Privacy Policy

1. Data Controller

1. The data controller for your personal data is Next Orbit OÜ, trading as LocaYo ("LocaYo", "we", "us", or "our"), a private limited company (osaühing) registered in the Republic of Estonia, registry code 17501338, registered address: Sepapaja 6, 15551 Tallinn, Estonia.
2. For data protection enquiries, contact our data protection contact at [email protected] or via our Help Centre contact form.
3. We process personal data in accordance with:
   • EU/Estonia: General Data Protection Regulation (GDPR) 2016/679 as directly applicable in Estonia
   • EU/EEA: General Data Protection Regulation (GDPR) 2016/679
   • Poland: RODO (Polish implementation of GDPR) and related Polish data protection laws

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, phone number, password, profile photo
• Profile information: bio, location, business details (for business accounts)
• Listing information: descriptions, photos, pricing, availability
• Listing location: we store the address you provide and publicly show only an approximate location — about 500 m from the real one. The exact rental address is shown to the renter after the booking is confirmed.
• Local classified ads (for sale, swap, free to collect): the content and photos of the ad, price, location, your declaration whether you advertise as a private individual or a trader, your consent to showing a phone number or e-mail address, and the ad's counters (views, number reveals, conversations started). Legal basis: performance of a contract (Art. 6(1)(b) GDPR); moderation and protection against abuse — our legitimate interest (Art. 6(1)(f)). A deleted ad disappears from the public part immediately, its photos are deleted from the CDN within 24 hours, and the record itself is kept for up to 12 months for the purposes of reports and disputes, after which it is permanently deleted
• Communications: messages with other Users, support requests
• Conversations with Bober Lokals (AI assistant): questions typed into the chat window. When Bober does not know the answer itself, the latest messages of that conversation are sent to Anthropic, which prepares the reply — without your name, email address or phone number. We store the question text (up to 300 characters) and Bober’s reply, without your IP address, to teach Bober new topics and detect abuse, and delete them after 180 days. Selected general questions and answers — without any data that could identify you — may be kept permanently as Bober’s answer templates. Legal basis: our legitimate interest in operating and improving the Platform (Art. 6(1)(f) GDPR). Do not type in data you do not want to share. You can switch Bober off in settings (Appearance section)
• Reviews: ratings and review content
• Verification data: identity documents (if you choose to verify)
• Payment information: payment details for premium features (Boosts) processed by our payment provider Stripe — we do not store full payment card details

2.2 Tax Compliance Information (Providers Only)

We are legally required to collect the following information from Providers under EU Council Directive 2021/514 (DAC7) as implemented in Estonian law.

• Tax identification data: Tax Identification Number (TIN), including PESEL/NIP (Poland), Steuer-IdNr (Germany), Isikukood (Estonia), or equivalent in your country of tax residence
• Date of birth (for individual Providers)
• Tax residence: country or countries of tax residence
• Full address: primary residential or business address
• Entity type: whether you are an individual or a business entity
• Business registration number (for business accounts, where applicable)
• VAT identification number (where applicable)
• Bank account details (if available to the Platform — see Section 3 for details)

2.3 Information We Collect Automatically

• Device information: IP address, browser type, operating system, device identifiers
• Usage information: pages viewed, features used, search queries, clicks
• Location data: general location based on IP, precise location if you enable it
• Cookies and similar technologies: see our Cookie Policy
• Messages sent via “Help”: when you write to us from your panel, we attach the page you are writing from and your device and browser type, plus any screenshots you add — only to look into the reported problem. We delete this data once the matter is resolved (screenshots after 30 days at the latest), and the conversation itself together with your account.

