Privacy Policy

What we collect

The data you give us and the data created when you use Depozza:

• Account and profile: name, email, password (stored hashed by our sign-in provider), language and, only if you add them, photo, bio, phone number and postal address.
• Identity check: before you host or book, our partner Didit checks an ID document and a selfie; we keep the result, your legal name and date of birth. If you upload a document yourself instead, it is stored privately for our review.
• Activity: listings (with their photos and address), bookings, contracts (with the IP address used to accept them), payment and payout records, messages and attachments, move-in/move-out photos, disputes, reviews, reports and support requests.
• Device: your location only when you tap “Near me” or “Use my location”; the camera and photo library only when you add a picture. No advertising identifier, no tracking, no analytics in the app.

How we use it

To operate the marketplace, verify users, process payments and held deposits, prevent fraud and provide support.

• Operate bookings, payouts and the conversation between host and renter.
• Verify identity, prevent fraud and meet EU obligations (DAC7, AML).
• Improve product reliability and answer your support requests.

Sharing

We share data only with the providers that run the service for us, under data processing agreements, or when the law requires it:

• Supabase (database, sign-in and file storage) and Cloudflare (website and server functions).
• Stripe (payments and host payouts; card and bank details are entered on Stripe’s own pages, not ours) and Didit (identity verification: ID document and selfie).
• OpenStreetMap: map tiles, the places you search for and, when you use your location, an approximate position (rounded to about 1 km). Our email provider sends account and booking emails.
• Authorities, only when the law requires it. We never sell data and the app contains no advertising or analytics tools.

Your rights

You can access, correct or delete your data and export it at any time, in line with GDPR.

• Export a copy of your data: Settings → Account → Export my data.
• Correct your details at any time in Settings, and object to or restrict a processing by writing to us.
• Delete your account: Settings → Account → Delete account. If a booking is still running, your listings go offline at once and we close the account when it ends.

How long we keep it

While your account is open. When you delete it we erase your profile, photos and identity documents. Contracts, booking, payment and tax records are kept for up to 10 years where the law requires it (commercial and tax law, DAC7), and messages tied to a booking for as long as a claim about that booking remains possible.

Location, camera and photos

The app asks for your location only when you tap “Near me” in search or “Use my location” when listing a space, to sort spaces by distance or fill in the address. It is never tracked in the background. The camera and photo library are used only when you choose to add a photo: listing, profile, identity document, chat, move-in/out or dispute evidence. The website sets only essential cookies (sign-in, security and your language).

Security

Connections are encrypted (HTTPS), database access is limited by row-level security, and sensitive actions are logged. To report a security issue, email support@depozza.com.

International transfers

Some providers (for example Stripe, Cloudflare or Supabase) may process data outside the European Union. In that case we rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.