Essential reminder: Xaaya collects no payment. Any transfer request presented as coming from Xaaya is fraudulent.
1. Data collected
- Account data: first name, last name, email address, phone number, role, city, profile picture.
- Listing data: description, price, approximate location, photographs, amenities.
- Usage data: pages viewed, favourites, saved searches, connected devices.
- Technical data: session identifier, language and theme preferences, push notification token.
2. Purposes of processing
- Deliver the service: publishing, searching, matchmaking, messaging.
- Ensure safety: fraud detection, trust score computation, handling of reports.
- Improve the product: aggregated and anonymised statistics.
- Inform: notifications about your listings, messages and alerts.
3. Legal basis
Processing is based on performance of the contract (providing the service), on legitimate interest (security and fraud prevention) and, for non-essential notifications, on your consent.
4. Retention periods
- Active account: for as long as you use the service.
- Deleted account: immediate anonymisation, data purged within 30 days.
- Expired or deleted listings: 12 months for evidence and fraud-prevention purposes.
- Messages: 24 months after the last exchange.
- Technical logs: 60 days.
5. Recipients
Your data is hosted by our infrastructure provider (Supabase) and served by our application host (Vercel). No data is passed to data brokers or advertising networks.
Public profile information (first name, last name, picture, verification badge, rating) is visible to other users. Your phone number is shown only if you explicitly allowed it.
6. Your rights
- Right of access and portability: export your data from your profile.
- Right to rectification: edit directly from your profile.
- Right to erasure: delete your account from the danger zone of your profile.
- Right to object and restrict: disable notifications and phone visibility.
8. Security
- Encryption in transit (strict HTTPS) and at rest.
- Data partitioning through row-level security policies (RLS).
- Passwords stored as salted hashes, never in clear text.
- Administrator access restricted and logged.
9. Contact
For any question regarding your data, write to the contact address given in the legal notice. You will receive a reply within thirty (30) days.