Privacy Policy
Privacy Policy — Hovioo
Last updated: 2026-09-13 Effective date: 2026-09-13
Hovioo ("we", "us", "our") operates the Hovioo real-estate platform (mobile app, web app, and admin tools, collectively the "Service"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. It applies to all users of the Service.
1. Information We Collect
- Account information — email address, first and last name, country, and a hashed password, collected when you create an account.
- Listing content — property descriptions, addresses, prices, photos, amenity flags, and other content you submit when publishing a listing.
- Location data — approximate, city-level location used for nearby search results. We only collect precise location with your explicit operating-system permission, for features such as "near me" search and saved searches.
- Messages — the content of messages you send to other users (for example, inquiries to property owners) and the identities of the parties to those messages.
- Device and usage data — IP address, device type, operating system version, app version, crash reports, error events, and basic interaction analytics (which screens you visit, which actions you take). We use this data to operate and improve the Service.
- Cookies and similar technologies — we use cookies only for session authentication, via an httpOnly cookie that stores your authentication token. We do not use advertising or third-party tracking cookies.
2. Why We Use Your Information
We use your information to:
- Create and authenticate your account and keep you signed in.
- Operate the Service — display listings, route messages between users, save favorites and searches, and send notifications when a saved search matches a new listing.
- Send transactional email, such as password resets, listing approval or rejection notices, message notifications, and other account notices.
- Detect and prevent abuse, fraud, spam, and security threats.
- Comply with legal obligations and lawful requests from authorities.
- Improve the Service through aggregate analytics and crash reports.
3. Who We Share Your Information With
We do not sell personal information. We share personal information only with service providers that are strictly necessary to operate the Service:
| Provider | Purpose |
|---|---|
| DigitalOcean | Cloud infrastructure (Frankfurt, Germany) — hosts our database and servers |
| Cloudflare | DNS — resolves our domain names |
| Resend | Transactional email — sends emails on our behalf (password resets, alerts) |
| Sentry | Error tracking — captures crashes and errors to help us fix bugs |
| Vercel | Admin panel hosting — hosts our administrator interface |
All of these providers are bound by data-processing agreements that require them to handle personal information only on our instructions and with reasonable security safeguards.
4. Data Retention
- Account data — retained while your account is active, and deleted within 30 days of account closure, subject to legal-hold exceptions.
- Listings — retained while published; soft-deleted on removal and purged after 90 days.
- Messages — retained for 18 months after the last interaction in a conversation.
- Server logs and crash reports — retained for 30 days.
- Database backups — retained for up to 7 days.
5. Your Rights
At any time, you can:
- Access, correct, or delete your account information from in-app Settings → Profile.
- Request a full export of your data by emailing us.
- Request immediate deletion of your account and associated data by emailing us.
- Opt out of non-essential email notifications from **Settings → Notifications**.
- Withdraw operating-system permissions (location, photos, camera) at any time through your device settings.
6. Security
We use industry-standard safeguards to protect your data, including TLS encryption in transit, encryption at rest for our database, hashed and salted passwords (bcrypt), rate limiting on authentication endpoints, role-based access controls for administrators, and audit logging for sensitive operations. No system is completely secure, and we cannot guarantee absolute security.
7. Children's Privacy
The Service is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
8. International Transfers
Your data is stored in the European Union (DigitalOcean's Frankfurt, Germany region). Where our service providers operate from other countries (for example, the United States, for Sentry and Vercel), we rely on Standard Contractual Clauses and similar safeguards approved by the European Commission.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and via an in-app banner at least 30 days before they take effect. The "Last updated" date above reflects the date of the latest version.
10. Contact
For questions about this Privacy Policy, or to exercise your rights, contact us at privacy@hovioo.com.
If you are a resident of Tunisia, you may also file a complaint with the Instance Nationale de Protection des Données Personnelles (INPDP) at https://www.inpdp.nat.tn. If you are a resident of the European Union, you may contact your local supervisory authority.