This policy explains what data we collect when you use the KibrisYuvam website and mobile app, why and on what basis we process it, who we share it with, how long we keep it, and how you can exercise your rights. We never sell your data to third parties and we do not track you for advertising.
1Data Controller
The controller of your data is KibrisYuvam. For any question or request about your personal data: kibrisyuvam@kibrisyuvam.com
2Data We Collect
What you give us
- Account information: first and last name, email, password (stored only as an irreversible hash), phone number, country of residence, profile photo, language preference.
- Phone verification: your number and when it was verified, when you verify it to publish listings.
- Listing data: property details, descriptions, photos, the location you mark on the map, your contact preferences.
- Ad data (for advertisers): ad text, images and the listing it links to.
- Messages: your in-platform chats, message reactions, edited and deleted messages.
- Preferences: favourite listings, your saved searches (Listing Alerts) and the listings that matched them, notification preferences, users you have blocked.
- Reports: the content of a report you file about a listing or a user; for user reports, a copy of the related chat for review.
Collected automatically
- Security records: the IP address and device/browser of your login sessions; the IP address when an SMS code is requested.
- Notification data: your device's push-notification token, so we can send mobile notifications.
- Statistics: which listing was viewed, taps on the Call/WhatsApp buttons, where a visitor came from (e.g. Facebook, WhatsApp, Google), ad impressions and clicks. On the website nothing is stored in your browser for this; a visitor is counted with a code that changes every day and cannot be reversed. The mobile app uses a random device-specific id. These codes are never linked to your name or email.
- App error reports: when the app crashes, the device model, operating system version and error details.
We do not collect payment or card information — the platform has no payment system.
3Public Information
When you publish a listing, the following is visible to every visitor: the listing content and photos, your name (or the display name you set) and profile photo, your phone number if you chose to show it on the listing, and the location.
When you create a listing you can set its location as "exact" or "approximate". With approximate, the real location never leaves our server; the map only shows an area.
4Why We Process Your Data and on What Basis
| Purpose | Basis |
|---|---|
| Account, listings, search, messaging, favourites, Listing Alerts | Our terms of use contract with you |
| Phone verification, preventing fake accounts/listings and fraud, security records | Legitimate interest (platform safety) |
| AI pre-screening of listing and ad content | Legitimate interest (keeping illegal and rule-breaking content off) |
| Statistics and the Weekly Report for listing owners and advertisers | Terms of use contract and legitimate interest |
| Push notifications | The permission you grant on your device (you can turn it off at any time) |
| Lawful requests from authorities | Legal obligation |
Automated screening: listing text, photos and ads submitted for publication are first screened by AI against our rules. The result goes to an administrator; a human always makes the final decision and can override the AI's assessment. To challenge a decision, write to us.
5Emails and Notifications
We only send emails and notifications related to the service: account verification, password reset, listing approval or rejection, new messages, new listings that match your saved search, and the Weekly Report for listing and ad owners. We do not send marketing email.
You can turn off the Weekly Report from the link in the email or from Notification preferences, and push notifications from your device settings or Notification preferences.
6Who We Share Your Data With
Your data is shared only with the service providers needed to run the service, for the limited purposes below. None of them may use your data for their own purposes or sell it.
| Provider | What for | Data shared |
|---|---|---|
| Railway | Servers and database | Platform data (for hosting) |
| Cloudflare | Photo storage and delivery, domain, cookieless site statistics | Photos; anonymous visit data |
| Resend | Sending email | Your email address and the email content |
| Twilio | SMS verification codes | Your phone number |
| OpenAI | Automated screening of listing and ad content; AI ad images for advertisers | Listing text and photos, ad text and images (no identity data is sent) |
| Expo, Apple, Google | Delivering push notifications to your device | Notification token and notification text |
| Sentry | App error reports | Device model, operating system, error details |
| MapTiler, Google Maps | Showing maps | Your IP address and the map area when you open a map |
Beyond these, your data is shared only where legally required (a court order, a request from a competent authority) or in the fraud/criminal-activity case described in Article 9.
Listings and ads may link to other sites (e.g. an advertiser's website, WhatsApp). We are not responsible for those sites' privacy practices; this policy covers KibrisYuvam only.
7International Transfers
The servers of the providers above are outside Northern Cyprus, mainly in the United States and the European Union, so your data is transferred abroad. We work with these providers under data processing terms that require them to process data only on our behalf and securely.
8Cookies
The website uses only essential cookies: the login cookies that keep you signed in, and your language preference. We do not use statistics, advertising or tracking cookies, and we store nothing in your browser for statistics, which is why we do not ask for cookie consent.
9Data Security
Your password is stored as an irreversible hash, connections are encrypted (HTTPS), sessions are managed with time-limited access tokens, and administrator actions are recorded in an immutable audit log. No system is 100% secure; if a security incident is detected, we will notify you in line with our legal notification obligations.
To deter abuse, the IP address and device information of your login sessions are kept as a security record. These records are used only for account security, fraud investigation and abuse detection — never for marketing or profiling. If criminal activity is detected, they may be shared with the relevant authorities upon lawful request.
10Data Retention
| Data | How long we keep it |
|---|---|
| Account, listings, messages, favourites, saved searches | While your account is open; on deletion, as described in Article 11 |
| Expired listings | Until you delete them or your account is deleted (so you can republish) |
| Security records (login IP and device) | 12 months from creation, once the session has ended |
| SMS code requests | 30 days |
| Statistics | 24 months |
| App error reports | Up to 90 days |
| Report and moderation records, audit log | For moderation integrity and fraud prevention; your identity is anonymised when your account is deleted |
11Account Deletion
After your deletion request, a 30-day recovery period begins; during this time you can restore your account by logging back in. At the end of that period:
- Your listings and listing photos are permanently deleted from storage.
- Your name, email, and phone information are anonymized; you can no longer log in to the account.
- Your device notification token and notification preferences are deleted entirely.
The following are retained, in limited form, even after deletion, for the reasons stated:
| Data | Why it is retained |
|---|---|
| Audit logs | To prevent fraud and abuse; your identifier in the record is anonymized. |
| Shared message history | The other party's right to their own conversation history; the sender's name is shown as "Deleted User". |
| Reports filed by/about you | To preserve the integrity of the moderation process. |
| Backup copies | For the duration of our infrastructure provider's standard backup cycle; already separately and permanently deleted from the active system. |
12Your Rights
You have the following rights over your data:
- Access: to find out what data we hold about you and get a copy.
- Correction: to fix inaccurate or incomplete data (most of it you can change yourself in profile settings).
- Deletion: to have your account and data deleted (Article 11).
- Portability: to receive the data you gave us in a common format.
- Restriction and objection: to ask us to stop a particular processing, or to challenge an automated screening decision.
- Withdrawing permission: to turn off notifications and the Weekly Report at any time.
- Complaint: to complain to the data protection authority where you live if you believe your data is processed unlawfully.
Send your requests to kibrisyuvam@kibrisyuvam.com; we respond within 30 days at the latest.
13Children's Privacy
KibrisYuvam is not directed at anyone under 18; we do not knowingly collect data from children.
14Changes to This Policy
We may update this policy. For material changes we will let you know in the app or on the website; the "Last updated" date at the top of this page changes with every update.
For any request regarding your personal data, write to kibrisyuvam@kibrisyuvam.com.