Privacy policy

1. Controller and contact

PlusHouse Dev L.L.C., business number 812366062, Jashar Salihu 51, Prishtinë, Kosovo, controls personal data used for accounts, operating and securing the platform, public publication, support, moderation, billing and its own lawful communications. Contact privacy@plushouse.eu for privacy requests or info@plushouse.eu for support. This notice covers web and mobile services.

Agencies independently control their client service, property mandates, transaction documents and their own marketing. For private CRM and document-vault information processed only on an agency's documented instructions, PlusHouse acts as a processor under the Data Processing Addendum. Roles depend on the actual purpose and decisions, not merely the contract label. Contact the agency for its own privacy notice; contacting us does not prevent a request to it.

2. Data, sources and purposes

• Accounts and agency profiles: names, email, phone, authentication identifiers, profile images, business and registration details, roles and team memberships. Sources include you, your employer or agency and the authentication service. Used to create and secure access, administer teams and review business applications.
• Property services: addresses and map coordinates, property facts, prices, photos, floorplans, descriptions, availability, publication and edit history, owner submissions, favorites, saved searches and buyer preferences. Sources include the submitting user, agency, authorized imports and public listing material. Used to publish, search, recommend and manage properties.
• Client and agency records: inquiry and message content, contact details, appointments, CRM notes, deal stages, uploaded contracts, identification and other documents. Used to route a requested contact and provide agency workflow and storage tools, with access determined by role and permissions.
• Support, safety and billing: complaints, reports, support conversations, audit events, payment or promotion references, amounts and status. Used to respond, investigate abuse, provide paid services and meet applicable recordkeeping obligations. Card payments, where enabled, are handled by the payment provider; do not send card details through messages.
• Technical and preference data: request logs, IP and device information where collected by infrastructure, app diagnostics, page and listing events, random session identifiers, referrer, consent choices and notification settings. Used for delivery, security, reliability and permitted measurement. Browser storage is described in the Cookie Policy.
• AI and voice features: prompts, messages, requested document contents and related CRM matching candidates, extracted fields, outputs, and voice/audio or transcripts when those functions are used. Used to provide the selected feature, including listing review, translation, matching and estimates. Do not provide unnecessary sensitive data.

3. Legal bases and required information

We use contract necessity for the account and service you request; legal obligation for duties that actually apply; legitimate interests, after balancing your rights, for proportionate security, fraud prevention, complaint handling and service reliability; and consent for optional marketing and non-essential tracking where required. A contractual requirement is not consent, and legitimate interests are not a blanket basis for advertising cookies or every AI use. Agencies must identify their own lawful basis for private client records, including any additional condition for sensitive data.

Account identifiers are needed for signed-in features; property facts and contact-routing information are needed for the service selected. Refusing optional marketing, analytics or location permission does not prevent basic browsing. We explain when missing required information prevents a particular action. We do not treat acceptance of terms as permission for every processing purpose.

4. Public information and agency recipients

Approved, visible listing and agency information is public: property descriptions, media, price, location as displayed, agency profile and contact details may be viewed, shared, cached or indexed by search engines. Do not put ID documents, signatures, tenant details or confidential contracts in public media. Removing a page does not instantly remove third-party caches; we can consider reasonable follow-up requests.

When you contact an advertiser or send property information to a chosen agency, your submitted contact details, message, property data and attachments needed for that request are made available to the recipient and its authorized team. That recipient is responsible for its subsequent client handling and separate marketing. Private vault material is not intended for public indexing; authorized staff and service providers may access it as necessary for the service, support, security or a lawful obligation.

