Privacy policy

Data controller

The controller of personal data is Mastris d.o.o., Ulica Ivana Rangera 58, 42000 Varaždin, OIB 42189191205. For questions about your personal data, write to info@komshy.com.

What data we process

When you sign in with Google or Facebook, we receive only your e-mail address. We do not store your real name: other users only see your nickname. We also process the location you choose, your phone number if you want to give it, the company name and OIB for a business account, and your listings, requests and messages. If you write to support (Help), we keep those messages and our answers.

Location

Your exact location is never shown to other users. The map and the listing show only an approximate point, moved 150 to 450 metres from the real one, and the listing and profile name only the district or town, never the street or house number. All metadata, including GPS, is removed from photos.

On your first visit, before you choose a place, we show the tools near the city your IP address belongs to ("approx."). We look it up in a database on our own server, use only the city's centre, and never store or log your IP address or that city. Choosing a place replaces the guess.

This product includes GeoLite Data created by MaxMind

Processors

Google and Meta (sign-in), Mailjet (sending e-mail), Anthropic (automatic AI check of listings), Hetzner (server and storage of listing photos), OpenFreeMap (the map background) and Photon (address search). Address searches go through our server, so Photon does not receive your IP address or cookies. We have data processing agreements with our processors (Art. 28 GDPR). Anthropic, Google and Meta may process data in the USA; the transfer rests on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

Moderation

AI checks listings, and users and others can report content. The AI can only hide a listing until it is reviewed; hiding, removing or blocking is decided by a person, and every decision is logged. We send you the reasons for a decision, and you can ask for a person to review it again (Art. 22 GDPR).

Your rights

In your profile settings you can download your data (a JSON file) and delete your account. Deleting it removes your personal data and listings, and closes open requests. Messages you sent stay visible to the people you wrote to under the nickname “obrisani-korisnik-…” (deleted user). For your other rights under the GDPR (access, rectification, restriction, objection), write to us by e-mail. You can complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr).

Cookies

We use only necessary cookies: the sign-in cookie and the cookies that protect against forged requests (XSRF-TOKEN and its companion cookie). When you sign in with Google or Facebook, a temporary technical cookie is also used briefly. We also remember the page language (komshy_lang) and the search place you choose (komshy_place). We do not use cookies for advertising or tracking. We count visits with Umami on our own server, without cookies: we store neither your IP address nor anything that would recognise you, the data is only aggregate (visits, pages, device type, country) and we share it with no one.

How long we keep data

Your profile, listings, requests and messages are kept while you have an account, and deleting the account removes them as described above. We delete e-mail notifications 30 days after they are sent (or after sending is no longer needed), and the technical records of background jobs after 7 days (30 days for a job that kept failing, so that we can investigate it). The conversation with support is kept while you have an account and is deleted with it.

Content reports

When you report content without an account, we process your name, e-mail address, the page language and the report to handle it and tell you the decision (a legal obligation under the Digital Services Act). The person you report does not learn who reported them. We delete the name and address 180 days after the decision, and the e-mails we sent you 30 days after sending.

Legal bases

We process your account, listings, requests and messages to perform our contract with you (the terms of use). We process content reports, statements of reasons and complaints to meet legal obligations. Protection against abuse and the security of the service rest on our legitimate interest.