Privacy notice

Who we are

Realio.ge is operated by Cod3Labs LLC, a limited liability company registered in New Mexico, USA. Registered office: 1209 Mountain Road PL NE STE N, Albuquerque, NM 87110, United States. Cod3Labs LLC is the controller of the personal data described in this notice.

Privacy contact for every request or question: legal@realio.ge.

We do not sell personal data and we use no advertising trackers. Our hosting provider, Cloudflare, may collect aggregate page-view statistics without cookies to keep the site fast and secure.

What we collect, why, and on what legal basis

Where the GDPR or the UK GDPR applies, the legal bases are listed in brackets.

• Account: email address, name, phone number, language and, if you add one, an agency name. Passwords are handled by our sign-in service and are never visible to us. We use this to create and secure your account and to contact you about it and your listings. [Contract.]
• Listings you submit: property details, location text, photos and your confirmation that you may publish the photos. We use them to show and moderate the listing. Photo metadata such as GPS position is removed when photos are re-encoded in your browser before upload. [Contract; our legitimate interest in an accurate and safe marketplace.]
• Enquiries and viewing requests: your name, contact details, message and the listing. We use them to deliver your request to the advertiser, or to us for general enquiries and sample listings. [Contract; legitimate interests of you, the advertiser and us in handling the request.]
• Saved homes, saved searches and notification settings. [Contract.]
• Orders and billing: name, company, tax ID (optional), country, billing email, the product, amount, dates and status. We use them to take payment, issue invoices and keep accounting records. [Contract; legal obligation.]
• Account credit: amounts, dates, related orders and, for a credit granted by an administrator, the reason. [Contract; legal obligation.]
• Emails: receipts, listing and plan notices, refund notices and the alerts you switch on, with their delivery status. [Contract and our legitimate interest for service messages; consent for optional alerts, which you can withdraw in your account settings.]
• Technical data: IP address, browser type and pages requested, used for security, abuse prevention (rate limits, bot checks) and reliability. [Legitimate interests.]
• Administration records: an audit log of important actions on accounts, listings and orders, including those by administrators. [Legitimate interests; legal obligation.]

What is public and who can see what

A published listing shows its details and photos to everyone. Your phone number and email are not shown on a listing.

An agency profile is public only while an agency plan is active. It shows the agency name, description, languages, areas, website and logo. A phone number or email appears only if you switch it on for that profile.

An advertiser receives the name, contact details and message you type into an enquiry or viewing request about their listing. Other visitors never see them.

Administrators can see account, listing, enquiry and order data to operate and moderate the service. Administrators can export account, order and enquiry data as CSV files; phone numbers and message texts are included only after an extra confirmation, and each export is recorded in the audit log.

If an administrator removes a listing, the reason is stored with the listing and in the audit log, and the owner can read it. Reasons for refunds are internal, kept with the order records, and are not shown to the buyer. The reason for a credit granted by an administrator is shown to the account holder.

Drafts and unsent changes

Changes to a published listing (text and photos) that you have not sent, or that await review, are stored with your account until they are sent and decided, discarded or the listing closes. Deleting your account removes them.

Payments and billing details

Card payments are made on a payment page hosted by Odoo and processed by Stripe. Card details are entered there and never reach Realio. We receive the payment status and the order details needed for your invoice. Prices are in Georgian lari (GEL) and no VAT is added.

If you save billing details in your account (name, company, tax ID, country, billing email), they are kept until you remove them or the account is deleted. Each order keeps its own copy for the invoice. We never write your tax ID to logs or emails.

Who receives personal data

We use these service providers (processors) and they act on our instructions:

• Supabase: database, sign-in and file storage.
• Cloudflare: hosting, security and Turnstile bot checks. It receives connection data including your IP address.
• Odoo and Stripe: invoicing, payment page and card payment. Stripe also acts as an independent controller for its own legal duties such as fraud prevention.
• Resend: sending the emails described above.
• Mapbox: map tiles on the search map. It receives connection data and map requests from your browser.

Advertisers receive the enquiries addressed to them, as described above. We may disclose data to authorities where the law requires it. If the business is sold, data may pass to the buyer under this notice.

International transfers

Cod3Labs LLC and our processors are in the United States and may process data in other countries. If you are in the EEA, the UK or another region with transfer rules, your data is therefore transferred outside your region. We rely on the safeguards allowed by law, such as the European Commission's standard contractual clauses and the UK addendum in our processors' data processing terms, or an adequacy decision where one applies. You can ask us at legal@realio.ge for information about these safeguards.

How long we keep data

• Account, listings, saved items and drafts: until you delete the account or the item.
• Enquiries and viewing requests: deleted automatically 12 months after they were sent, or sooner when the account is deleted.
• Orders, invoices and the credit ledger: as long as accounting and tax law requires. After an account is deleted they are kept without a link to the account, but may still contain the billing details shown on the invoice.
• Queued and sent emails (address and content): 30 days. Delivery counts without addresses or content are kept slightly longer.
• Audit log: as long as needed for security and accountability.
• Technical logs: for the short periods set by our hosting and database providers.
• Browser storage: personal details kept in your browser expire after 30 days (see the Cookies page).
• Photos you uploaded are removed from storage automatically some days after they are no longer used by a listing, profile or draft.

When you delete your account, your listings, saved homes, saved searches and sent enquiries are removed, an administrator then deletes your sign-in, and any remaining account credit is forfeited. Records we must keep by law remain as described above.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time (this does not affect earlier use). Objection applies in particular to processing based on our legitimate interests.

You can correct your profile, billing details, notification settings and listings in your account, and delete your account there. For anything else, write to legal@realio.ge. We answer within one month, or tell you why more time is needed, as the law allows. We may need to verify your identity first.

Complaints

You may complain to a data protection supervisory authority: in the EU/EEA, the authority of the country where you live, work or where you believe a violation happened; in the United Kingdom, the Information Commissioner's Office; in Georgia, the Personal Data Protection Service of Georgia. We would appreciate the chance to answer your concern first.

Automated decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you. Automated bot checks and rate limits protect the service from abuse.

Is providing data required

Providing the data needed for an account, a listing or a purchase is necessary to use those features. Without it we cannot provide them. Everything else is optional.

Security

Access is limited by roles and database access rules, traffic is encrypted, and card details never reach our systems. No system is perfectly secure; tell us at legal@realio.ge if you suspect a problem.

Children

Realio.ge is not intended for people under 18, and we do not knowingly collect their data.

Changes

We update this notice when our processing changes and show the date above. We will make material changes visible on this page.