5. Service providers and other disclosures

• Clerk: sign-in, identity and organization administration; account identifiers, contact details and membership data.
• Convex: application database, authorized queries, background tasks and file references; records needed by the requested platform features.
• Railway and Cloudflare, including R2: application hosting, network delivery and public or private object storage; request data, uploaded files and operational metadata. Legacy or configured Vercel services may also receive relevant delivery or performance data.
• Resend: transactional messages and permitted marketing; delivery addresses, message content and delivery preferences. Expo, Apple and Google: push delivery and app distribution where used; notification tokens and message payloads.
• Stripe, where checkout is enabled: payment processing; checkout email, payment details provided to Stripe, billing and payment references. PlusHouse receives the relevant payment status and reference data.
• Sentry: error monitoring and diagnostics; masked replay only with analytics consent on permitted public routes. Google Analytics and Microsoft Clarity: permitted analytics with consent. Meta Pixel and the server conversion endpoint: marketing/conversion events with marketing consent where configured. These services may receive device, event, cookie or network identifiers according to the feature and provider terms.
• Configured AI providers, principally Google AI and OpenAI in the current service, and any configured gateway: inputs necessary for the selected feature, outputs and usage metadata. A requested vault analysis sends the document and relevant candidate contact, listing and deal data to the configured model. Provider retention and model-training terms depend on the actual contracted service; this notice does not promise zero retention or no training without verified contractual controls.
• Map/geocoding, nearby-place, media-processing and external import services, where used: submitted locations, media or source URLs needed for that operation. Opening a third-party map, media embed or external link may also disclose request information directly to that provider.
• Professional advisers, competent authorities or a business successor: information necessary for a lawful duty, claim, safety response or legitimate reorganization with appropriate safeguards. We do not sell personal data for a data-broker business. Consent-based advertising disclosures still occur as described above and may have specific legal treatment in your jurisdiction.

6. International processing

Providers may process data outside Kosovo or your home country. The location depends on the provider, selected region, support access and service settings. We do not promise that all records remain in Kosovo or the EU. Ask privacy@plushouse.eu for information about applicable recipients and safeguards.

Where required, transfers need a valid mechanism and any necessary assessment or authority authorization, including the Kosovo transfer framework and, where GDPR applies, adequacy or appropriate contractual safeguards and supplementary measures. A privacy-policy statement or ordinary terms checkbox does not itself legalize an international transfer. Specific transfer information and relevant safeguards can be requested, subject to justified protection of confidential details.

7. Retention and deletion

Account and active-service records remain while needed for the service. Private agency records follow lawful agency instructions and applicable legal holds. Billing, disputes, safety and audit material may require limited retention for an identified legal or operational purpose. We assess erasure by category; not every record must be kept simply because a dispute is theoretically possible.

Raw first-party page-view cleanup is scheduled after 90 days and hourly traffic-rollup cleanup after 7 days; aggregate daily totals can remain. These are configured windows, not a promise that every production cleanup has been independently audited. Other records and vendor backups have no single universal deletion period. Removal from active systems, provider backups, an agency's own copy and search-engine caches are separate processes. Deletion requests are handled through the procedure on the Account Deletion page.

8. Security and limitations

The service uses authenticated access and backend permission checks for private functions, scoped private file access, validation and operational safeguards. Authorized agency staff can access the information their permissions allow; system administrators and processors may require access for legitimate support, security or legal tasks. These measures reduce risk but do not guarantee that loss, unauthorized access or outages are impossible. Report suspected exposure promptly to privacy@plushouse.eu without transmitting unnecessary identity documents.

9. Recommendations and automated assistance

Search and recommendation tools can use selected filters, listing facts, saved searches, buyer preferences and interaction signals. Sponsored placements are separate commercial exposure. AI may assist with review, ranking, translation or document extraction; errors and unfair results are possible. Ask for an explanation or human review of a disputed restriction or significant decision. The mortgage tools do not decide a credit application. Any legally significant solely automated decision requires its own lawful basis and safeguards where applicable.

10. Rights, requests and complaints

Subject to applicable law, you may request access, correction, erasure, restriction, portability and information about recipients and safeguards, object to relevant processing including direct marketing, and withdraw consent without affecting earlier lawful processing. Contact privacy@plushouse.eu using the account email if possible. We ask only for proportionate identity or authority verification; never send passwords or full payment-card information.

We respond without undue delay and, where Kosovo law or GDPR requires, within one month. A permitted extension is explained within the initial deadline. Requests are normally free; any lawful refusal, limitation or exceptional fee must be justified. You may complain directly to Kosovo's Information and Privacy Agency (AIP) or another competent authority and seek judicial remedies without first complaining to us. See the Data Rights page.

11. Children and changes

The service is not directed to children under 16, and entering a property or paid-service agreement requires the legal capacity applicable to that transaction. Notify us if a child has supplied data without a lawful basis so we can assess deletion and protective steps. We date policy versions and provide material-change notice where required; a new notice does not retroactively validate a different purpose or missing consent.