Privacy policy

Who processes your data

The controller is Klarfels, the operator named in the Imprint. There you'll find the owner's name, the postal address and the email address for any privacy question.

We keep data to a minimum: we never send contact details to an AI system, we don't write email addresses or phone numbers into technical logs, and we store sign-in codes and alert management links only as hashes.

All visitors

The site runs through Cloudflare. Cloudflare passes requests on to our server and, in doing so, processes your IP address and technical details of the request, such as your browser, to deliver the site and protect it from attacks.

To measure and improve the site we use Umami, an analytics tool that runs on our own server. Umami uses no cookies and doesn't store your IP address: it uses it only at the moment of your visit, to work out your approximate location (country and city) and to avoid counting the same visitor twice. It records the pages you open, your device and browser type, your language, the page you came from and actions such as a click through to an original ad.

We record searches only in aggregate: which filters were used and how many times a day, with nothing about who searched. The exception is search text that AI reads (see below).

When you answer “Was this helpful?”, we store the page, the language, your answer, the tags you picked and a note if you write one, with no IP address, email or account. We delete the answers after 12 months.

Our server keeps no record of individual visits. To limit the number of requests, such as listing reports or phone number reveals, we store your IP address only as a hash and delete it after 2 days. The server's technical logs are deleted automatically once they reach a certain size, typically after a few days to a few weeks.

The legal basis is legitimate interest (Art. 6(1)(f) GDPR): delivering the site securely and correctly, and measuring and improving the service.

Cookies and browser storage

We use cookies only where they're strictly necessary:

• a session cookie while you're signed in,
• Cloudflare Turnstile, which protects forms from bots. It loads only with forms (sign-in, posting a listing, reporting a listing, revealing a phone number, email alerts, the source opt-out and a note with “Was this helpful?”) and may store data in your browser that the check needs.

We write to your browser's local storage (localStorage and IndexedDB) only when you ask for it:

• the listings you save,
• the listings you hide, and the reason if you pick one,
• that you switched off the keyboard shortcuts, if you do,
• viewings you add to your calendar (date and time, next to the saved listing),
• the ticks you put on the apartment viewing checklist, the letting plan and the "Who to tell your new address" list,
• the order of your saved listings from "Which do you prefer?",
• your own photos and voice note next to a saved listing ("Your viewing photos"), in this browser's IndexedDB only; we never send them anywhere,
• a short introduction for your first message to an owner (who's moving in, work, pets, smoking, move-in date and length of stay), once you save it; it goes only into the message you send yourself, never to us,
• your votes on saved listings and the votes someone sends you, with the name they typed (votes travel in the link itself, after the #, so they never reach us),
• how your search is going next to saved listings (status, tags and a short note),
• the destination you pick for your daily trip, so we can offer it again,
• the current flat you enter to compare with (rent, bills, size and area),
• the questions you sent with "Ask the owner", for a week,
• that you closed the explanation of the marks on a listing card,
• your theme choice (light or dark),
• a "Not now" choice on an alerts prompt, for 30 days,
• once you have saved at least one listing, the time of your last visit, so we can show how many listings are new since then (for the current visit that time is also kept in sessionStorage),
• once you have saved at least one listing, also your last search with its filters, so the home page can offer it again (one tap forgets it),
• the listings you chose to "Watch the price" of,
• a "Not now" choice on the offer to add the site to your home screen,
• a draft of your listing while you fill it in (the details in localStorage, the prepared photos in IndexedDB), so you can continue where you left off. It is deleted once you publish or choose “Start over”.

When you share your list of saved listings, the list is written into the link itself.

When you visit, your browser also registers our service worker, a small program that lets you add the site to your home screen, shows push notifications and opens your saved flats without a connection. For that it keeps the site's program files and your last saved-flats page on your device. That copy stays on the device and is never sent anywhere. The service worker doesn't track you and doesn't change the requests your browser sends.

The language is set by the web address alone, without a cookie. That's why we don't need a cookie banner (Art. 43(4) of the Croatian Electronic Communications Act; § 25(2) of the German TDDDG; Art. 5(3) of the ePrivacy Directive). If we add advertising later, ad cookies will load only after your consent, and we'll update this policy before that.

