Homely privacy policy
Effective date: 1 November 2026
This policy explains what personal data Homely collects, why, how long we keep it and what rights you have. It applies to the website https://homely.mk and to the Homely apps for iPhone and Android.
We wrote it to meet the Law on Personal Data Protection of North Macedonia and the data protection laws of Albania, Kosovo and Serbia, which follow the EU GDPR, and the Swiss Federal Act on Data Protection for our members in Switzerland. Where this policy says "GDPR-style laws", it means those national laws. If you live in the EU, the GDPR may also apply to you.
1. Who we are
Homely is run by:
Homely.mk Tetovo, North Macedonia
Homely.mk is the controller of your personal data. This means we decide why and how your data is processed.
Privacy contact: [email protected]
We are based in North Macedonia and have not appointed a representative in other countries.
2. Short version
- You can browse listings without an account. We do not use advertising cookies or trackers.
- To post a listing or send a message you need an account: email, password and name. A phone number is optional until you want the verified badge.
- Listings are public. That includes the street, house number, map pin, photos, your name and your badge.
- Phone numbers and email addresses typed into messages are hidden automatically.
- We only send you suggestions and news if you said yes. You can say no at any time.
- You can download your data and delete your account on your profile page.
3. What data we collect and why
The table names the legal basis for each purpose. "Contract" means we need the data to provide the service you signed up for. "Legitimate interest" means we have a fair reason that does not outweigh your rights; you can object (see section 11). "Consent" means you said yes and can withdraw it. "Legal obligation" means a law requires it.
3.1 Your account
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (stored only as a secure hash), name, language | Create and run your account, sign you in, contact you about it | Contract |
| Phone number and a one-time code sent to it | Confirm the phone belongs to you and show the verified badge | Contract |
| Company name and registration number, if you sell as a business | Show your company and let our staff verify it against the Central Registry | Contract; legitimate interest (trust on the marketplace) |
| Active days: your account id and the date you used the site while signed in, nothing about what you did | Count active accounts for our internal dashboard | Legitimate interest (understanding how much the service is used) |
3.2 Listings
| Data | Purpose | Legal basis |
|---|---|---|
| Property details, price, description, photos | Publish your listing | Contract |
| Municipality, street, house number and map pin | Show buyers and tenants where the property is | Contract |
| Your name, company and verified badge on the listing | Let people know who they deal with | Contract; legitimate interest (trust) |
3.3 Messages
| Data | Purpose | Legal basis |
|---|---|---|
| Messages between you and other members, read marks, which listing they are about | Let buyers and sellers talk | Contract |
| The original text of a message, kept apart from the shown text | Hide phone numbers and emails to protect you from scams, and investigate abuse | Legitimate interest (safety) |
| Contact reveals: that you opened a seller's contact details | Prevent scraping and spam, and show sellers how many people asked | Legitimate interest (safety) |
3.4 Saved homes, searches and alerts
| Data | Purpose | Legal basis |
|---|---|---|
| Saved homes, hidden homes, saved searches | Remember your choices | Contract |
| Saved search alerts by email | Tell you about new listings that match a search you saved | Contract (you turn each alert on) |
3.5 Emails and notifications
You choose which emails you get in Profile, Notifications. The categories are:
- New messages: an email when someone writes to you. Several messages are grouped into one email.
- Your listings: news about your own listings, for example approval.
- Saved search alerts: new listings that match a saved search.
- Suggestions and news: a weekly selection of listings (Tuesday mornings) and occasional news about Homely. This category is off until you say yes.
- Personalise suggestions with my activity: lets us use your activity to pick the weekly suggestions.
Some emails are always sent because the service needs them: confirming your email, resetting your password, security notices and the confirmation that your account was deleted.
| Data | Purpose | Legal basis |
|---|---|---|
| Your email settings | Send only what you asked for | Contract |
| Consent record for "Suggestions and news": the date, the wording version (currently `marketing-2026-10-30`) and where you gave it | Prove you agreed | Consent; legal obligation (proof of consent) |
| Delivery log: account id, which email template, what it was about and whether it was delivered. No address and no text | Make sure emails arrive and avoid sending twice | Legitimate interest |
| Activity for suggestions: searches as filters, listings you viewed, saved, hid or contacted. No message text | Pick listings you may like for the weekly suggestions | Consent. Recorded only while both "Suggestions and news" and "Personalise" are on |
This activity use is a simple form of profiling. It only affects which listings we suggest to you by email. It never has legal or similarly significant effects on you.
