Privacy Policy

Information we collect

Account information: name, email, password (stored hashed), phone number, profile photo, language preference.

Profile information you choose to provide: agency affiliation, years of experience, address, biographical text.

Listing content: photos, titles, descriptions, prices, locations, and features for properties you publish.

Messages you exchange with other users, including any files you attach.

Payment information: card payments are handled directly by Stripe. We receive only the billing status, the last four digits of your card, and the country of the issuing bank — we never see the full card number.

Technical data: IP address, device type, browser, and approximate location (used to default the search area to a sensible city). Standard server logs are kept for security and abuse-prevention purposes.

How we use this information

To run the platform: show your listings to other users, deliver your messages, send notifications, and let agencies manage their teams.

To bill subscriptions, listing fees, and promotion upgrades through Stripe.

To send transactional emails such as account confirmation, listing approval, password recovery, and new-message digests.

To moderate content — listings and agencies pass through a human review queue before they are published.

To improve the product. Aggregated, non-identifying usage information helps us understand which features are useful.

AI features

When you use the AI title/description writer, image enhancement, or auto-translation, the text or image you submit is sent to Google's Gemini API for processing.

Google processes the request on its own infrastructure under its own terms. Do not include sensitive personal data in prompts. The output is generated automatically; you remain responsible for reviewing it before you publish.

Who we share data with

We do not sell your data.

We share what is necessary with the providers that make Shpia work: Supabase (authentication, database, file storage, real-time messaging), Stripe (billing), Google (Gemini AI features), our hosting provider (Railway / AWS), and our email-delivery service.

Other users see what you make public: your name, profile photo, agency affiliation, and the listings you publish. Agencies see your contact details when you submit an inquiry.

We disclose data to public authorities only when we are legally required to (court order, criminal investigation) and only the minimum that the request covers.

Public storage of images and attachments

Property photos, avatars, agency logos, and message attachments are stored in a public Supabase storage bucket and served directly from its CDN. This means anyone who has the URL of a file can open it.

This is the trade-off we made to keep image loading fast for buyers. Do not upload identity documents, contracts, or other sensitive files in chat attachments. The upload screen reminds you of this; this paragraph is the formal record of the choice.

Details agencies record about property owners

When an agency lists a property on behalf of its owner, the agent can record that owner's name, email address, phone number and a short note, so the agency knows who to contact about the listing.

These details are visible only to active members of that agency and to Shpia administrators. They are never shown to buyers, never included in the public listing, and never sent to a visitor's browser.

If you are a property owner whose details an agency has recorded and you want them corrected or removed, contact the agency directly, or write to us at support@shpia.org and we will remove them.

How long we keep data

Account data is kept while your account is open. After you close it we delete or anonymise it within 90 days, except where Albanian law requires us to keep records longer — for example, invoicing and tax records are kept for ten years.

Individual listings are kept on the platform for 90 days from the date they are published; renewing a listing resets the clock. Inactive and deleted listings are removed from search but the underlying record is retained for six months for fraud-prevention purposes.

Messages remain for the lifetime of the conversation. Either participant can delete their own messages at any time.

Your rights

Under Albanian Law No. 9887 on the Protection of Personal Data, and consistent with the EU GDPR, you have the right to access the data we hold about you, correct it, request deletion, request a portable copy, and object to certain processing.

To exercise any of these rights, write to support@shpia.org. We answer within 30 days.

To delete your account, go to Account → Settings → Delete account, or email us.

If you believe we have mishandled your data, you can complain to the Office of the Information and Data Protection Commissioner of Albania (idp.al).

Cookies and tracking

We use only the cookies needed for the platform to work: a session cookie to keep you signed in and a small cookie that remembers your language choice.

We do not currently run third-party analytics, advertising trackers, or fingerprinting scripts. If we add any in the future, we will update this policy and ask for your consent where the law requires it.

Children

Shpia is intended for adults aged 18 or over. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please email support@shpia.org and we will remove it.

International transfers

Our providers (Supabase, Stripe, Google) operate data centres outside Albania, including in the European Union and the United States. Where data leaves Albania we rely on the safeguards those providers offer — standard contractual clauses, regional EU hosting where available, and equivalent technical protections.

Changes to this policy

We may update this policy as the platform evolves. The date at the top of this page reflects the most recent change. For material changes we notify registered users by email at least 14 days in advance.

Contact

Questions, requests, and complaints: support@shpia.org