Signing in and advertisers

To post a listing, you sign in with a Google account or with a code we email you. Your account is created the first time you sign in. We process:

• account data: your email address and, if you sign in with Google, your name, the address of your profile picture and the sign-in data Google sends us,
• sign-in data: a sign-in code is valid for 5 minutes and we store it only as a hash. With each sign-in (session) we store the IP address and browser you signed in from, for security. A session lasts 7 days from when you last used it, and we delete it when you sign out or when it expires,
• the listing: details of the flat, the neighbourhood and, if you enter it, the street, the description, photos, and the contact name and phone number, with whether you use WhatsApp or Viber. The map shows only an approximate area, never the flat's exact location,
• photos: before upload your browser resizes them and removes hidden data such as the location and phone model. We store them in Cloudflare R2,
• listing statistics: the number of views (also by kind of source, such as a search engine, an alert or WhatsApp), phone reveals and contact taps, only as daily totals, with nothing about the visitors and not the address of the page they came from,
• if you claim an agency profile: a record of the claim (which email address claimed which agency, and when) and the logo and description you add,
• emails about your listing: confirmation that it's live or being checked, statistics after 3 days and then once a week while it's live (you can turn the weekly email off with one click), a reminder before it expires, confirmation when you mark it rented, and a statement of reasons if we reject or remove it.

The legal basis is performing our contract with you (Art. 6(1)(b) GDPR), that is, providing the service you asked for, and legitimate interest (Art. 6(1)(f) GDPR) in security and preventing abuse.

How long:

• A listing runs for 30 days and you can renew it. When it expires or you mark it rented, its page stays up for another 14 days and then goes. You still see the listing, with its contact details, in “My listings” until you delete it.
• When you delete a listing, we immediately delete its photos, description and contact details. We keep the other facts (rent, size, rooms and location) with your account for price statistics. We delete the whole listing 12 months after it ended (expired, rented or deleted).
• We keep your account and the data linked to it until you delete it. In “My listings”, “Delete account” deletes your account, all your listings with their photos and the email alerts sent to your address in one go. We confirm by email.
• We delete an agency's logo and description when you give the profile back or delete your account. We keep the record of the claim for 12 more months, as proof of who could edit the profile and why, and then delete it.

We are the controller for personal data in direct listings. That's why we protect it from misuse and scraping:

• contact details go only in dedicated fields, never in the description,
• the phone number is revealed only on click, with a limit on reveals and Turnstile protection,
• contact details are never in the page code, sitemaps or structured data,
• we screen listings for scams and abuse and take them down quickly when needed.

Processing with artificial intelligence (AI)

We use AI models through the OpenRouter service for five tasks:

• when you paste the text of an existing ad, or a link to it, AI suggests details for the form from that text. Before sending, we remove phone numbers, email addresses and links from the text; if you pasted a link, we also send that page's address,
• AI screens every new listing, and every change to its rent, description or photos, for scams and breaches of the Listing rules. It receives the flat's details, the description and up to three downsized photos, never the contact fields,
• when we can't reliably read the rent, size or rooms from an agency's page, AI extracts them from that page's text, also without contact details, along with the page's address,
• when you type something into search that our rules don't understand, AI reads filters from it (area, price, rooms). We keep the search text and the result, with nothing about who searched, so the same search isn't sent again, and delete them 12 months after they were last used,
• AI translates a published listing's description into the site's other language (Croatian or English). We store the translation with the listing and show it only on request, labelled as a machine translation; the original description stays as it is.

We don't store the other requests sent to the AI model; we record only their number and cost. OpenRouter doesn't log the content of our requests or use it to train models, and routes them only to providers that don't retain them after processing or train on them. Today that is a model from OpenAI, run for us by Microsoft Azure on servers in the EU. If we change the model or the provider running it, OpenAI, Amazon Web Services, Anthropic or Google may process the requests, including on servers outside the EU.

Automated screening never rejects a listing on its own: a listing it flags waits for a person to review it. If we don't review it within 7 days, it is rejected because the time ran out, and we email you the reasons. You can then edit and resubmit it, or contest the decision.

The legal basis for suggesting details is performing our contract with you (Art. 6(1)(b) GDPR); for screening listings, reading agency pages and reading searches it is legitimate interest (Art. 6(1)(f) GDPR): keeping users safe, the data accurate, and a search that understands what you type.

Alerts about new listings

• Email alerts: your email address, the saved filters, the language and the list of listings we've already told you about (so we never send the same one twice). The basis is consent (Art. 6(1)(a) GDPR), which you confirm by clicking the link in our email. We delete unconfirmed sign-ups after 7 days. We don't track whether you open our emails or click their links.
• Push alerts: the push address and keys your browser creates (pseudonymous data), the saved filters and the list of listings already sent. The basis is consent, given through the browser permission, which we ask for only after you click. A notification contains only a title, a short description of the search and a link to our site.
• Watching one flat (“Prati cijenu”): the push address and keys of your device and which listing you watch, to send one notification when its rent drops or it ends. We delete it when you stop watching, after that last notification, after 60 days, or when the push service says the address no longer works.
• “Found a flat?”: if you answer whether you found it through us, we store only the answer, the kind of alert (email or push) and the date, without your email address or push data. Once you switch the alerts off, the answer can no longer be linked to you or to the search. Answering is optional and only used for counting. Pausing alerts (3 days, a week or two) stores only the date until which we send nothing. The same goes for snoozing alerts until your next move: we store only the day they wake up, not when your lease ends. Until then a snoozed alert keeps your email address or push data, which we delete when you switch it off.
• We delete all of it as soon as you unsubscribe. We also delete push data when the push service tells us the address no longer works, and after five failed sends in a row once a week has passed without a single delivered notification.

