Privacy Policy

This notice describes how BixBuz processes personal data when you use our multi-domain property marketplace (including account, listings, messaging, billing, and support).

Account and authentication data: email address, authentication identifiers, optional profile fields (for example name, username, avatar), account type and role flags.

Listing and marketplace data: listing content you submit, images, location/geocoding inputs, favorites, and messages exchanged through the platform.

Billing and subscription data: billing profile fields, Stripe customer/subscription/checkout identifiers, invoice-related snapshots, and payment status metadata.

Technical and security data: IP-derived rate-limit keys, server logs as operated by hosting providers, and essential local storage/cookies needed for sign-in and preferences.

Analytics and measurement data (only after consent): privacy-oriented analytics via Plausible, Google Analytics (GA4) measurement, and A/B experiment variant cookies.

Provide and secure the service: authentication (including Google OAuth via Supabase Auth), account management, listing publication, messaging, and customer support.

Operate marketplace features: store listings and images, translate listing/message text with an LLM translation service, convert currencies via ExchangeRate API, and geocode addresses via OpenStreetMap Nominatim.

Process payments and accounting artefacts via Stripe and, when invoice issuance is enabled, the Hungarian Számlázz.hu adapter integrated in billing code.

Moderate and secure the platform (including admin review of listings and soft-deletion/ban controls).

Measure product usage only with analytics/measurement consent.

Contract performance (GDPR Art. 6(1)(b)): account creation, listings, messaging, subscriptions and paid features you request.

Legal obligation (Art. 6(1)(c)): retention of billing/accounting records for the statutory period.

Consent (Art. 6(1)(a)): non-essential analytics/measurement (Plausible, GA4, A/B cookies). You can withdraw consent at any time via Cookie settings.

Legitimate interests (Art. 6(1)(f)): security, fraud/abuse prevention, rate limiting, and service improvement that does not require non-essential tracking cookies.

Hosting: Vercel (application hosting/edge delivery).

Database, auth and storage: Supabase (PostgreSQL, Auth, Storage buckets listing-images and profile-avatars). Project documentation records EU region eu-west-1.

Payments: Stripe.

Transactional email: Resend.

Identity provider: Google OAuth (used through Supabase Auth).

Analytics (consent-gated): Plausible; Google Analytics (GA4).

Other integrations used by the app: ExchangeRate API (FX), OpenStreetMap Nominatim (geocoding), an LLM translation service.

Invoicing adapter: Számlázz.hu (when invoice jobs are executed outside dry-run).

Some processors may process data outside Hungary/EEA under their own terms and transfer mechanisms. Provider street addresses are not invented here.

Account deletion in the product is implemented as soft delete: the profile is marked with soft_deleted_at, profile fields are cleared/anonymized, and the auth email is replaced with an anonymized address. Access is blocked while soft-deleted.

Listing images and related marketplace records may remain as needed for integrity, moderation, dispute handling, or legal claims.

Security and moderation records may be retained as long as necessary for investigation and platform safety.

Billing and accounting records are retained for the applicable statutory period.

Analytics identifiers follow the respective provider settings and your consent state; rejecting analytics stops loading those scripts and clears A/B measurement cookies set by BixBuz.

You may request access, rectification, erasure, restriction, portability, and objection where applicable under GDPR, and you may withdraw consent for analytics at any time.

Use in-product Settings to delete your account (soft delete), or email support@bixbuz.eu for privacy requests.

You may lodge a complaint with a supervisory authority. For the controller established in Hungary, the primary authority is the National Authority for Data Protection and Freedom of Information (NAIH), Hungary. Contact details are published by NAIH; we do not invent alternate addresses here.