- operational monitoring;
- controlled access to infrastructure.
No internet service can guarantee absolute security.
2.17 Children
FindMePlace accounts are intended for users aged 18 or over.
If FindMePlace becomes aware that an account was created in breach of the age rule, it may restrict the account and take appropriate steps concerning the associated data.
2.18 Changes to this Privacy Policy
This Privacy Policy may be updated when:
- the Service changes;
- a processor changes;
- retention changes;
- new analytics/advertising tools are introduced;
- payment functions are introduced;
- ranking or moderation materially changes;
- legal requirements change.
The version and effective date will be updated when the Policy changes.
2.19 Contact
Privacy: [email protected]
Legal / DSA: [email protected]