2.4 Information from Third Parties

• Social login providers (Google, Facebook): if you create an account or sign in with Google or Facebook, we receive from that provider your first name, last name, email address, profile picture and your account identifier with them. Legal basis: Art. 6(1)(b) GDPR (creating and running the account at your request). Publicly on the Platform we show only your first name — or the username you chose — and your profile picture; we never disclose your last name or email address to other users. You can change the public name and remove the picture in your account settings at any time.
• Payment processor: Stripe may provide us with transaction confirmations and limited account information for premium feature purchases
• Other Users: reviews and reports about you
• Publicly available sources (business card drafts): we may prepare a draft business card based on publicly available company data (e.g. business registers, the company's website). A draft is not public — only the business owner can see it via a dedicated link and decides whether to claim it; the owner may also request deletion of the draft (contact: [email protected])
• Real estate agencies and public sources (imported content): from a real estate agency that has ordered automatic import of offers from its software we receive the offer content together with the name of the agent in charge; we publish it in the offer on the agency's account, to the extent sent by the agency (legal basis: Art. 6(1)(f) GDPR — presenting the offer on the agency's behalf; the agent may ask for removal through the agency or directly from us). From public contract notices (Public Procurement Bulletin, Baza Konkurencyjności) we store only the contracting authority's name and the notice content — no names, e-mail addresses or phone numbers of contact persons. From the register of developer prices (dane.gov.pl) we store the developer's details and the investment contact details it has published.

2.4a Photos, Avatars and Documents — Public vs. Private Media

Important: we distinguish between public media (visible to everyone online) and private media (accessible only by LocaYo administrators).

Public media — visible to everyone:

• Your public display name: next to your listings, requests and reviews we show the username you chose, or — if you have not set one — your first name. We do not show your last name or email address — the only exception is an e-mail address you yourself choose to share in your Local classified ad (revealed to logged-in Users after they click "Show e-mail"). An account that provided no first name (e.g. created with an email or SMS code) appears as “User”.
• Your avatar (profile photo): visible on your public profile, next to your listings and reviews. By uploading an avatar you consent to it being publicly accessible. You can delete it in your account settings at any time.
• Listing photos: visible to all users and search engine crawlers (Google, Bing). After a listing is deleted, photos are removed from our CDN within 24 hours.
• Business logo and banner (business accounts): visible on the public business profile.
• Professional's business card (professionals directory): name, description, specialisations, service area, opening hours and photos of completed work are public. The phone number is not placed in the page content — it is revealed only after a logged-in User clicks "Show number", and the number of reveals is subject to anti-spam limits.

Private media — accessible only by LocaYo administration, signed links with expiry:

• Address verification documents: utility bills, tenancy agreements — stored on CDN with authenticated access (signed URLs with 5-minute TTL). Deleted immediately after admin decision (approved / rejected).
• Identity verification documents: ID scan, passport, selfie with document — same as above, signed URLs + deleted after decision.
• Business documents: tax ID, company registration, insurance, professional licences — same as above. Retained during verification + as required by law (e.g. DAC7).
• Partner agreement scans: for Referral Programme Partners — retained for the duration of the agreement + 5 years after termination (tax and accounting obligations).

All private media is encrypted in transit (HTTPS/TLS) and stored on Cloudinary infrastructure in "authenticated delivery" mode. The raw file URL alone is insufficient for access — LocaYo authorisation and a cryptographic signature with expiry are required.

2.5 Transaction Data

• Booking data: details of confirmed bookings including dates, duration, listed price, booking status, and number of transactions per Provider per quarter
• Pickup/delivery addresses: When you complete a booking, addresses may be shared between Provider and Customer
• Data minimisation: We recommend providing approximate location rather than exact home address
• Automatic deletion: Address data from completed bookings is automatically anonymised after 30 days

2.6 A Provider's client data — we process it on their behalf

Providers (companies and individuals offering services) have their own client base and appointment schedule in the dashboard. They may also add people who have no LocaYo account.

• The Provider is the controller of that data, not LocaYo. We act solely as a processor (Art. 28 GDPR) on their instructions — details in the Terms, Section 8a.
• What data: name, phone, e-mail, notes and markers entered by the Provider, tags, and the history of appointments, bookings and jobs.
• What we do NOT use it for: we do not use it for our own purposes — no marketing, no profiling, no resale. It is not visible to other Users, nor in the LocaYo admin panel.
• Return reminders are sent to the Provider, never to their client.
• How long: until the Provider deletes the card or their account — deleting the account removes the entire base together with the schedule once the 14-day grace period has passed.
• If you are a Provider's client and want to access, correct or delete your data in their base, contact them directly. We will pass such a request on and help them act on it, but we cannot decide about someone else's data.

3. How We Use Your Information

Note on tax compliance data: Processing of tax compliance data (TIN, date of birth, address, tax residence) is based on our legal obligation under EU DAC7 (Council Directive 2021/514) as implemented in Estonian law and does not require your consent. However, you will be informed before this data is collected and have the right to understand how it is used. The data will only be used for the purpose of fulfilling our tax reporting obligations and will not be used for marketing or other unrelated purposes.