You can withdraw consent at any time: with the unsubscribe link in the email, with the alert management link or in your browser settings. Withdrawing consent doesn't affect the lawfulness of processing before that.

Agencies whose listings we index

We don't get agency data from the agencies themselves but from their public websites. That's why we publish the Art. 14 GDPR information here and on the Bot and source opt-out page.

• What: the agency's name (a sole trader's business name is personal data), the listing facts, and the URLs of the listing and its photos. We never store agents' names, phone numbers or email addresses.
• Why: to index public listings and send tenants to the original ad. The basis is legitimate interest (Art. 6(1)(f) GDPR).
• Recipients: the processors listed below, and OpenRouter and the AI model provider only when AI processes a page's text.
• How long: we show a listing while it is live at the source. After that, we keep its facts for price statistics and price history, and delete them 12 months after we last saw the listing.

You can object to indexing by opting your site out. We keep opt-out requests (email address and domain) indefinitely, so we can keep honouring them. We don't notify agencies one by one because that would take disproportionate effort (Art. 14(5)(b) GDPR).

Listing reports

When you report a listing, we store the reason, the report text and, if you give it, your email address, to which we send only a receipt and our decision on that report. We also note the language, so those emails arrive in it. The basis is legitimate interest and our obligations under the Digital Services Act (DSA). We delete handled reports 12 months after they were made, and keep open ones until they're handled.

Outside content and sharing

• Photos of indexed listings load directly from the agency's server. Your browser therefore sends that server your IP address and our domain as the referrer. We can't avoid this without copying the photo, and we don't copy photos.
• A map loads only when you open it. Your browser then fetches the map tiles from OpenFreeMap's servers and sends them your IP address.
• Voice search: when you tap the microphone in the search box, your browser recognises the speech, and the browser maker's service processes the audio (Google in Chrome and Edge, Apple in Safari) under its own terms. We never receive the audio, only the recognised text, as if you had typed it.
• The Facebook share button is a plain link: Meta receives nothing until you click it. “Copy for WhatsApp” and “Copy link” only copy text on your device.
• Contact with an advertiser (a call, SMS, WhatsApp or Viber) happens in the app you choose. We don't see the conversation.

Processors and transfers outside the EU

These service providers process data on our behalf:

• netcup GmbH, Germany: hosting the site and the database,
• Cloudflare: DNS, CDN and proxy, the tunnel to our server, storage of photos and encrypted backups (R2), Turnstile, and forwarding email sent to our address,
• Mailjet, France: sending email,
• OpenRouter and the AI model provider it passes requests to (today Microsoft Azure in the EU, running a model from OpenAI; OpenAI, Amazon Web Services, Anthropic or Google may stand in): the AI processing described above,
• Google: signing in with a Google account, and Gmail, where email sent to info@najamstanova.com arrives.

Push notifications are delivered by the browser vendors' push services: Google (Chrome, Edge, Opera, Samsung Internet), Mozilla (Firefox), Apple (Safari) and Microsoft (older Edge). The message travels to your device encrypted, so the push service can't read it.

Cloudflare, OpenRouter, OpenAI, Amazon, Anthropic, Google, Apple, Mozilla and Microsoft are based in the US, so data may be processed outside the EU. Such transfers rely on the European Commission's adequacy decision (the EU–US Data Privacy Framework, for certified providers) or on the Commission's standard contractual clauses. OpenRouter relies on the standard contractual clauses. The AI model itself runs on Microsoft Azure servers in the EU today.

Analytics and the database run on our own server, so no outside processor is involved there.

We back up the database every night and store the backups encrypted in Cloudflare R2. Daily backups are deleted after 14 days and monthly ones after 12 months. Deleted data disappears from the backups by then at the latest.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing and to data portability, and the right to object to processing based on legitimate interest. You can withdraw consent at any time.

You edit and delete your listings yourself in “My listings”, where you can also delete your whole account. For anything else, email us at the address in the Imprint. We verify your identity by email. We acknowledge your request within 24 hours and complete it within 30 days.

You're not legally required to give us any data. Without an email address, though, you can't post a listing or get email alerts.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (lfd.niedersachsen.de). You can also contact the authority in the country where you live; in Croatia, that's the Personal Data Protection Agency (AZOP, azop.hr).

When we change how we process data, we update this policy and the date at the top of the page.