3.6 Push notifications in the apps
If you turn on push notifications in the app, we store your account id, the platform (iOS or Android), the push token of your phone, the app version, and when the phone was registered and last seen. We use it to tell you about new messages. Legal basis: consent (the switch and your phone's permission).
The token is deleted when you turn the switch off, when you sign out, when Apple or Google tells us it is no longer valid, when you use more than ten phones (the oldest goes), and when you delete your account.
3.7 Reports, moderation and safety
| Data | Purpose | Legal basis |
|---|---|---|
| Reports you send about a listing, and the reason | Review scams, duplicates and misleading listings | Legitimate interest (a safe marketplace) |
| Moderation decisions, suspensions and notes by our staff | Enforce the terms of use and protect other members | Legitimate interest; contract |
| Fraud signals | Detect fake accounts and scams | Legitimate interest |
Our staff may suspend or delete an account that breaks the terms of use. A person decides; this is not an automated decision.
3.8 Promoted listings and invoices
| Data | Purpose | Legal basis |
|---|---|---|
| Orders, the payment reference, amount and the bank transfer we matched, invoice details | Sell promotions and keep the accounts | Contract; legal obligation (accounting) |
We do not receive or store card details. You pay by bank transfer through your own bank.
3.9 Technical data when you visit
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser, requested page, time (handled by Cloudflare and our servers) | Deliver the site, protect it from attacks and bots | Legitimate interest (security) |
| Authentication and access logs | Find and stop misuse | Legitimate interest (security) |
| Error reports (Sentry): the page without its query string, browser and app version, the error and the steps before it. Not your name, email, cookies, request headers or form contents | Find and fix faults | Legitimate interest |
| Session Replay on the website (Sentry): a recording of how the page changed during a visit, with text and inputs masked. Only if you agree in the banner. Never on sign-in, registration, password and email-link pages, and never in the apps | Understand and fix faults we cannot reproduce | Consent |
| Cloudflare Web Analytics: page views counted without cookies and without identifying you | Know which pages are used | Legitimate interest |
| Cloudflare Turnstile check on forms | Tell people from bots | Legitimate interest (security) |
4. Where your data comes from
Almost everything comes from you. Some comes from others: messages another member sends you, reports about your listing, the delivery result from our email provider, and push token status from Apple or Google. When we verify a company, we check its data in the public Central Registry of North Macedonia.
5. What is public
Listings are public on the internet and can be found by search engines. A listing shows:
- the property details, price, description and photos;
- the municipality, street, house number and the map pin;
- the seller's name or company and the verified badge.
Think about this before you publish. Do not put people, car plates or documents in photos. You decide what goes into the description.
Your email address is never shown. Your phone number is shown to a visitor who taps "Show phone" on your listing; we limit how often one visitor can do this, and we log the reveal. Phone numbers and email addresses typed into messages are hidden from the other side.
6. Who we share data with
We do not sell your data. We do not share it for advertising.
Other members see what you publish and what you write to them. Our own staff see what they need to support and moderate.
We use these service providers. They process data only on our instructions (processors):
| Provider | Role | Location |
|---|---|---|
| Microsoft (Azure) | Hosting of our servers and database | Virtual machine in the European Union |
| Cloudflare, Inc. | Network in front of the site (Tunnel), protection against attacks, Turnstile bot check, Web Analytics | Global network; company in the USA |
| Functional Software, Inc. (Sentry) | Error monitoring and, with consent, Session Replay on the website | Data stored in the EU (Germany); company in the USA |
| Resend (Plus Five Five, Inc.) | Sending emails from [email protected] | USA |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to iPhones | USA |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to Android phones | USA |
| OpenStreetMap Foundation (tile servers) | Map images. Your browser loads them directly, so the server sees your IP address and the map area | United Kingdom and global |
We may also share data with authorities when the law requires it, or to defend legal claims. If Homely.mk is sold or merged, the data moves with it under this policy.
7. International transfers
We are based in North Macedonia. Our members are in North Macedonia, Albania, Kosovo, Serbia, Switzerland and the EU. Some providers are in the USA or other countries.
When data goes to a country that your national authority does not consider safe enough, we use the EU Standard Contractual Clauses, or the provider's certification under the EU-US Data Privacy Framework where it has one. You can ask us for a copy of these safeguards at the privacy address.
