Privacy Policy

Information we collect

Account information: name, email, password (stored hashed), phone number, profile photo, language preference.

Profile information you choose to provide: agency affiliation, years of experience, address, biographical text.

Listing content: photos, titles, descriptions, prices, locations, and features for properties you publish.

Messages you exchange with other users, including any files you attach.

Technical data: IP address, device type, browser, and approximate location (used to default the search area to a sensible city). Standard server logs are kept for security and abuse-prevention purposes.

In the mobile app: a random identifier created when the app is installed, and, if you allow notifications, the push token your phone gives us to deliver them.

Usage data: the screens you open, the features you use, the searches you run, and errors the app runs into, recorded by our own analytics, not a third-party service. Once you are signed in, this is linked to your account.

How we use this information

To run the platform: show your listings to other users, deliver your messages, send notifications, and let agencies manage their teams.

To send transactional emails such as account confirmation, listing approval, password recovery, and new-message digests.

To moderate content — listings and agencies pass through a human review queue before they are published.

To improve the product: the usage data described above shows us which features are useful and where errors happen. We look at it in reports; it is never used for advertising, sold, or shared.

AI features

When you use the AI title/description writer, image enhancement, or auto-translation, the text or image you submit is sent to Google's Gemini API for processing.

Google processes the request on its own infrastructure under its own terms. Do not include sensitive personal data in prompts. The output is generated automatically; you remain responsible for reviewing it before you publish.

Who we share data with

We do not sell your data.

We share what is necessary with the providers that make Shpia work: Supabase (authentication, database, file storage, real-time messaging), Google (Gemini AI features), Mapbox (maps), Expo, Google Firebase Cloud Messaging and Apple Push Notification service (delivering notifications to your phone), our hosting providers (Railway / AWS for the platform, Vercel for the website), and our email-delivery service.

Other users see what you make public: your name, profile photo, agency affiliation, and the listings you publish. Agencies see your contact details when you submit an inquiry.

We disclose data to public authorities only when we are legally required to (court order, criminal investigation) and only the minimum that the request covers.

Public storage of images and attachments

Property photos, avatars, agency logos, and message attachments are stored in a public Supabase storage bucket and served directly from its CDN. This means anyone who has the URL of a file can open it.

This is the trade-off we made to keep image loading fast for buyers. Do not upload identity documents, contracts, or other sensitive files in chat attachments. The upload screen reminds you of this; this paragraph is the formal record of the choice.

Details agencies record about property owners

When an agency lists a property on behalf of its owner, the agent can record that owner's name, email address, phone number and a short note, so the agency knows who to contact about the listing.

These details are visible only to active members of that agency and to Shpia administrators. They are never shown to buyers, never included in the public listing, and never sent to a visitor's browser.

If you are a property owner whose details an agency has recorded and you want them corrected or removed, contact the agency directly, or write to us at support@shpia.org and we will remove them.

How long we keep data

Account data is kept while your account is open. After you close it we delete or anonymise it immediately, except where Albanian law requires us to keep records longer.

Individual listings are kept on the platform for 90 days from the date they are published; renewing a listing resets the clock. Inactive and deleted listings are removed from search but the underlying record is retained for six months for fraud-prevention purposes.

Messages remain for the lifetime of the conversation. Either participant can delete their own messages at any time.

Your rights

Under Albanian Law No. 9887 on the Protection of Personal Data, and consistent with the EU GDPR, you have the right to access the data we hold about you, correct it, request deletion, request a portable copy, and object to certain processing.

To exercise any of these rights, write to support@shpia.org. We answer within 30 days.

To close your account, go to My Account and press "Close my account", or email us. The section below describes exactly what happens.

If you believe we have mishandled your data, you can complain to the Office of the Information and Data Protection Commissioner of Albania (idp.al).

Closing your account

You can close your account yourself, from My Account in the app or on the website. You do not need the mobile app to do it, and you do not need to contact us first.

Closing takes effect immediately. Your sign-in is removed and you cannot sign in again.

Deleted: your name, contact details, photograph, biography and professional details; your favourites, saved searches, browsing history and notifications; and any listing of yours that belongs to no agency, together with its photographs.

Anonymised: messages you sent, viewings you arranged or showed, reviews you wrote, and client records you created. These belong to the conversation, the agency or the other person as much as to you, so the record stays and your name comes off it.

If you belong to an agency, anything the business depends on is handed over before your account closes. You are asked who should take over the agency if you are its only owner, and who should take over your listings and clients. Nothing of the agency's is deleted along with your account.

Reports and blocking

You can report a listing or another user, and you can block someone so that neither of you can message the other.

A report goes to the Shpia moderation team. It records who filed it, what it is about, the reason and any note you add. The person reported is not told who reported them.

When someone is reported from a conversation, a moderator can read that conversation — its last 50 messages — to decide the report. This is the only situation in which anyone other than the people in a conversation reads it.

As a result of a report, a moderator may take a listing down or suspend an account. A listing that was taken down can be corrected and resubmitted for review, and a suspended account can be restored. Reports are kept as moderation records, including after either person closes their account, with their names removed.

Cookies and tracking

We use only the cookies needed for the platform to work: a session cookie to keep you signed in and a small cookie that remembers your language choice.

We measure how Shpia is used with our own analytics, described under "Information we collect". We do not run third-party analytics, advertising trackers, or fingerprinting scripts. If we add any in the future, we will update this policy and ask for your consent where the law requires it.

Children

Shpia is intended for adults aged 18 or over. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please email support@shpia.org and we will remove it.

International transfers

Our providers (Supabase, Google, Mapbox, Vercel and the notification services) operate data centres outside Albania, including in the European Union and the United States. Where data leaves Albania we rely on the safeguards those providers offer — standard contractual clauses, regional EU hosting where available, and equivalent technical protections.

Changes to this policy

We may update this policy as the platform evolves. The date at the top of this page reflects the most recent change. For material changes we notify registered users by email at least 14 days in advance.

Contact

Questions, requests, and complaints: support@shpia.org