We collect only the data needed for DiasHome to work, and we don’t sell it. This policy explains what personal data we process, why and on what legal basis, who we share it with, how long we keep it and what rights you have. It has been drawn up in accordance with the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller responsible for processing your data is the DiasHome service. For any questions about personal data, write to support@diashome.app or on Telegram to @diashome_admin.

2. What data we process

2.1. Account

• your e-⁠mail, and your name and profile photo if you have provided them;
• the site language, country and city;
• the sign-in method. When you sign in with Google, we receive your e-⁠mail, name and Google account ID from Google; we have no access to your Google password;
• the date you accepted the terms of use, your notification settings and your consent to newsletters;
• your plan and its expiry date, your invitation code and information about who invited you.

2.2. Sign-in and security

• sign-in codes — only as an irreversible hash;
• sessions: device and browser type, time of sign-in and of last activity;
• IP address — in stored data only as an irreversible hash from which the address can’t be recovered. To protect against abuse, the IP address is briefly used in request rate counters and is not stored;
• the two-⁠factor authentication key — in encrypted form, and recovery codes.

Like any website, our servers receive the IP address and technical data of every request. Technical logs are kept for a limited time and are used only to run and protect the site.

2.3. Listings, profiles and reviews

Everything you publish: texts, photos, prices, city and address, contacts (contact name, phone, messengers, e-⁠mail, website, social media), opening hours, languages, portfolio, reviews and replies to them. We remove metadata from uploaded photos, including information about where they were taken. We use the address of a listing or profile to find its point on the map.

2.4. Documents for checks

If you verify your profile’s documents, we receive the document files and your comment. They are kept in secure private storage, they are opened only by staff who check documents, every view is logged, and the files are deleted immediately after the decision.

2.5. Payments

Orders, payments, the balance and its transactions, plans, promo codes. Card details are entered on the page of the payment service Whop, and we don’t receive them: Whop sends us only the payment ID and status, the amount, the currency and, if the payment failed, the reason it was declined.

2.6. Use of the site

• favourites, saved searches and notifications;
• contact views: whose contacts were opened and when. For guests, a hash of the network and browser is used instead of an account. This is needed to protect authors from contact harvesting and for the “Contacted via DiasHome” badge in reviews;
• views of listings and profiles — counted anonymously, with only daily totals stored;
• search queries — not linked to you, as daily totals, to improve search and suggestions;
• reports (and the e-⁠mail for the reply, if you provided one), appeals and correspondence with support.

2.7. Location

We determine your approximate country and city from network data in order to show listings near you straight away. We request your browser’s precise location only with your permission and use it to find the nearest city; the coordinates themselves are not stored.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): account and sign-in, publishing listings and profiles, showing contacts, reviews, favourites, saved searches, notifications, paid services and support.
• Legitimate interests (Art. 6(1)(f) GDPR): security of the site and accounts, protection against fraud, spam and bots, moderation and handling of reports, anonymised statistics and improvement of the site, protection of our rights.
• Legal obligations (Art. 6(1)(c) GDPR): accounting and tax records of payments, responses to lawful requests from public authorities, handling of reports of illegal content.
• Consent (Art. 6(1)(a) GDPR): newsletters and location detection by the browser. You can withdraw your consent at any time — this doesn’t affect the lawfulness of processing before the withdrawal.

4. What other users see

• Published listings, profiles, reviews and replies are visible to all visitors and may appear in search engine results.
• The contacts in a listing or profile are shown when someone presses “Show contacts”.
• Your account e-⁠mail is not shown to other users unless you have added it to your contacts yourself.
• The name from your account is shown next to your review, and if no name is set — “User”.

5. Who we share data with

We don’t sell personal data or share it for advertising. Data is received only by those who help us operate — to the extent necessary and on the basis of contracts that oblige them to protect the data:

• providers of hosting, content delivery networks, attack protection and file storage;
• e-⁠mail delivery services;
• the “I’m not a robot” check service — when you sign in, send a report or open contacts frequently;
• the payment service Whop — when you pay by card; Whop processes payment data under its own privacy policy;
• Google — if you sign in with Google;
• map services based on OpenStreetMap: they receive the address of a listing or profile, without any information about you, to find the point on the map; when you view a map, your browser loads map tiles from the map service’s servers;
• public authorities — only upon lawful request.

Some of these providers may process data outside the European Economic Area. In that case, data is transferred only with the safeguards provided for by the GDPR: on the basis of an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or the EU standard contractual clauses.

6. How long we keep data

• account — as long as it exists; after deletion — 30 days in case it is restored, then the data is anonymised;
• sign-in codes — up to 24 hours;
• session information — up to 30 days after signing out or the end of the session;
• notifications on the site — up to 6 months after being read, unread ones — up to a year;
• e-⁠mail delivery information — up to 90 days;
• information about contact views — up to 13 months;
• activity log for security and for resolving disputes — up to 2 years;
• documents for checks — deleted immediately after the decision, when the request is withdrawn or when the profile is deleted;
• photos you uploaded but didn’t publish — up to 24 hours;
• archive with a copy of your data — 7 days;
• payment data — as long as tax and accounting laws require, usually up to 10 years;
• backups — up to 30 days.

7. Deleting your account

To delete your account, write to support from the address it is registered with. Immediately after deletion, your listings and profiles stop being shown and all sessions are ended. For 30 days you can restore the account by signing in again. After that, we anonymise the account: we delete your e-⁠mail, name, photo and city, sign-in methods, sessions, favourites, saved searches, notifications, listings, profiles and photos. Payment data is kept for the period required by law. Your reviews stay on the site signed “Deleted user” — if you want to delete them too, do so before deleting your account or write to us.

8. Your rights

Under the GDPR, you can:

• find out what data about you we process and get a copy of it;
• correct inaccurate data — you can change most of it in your account;
• have your data erased;
• restrict processing;
• receive your data in a machine-readable format and transfer it to another service;
• object to processing based on legitimate interests;
• withdraw your consent;
• lodge a complaint with a data protection supervisory authority — in the country where you live or work, or where you believe your rights have been infringed.

To exercise your rights, write to support@diashome.app from the address your account is registered with. We may ask you to confirm that the request came from you. We reply within one month; if the request is complex, this period may be extended, and we will let you know.

9. How we protect data

The connection to the site is encrypted. IP addresses and sign-in codes are stored only as hashes, and two-⁠factor authentication keys in encrypted form. Documents for checks are stored separately in secure private storage. Staff have access only to the data they need for their work.

10. Cookies

We use only necessary and functional cookies, with no advertising or tracking cookies. Read more in the cookie policy.

11. Automated decisions

The automatic check may immediately reject a listing, profile or review with an obvious violation. In that case, you see what to fix and can send the content again or appeal the decision — it is then reviewed by a person. We make no other automated decisions that have legal effects for you.

12. Children

DiasHome is not intended for children under 16. If we learn that an account was created by a child under this age, we will delete the account.

13. Changes to this policy

We update this policy when the way the site works or legal requirements change. The date of the last change is shown at the top of the page. We announce material changes on the site or by e-⁠mail.