8. Cookies and storage on your device
We use no advertising or tracking cookies. What we store:
| Name | Type | Purpose | How long |
|---|---|---|---|
| `homely.auth` | Cookie, necessary | Keeps you signed in on the website | 8 hours, renewed while you are active |
| App session | Cookie, necessary | Keeps you signed in in the app | 30 days, renewed while you use the app |
| `XSRF-TOKEN` | Cookie, necessary | Protects forms against cross-site attacks | The browser session |
| `lang` | Cookie, necessary | Remembers your language | 1 year |
| `homely-consent` | Local storage, necessary | Remembers your Session Replay choice | 1 year, then we ask again |
| `pending-action` | Local storage, necessary | Finishes an action you started before signing in (for example saving a home) | 24 hours |
| Cloudflare Turnstile | Necessary | Bot check on forms | Set by Cloudflare, short |
| Sentry Session Replay | Optional, only after "yes" | Recording for error analysis | For that visit |
You can change your Session Replay choice at any time with the link in the footer.
9. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account exists |
| Phone verification codes | 24 hours after they expire |
| Proof of a verification | While it is valid, then 24 months |
| Original message text (with contact details) | 12 months after the last activity in the conversation, then only the hidden version stays |
| Messages as shown (contact details hidden) | 24 months after the last activity in the conversation |
| Contact reveals | 24 months, then only monthly totals per listing |
| Reports and moderation decisions | 36 months after the case is closed, then without names |
| Fraud signals | 24 months after the case is closed |
| Authentication and access logs | 90 days |
| Email delivery log | 12 months |
| Activity for suggestions | 180 days. Deleted at once when you turn off "Suggestions and news" or "Personalise", or unsubscribe |
| Active days | 400 days |
| Email settings | While your account exists |
| Consent records | 3 years after you withdraw consent or delete your account |
| Push tokens | While the switch is on (see section 3.6) |
| Invoices and accounting records | 10 years, as accounting law requires |
| Error reports in Sentry | 30 days |
| Archived listings after account deletion | 30 days, then text and photos are purged |
| Backups | Deleted data can stay in backups for up to 30 days |
10. When you delete your account
On your profile page, under Your data, choose Delete my account and type your password again. If you belong to a company account, you must leave it or hand it over first.
What happens:
- Your sign-in, sessions and tokens are removed. Your name, email and phone are erased.
- Your listings leave the search at once. The exact address is removed. Title, description and photos are purged after 30 days.
- In conversations, the other person keeps their copy. Your messages remain only in the hidden form they already saw, and you appear as "Marketplace member".
- Saved homes, searches, activity, email settings, consent records and push tokens are deleted.
- Invoices stay because the law requires it, without your contact details. Reports you made stay to protect others, without your name.
- We send a short confirmation to your old email address.
You can register again later with the same email. That creates a new, empty account.
If you cannot sign in, write to the privacy address from the email address of your account. We will check that the request is yours before we delete anything, for example by replying to that address.
11. Your rights
You have the right to:
- Access: know what data we hold about you and get a copy.
- Download (portability): on your profile page, Download my data gives you one JSON file with your profile, listings, messages, saved homes and searches, activity, email settings and consents, a list of emails sent, orders and reports.
- Rectification: correct wrong data. Most of it you can edit yourself in your profile and listings.
- Erasure: have your data deleted (section 10).
- Restriction: ask us to pause the use of your data while a question is being resolved.
- Objection: object to processing based on legitimate interest. You can always object to direct marketing.
- Withdraw consent: at any time, as easily as you gave it. This does not affect what we did before.
- Complain to a data protection authority.
How to withdraw consent:
- Suggestions and news, and personalisation: switch them off in Profile, Notifications, or use the unsubscribe link in every such email. Your activity data is deleted at once.
- Push notifications: switch them off in the app or in your phone's settings.
- Session Replay: use the privacy settings link in the footer.
To use your rights, use the profile page or write to the privacy address. We answer within one month. We may ask you to confirm your identity.
Data protection authorities:
- North Macedonia (our authority): Agency for Personal Data Protection (Агенција за заштита на личните податоци), https://dzlp.mk
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch
- Albania: Information and Data Protection Commissioner (IDP), https://idp.al
- Kosovo: Information and Privacy Agency (AIP), https://aip.rks-gov.net
- Serbia: Commissioner for Information of Public Importance and Personal Data Protection, https://www.poverenik.rs
- EU: the authority in your country of residence
12. Security
We use encrypted connections (HTTPS), store passwords only as hashes, keep the servers closed to the internet behind Cloudflare Tunnel, limit staff access by role and keep secrets outside the code. No system is perfectly safe. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
13. Age limit
Homely is for adults. You must be 18 or older to create an account. We do not knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.
14. Changes to this policy
We may update this policy when the service or the law changes. We show the effective date at the top. For important changes we tell signed-in members by email or on the site before they take effect. If a change needs your consent, we ask for it again.
15. Contact
Homely.mk, Tetovo, North Macedonia [email protected]