4. Who We Share Your Data With

1. Other Users: information necessary to complete a transaction:
   • Rental / booking: name, profile photo and contact details shared with the other party once a booking is confirmed.
   • Phone number in a listing: if the Provider consented when creating the listing, a logged-in User can reveal their number with the "Show number" button — before any booking. The number does not appear in the listing content; only a preview such as "+48 500 ••• •••" is visible. Reveals are subject to anti-spam limits. Without that consent, contact happens solely through chat.
   • Aggregate statistics for the Provider: the listing owner sees in their dashboard the number of views, number reveals, conversations and bookings, plus how visitors reached the listing and what type of device they used. We do not pass on data identifying an individual person — no identity, no IP address, no browsing history.
   • Job board (requests): when you post a request, its content (category, description, city, indicative budget) is visible to matching pros — without your contact details. Pros apply with an in-app message. Only when you choose a specific pro are phone numbers shared mutually (you see the pro's number, the pro sees yours) to enable direct contact. Until you choose, communication happens solely through in-app chat. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request / performance of the service).
2. Service Providers (Sub-processors): We use the following categories of third-party services to operate the Platform:
   • Application hosting (Hetzner Online GmbH, Germany) — server infrastructure in the EU
   • Database hosting (MongoDB, Inc., USA — data stored in the EU/Germany) — account and listing data storage
   • Image hosting (Cloudinary Ltd., Israel) — listing photos, avatars, verification documents
   • Payment processor (Stripe Payments Europe Ltd., Ireland) — payment processing for premium features
   • SMS verification (Twilio Inc., USA) — one-time code for phone number confirmation
   • Transactional email (Resend Inc., USA) — system emails (confirmation, password reset, notifications)
   • AI assistant (Anthropic, PBC, USA) — Bober Lokals replies to questions typed into the chat window; Anthropic does not use this data to train its models
   • Social login & analytics (Google LLC, USA) — Google OAuth and Google Analytics (analytics only with consent)
   • Facebook login (Meta Platforms Ireland Ltd., Ireland) — Facebook Login; we receive your first name, last name, email address, profile picture and account ID from Meta only when you click "Continue with Facebook" yourself
   • Advertising & conversion measurement (Google Ireland Ltd. / Google LLC, USA) — Google Ads and ad performance measurement (only with consent)
   • Marketing pixel (Meta Platforms Ireland Ltd.) — measuring campaign performance across Meta services (loaded only after consent)
   • Application error monitoring (Functional Software, Inc. dba Sentry, USA) — diagnosing crashes and technical errors
   • Bot protection & performance (Cloudflare, Inc., USA) — form protection (Turnstile), abuse prevention and content delivery

   Each sub-processor processes data only on our instructions and is bound by appropriate data processing agreements. A full, up-to-date list of sub-processors (with technical details) is available upon request at [email protected].

3. Tax Authorities: We are legally required to share Provider information with:
   • Maksu- ja Tolliamet (Estonian Tax and Customs Board) — annual reports under EU DAC7 as implemented in Estonian law
   • EU member state tax authorities — Maksu- ja Tolliamet automatically exchanges reported information with the tax authorities of each Provider's country of tax residence under DAC7 provisions

   Information shared with tax authorities includes: Provider name, address, date of birth, TIN, total transaction value (based on listed prices), number of transactions, platform fees, and (for property rentals) property addresses and days rented. This sharing is based on our legal obligation under Art. 6(1)(c) GDPR.

4. The Provider's team: if a Provider uses team accounts, the people they designate see data within the role and permissions granted to them — including the schedule and the client cards described in 2.6. Who gets access, and to what, is decided solely by the Provider, who is responsible for their team's actions.
5. Legal and Regulatory: When otherwise required by law, court order, or to protect rights and safety.
6. Business Transfers: In connection with merger, acquisition, or sale of assets.

5. International Transfers

1. Your data may be transferred outside the European Economic Area (EEA). We use the following safeguards:
   • EU/EEA: Application hosting (Hetzner, Germany), payment processing (Stripe Payments Europe, Ireland) and database hosting (MongoDB — data stored in Germany) process data within the EU/EEA, where GDPR applies directly.
   • Israel: Image hosting (Cloudinary Ltd.) takes place in Israel, which is covered by a European Commission adequacy decision — transfers rely on that basis.
   • United States: SMS verification (Twilio), transactional email (Resend), the AI assistant (Anthropic) and social login & analytics (Google, Meta) may process data in the US. These transfers are protected by the EU-US Data Privacy Framework (where the provider is certified) and/or Standard Contractual Clauses (SCCs) approved by the European Commission. MongoDB, Inc. — as a US-based entity — may potentially access data stored in the EU; we also safeguard this with SCCs/DPF.
2. Tax compliance data (TIN, address, date of birth) is shared with the Estonian Tax and Customs Board (Maksu- ja Tolliamet), which automatically exchanges this data with the tax authorities of the Provider's country of residence under DAC7 automatic exchange provisions. As Estonia is an EU member state, these transfers occur within the EU/EEA framework.
3. You can request more information about international transfers and the safeguards in place by contacting [email protected].

6. Your Rights

Under EU GDPR and RODO, you have the following rights:

1. Right of access — Request a copy of your personal data.
2. Right to rectification — Request correction of inaccurate data.
3. Right to erasure — Request deletion of your data in certain circumstances. Once you request account deletion, your business profile, listings and job requests stop being publicly visible immediately, and the data is erased and anonymised after 14 days. That period exists only so you can change your mind — until it ends, simply logging in restores the account. After that date the deletion is irreversible; we only keep records we are legally required to retain (accounting and tax documentation).
4. Right to restrict processing — Request we limit how we use your data.
5. Right to data portability — Request your data in machine-readable format.
6. Right to object — Object to processing based on legitimate interests or for direct marketing.
7. Rights related to automated decision-making — Rights regarding automated decisions that significantly affect you.
8. Right to withdraw consent — Withdraw consent at any time where we rely on it.

Note on tax compliance data: Your rights to erasure and restriction may be limited in respect of tax compliance data (TIN, date of birth, address, tax residence) where we are required by law to retain and process this data for tax reporting purposes. In such cases, we will explain the specific legal basis and any limitations that apply.

Data held in a Provider's client base: if your data was entered into a particular Provider's base (2.6), that Provider is the controller — address your request to them. A request sent to us will be forwarded to them without delay.

To exercise your rights, contact us at [email protected] or through our Help Centre. We respond as quickly as possible — usually within a few days (the statutory period is one month, or up to three months for complex cases, with notification).

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS)
• Encryption at rest: All data stored in our database is encrypted at rest using industry-standard encryption provided by our cloud infrastructure
• Field-level encryption: Highly sensitive data such as Tax Identification Numbers and bank account details are additionally encrypted at the application level using AES-256-GCM encryption before being stored in our database
• Password hashing: Passwords are hashed using bcrypt and are never stored in plain text
• Regular backups: Automated encrypted backups with secure storage
• Access controls: Strict role-based access controls limiting who can access personal data, with enhanced restrictions on tax compliance data
• Security monitoring: Continuous monitoring for unauthorised access and security incidents
• Protection against fraud: we automatically check whether messages between Users contain links to external websites, whether an e-mail address comes from a disposable inbox, and whether a series of accounts is being created from one connection or device (IP address and device identifier). The only outcome is that the account is flagged for review — a human decides on suspending or deleting an account (legitimate interest, Art. 6(1)(f) GDPR)
• Reported conversations: when a participant reports a conversation with the "Report" button, the latest messages from that conversation (up to 30) are attached to the report. A moderator sees them in order to assess the report and, if necessary, block the conversation or the account (legitimate interest, Art. 6(1)(f) GDPR)
• Data minimisation: We collect only the data necessary for each purpose and delete it when no longer needed

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.

8. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

9. Children's Privacy

1. Our Platform requires users to be at least 16 years old (18 to be a Provider).
2. We do not knowingly collect data from children under 16. If we learn we have, we will delete it promptly.

10. Changes to This Policy

1. We may update this Privacy Policy to reflect changes in our practices or legal requirements.
2. Material changes will be notified via email or prominent notice on the Platform at least 15 days before taking effect. This notice period does not apply to changes we have to make immediately because the law or the security of Users and the Platform requires it — we will inform you of such a change without delay.
3. The current version is always available on the Platform.

11. Contact Us

For privacy-related enquiries:

• Data protection contact: [email protected]
• Help Centre: locayo.app/help
• General enquiries: [email protected]