Privacy Policy

This notice describes how BixBuz processes personal data when you use our multi-domain property marketplace (including account, listings, messaging, billing, and support).

Account and authentication data: email address, authentication identifiers, optional profile fields (for example name, username, avatar), account type and role flags.

Listing and marketplace data: listing content you submit, images, location/geocoding inputs, favorites, and messages exchanged through the platform.

Billing and subscription data: billing profile fields, Stripe customer/subscription/checkout identifiers, invoice-related snapshots, and payment status metadata.

Technical and security data: IP-derived rate-limit keys, server logs as operated by hosting providers, and essential local storage/cookies needed for sign-in and preferences.

Analytics and measurement data (only after consent): privacy-oriented analytics via Plausible, Google Analytics (GA4) measurement, and A/B experiment variant cookies.

Technical submission and checkout diagnostics: at the steps of listing submission and payment we record a technical log (attempt identifier, step, outcome code, timestamps, domain and language) for the operation and security of the service; it contains no card data, password, email address or free text.

Provide and secure the service: authentication (including Google OAuth via Supabase Auth), account management, listing publication, messaging, and customer support.

Operate marketplace features: store listings and images, translate listing/message text with an LLM translation service, convert currencies via ExchangeRate API, and geocode addresses via OpenStreetMap Nominatim.

Process payments and accounting artefacts via Stripe and, when invoice issuance is enabled, the Hungarian Számlázz.hu adapter integrated in billing code.

Moderate and secure the platform (including admin review of listings and soft-deletion/ban controls).

Measure product usage only with analytics/measurement consent.

Contract performance (GDPR Art. 6(1)(b)): account creation, listings, messaging, subscriptions and paid features you request.

Legal obligation (Art. 6(1)(c)): retention of billing/accounting records for the statutory period.

Consent (Art. 6(1)(a)): non-essential analytics/measurement (Plausible, GA4, A/B cookies). You can withdraw consent at any time via Cookie settings.

Legitimate interests (Art. 6(1)(f)): security, fraud/abuse prevention, rate limiting, and service improvement that does not require non-essential tracking cookies.

Hosting: Vercel (application hosting/edge delivery).

Database, auth and storage: Supabase (PostgreSQL, Auth, Storage buckets listing-images and profile-avatars). Project documentation records EU region eu-west-1.

Payments: Stripe.

Transactional email: Resend.

Identity provider: Google OAuth (used through Supabase Auth).

Analytics (consent-gated): Plausible; Google Analytics (GA4).

Other integrations used by the app: ExchangeRate API (FX), OpenStreetMap Nominatim (geocoding), an LLM translation service.

Invoicing adapter: Számlázz.hu (when invoice jobs are executed outside dry-run).

Some processors may process data outside Hungary/EEA under their own terms and transfer mechanisms. Provider street addresses are not invented here.

The list below itemises the processors and completes the summary above (provider - purpose - data categories - role - storage location):

Supabase Inc. - database (PostgreSQL), authentication (Auth) and file storage (Storage buckets listing-images and profile-avatars) - account and authentication data, listing content, messages, favorites, saved searches, billing profile - processor - EU region: eu-west-1.

Vercel Inc. - application and edge hosting, serverless functions, scheduled jobs - request metadata and IP address in server logs - processor - Vercel region: dub1 (Europe).

Stripe (Stripe Inc. / Stripe Payments Europe) - payments, checkout, subscriptions, webhooks and customer portal - email address, Stripe customer/subscription/checkout identifiers, payment amount and currency; card data is handled only by Stripe - processor - on Stripe's own infrastructure.

Resend, Inc. - transactional email (registration, listing expiry, credits, confirmations) - email address and message content - processor - on Resend's own infrastructure.

Google Ireland Ltd. - Google sign-in (OAuth) as a Supabase Auth provider - email address, Google profile identifier, name and avatar - processor - on Google's own infrastructure.

Hostinger - mailbox hosting for support@bixbuz.eu and name servers - content and recipients of support correspondence - processor - on Hostinger's own infrastructure.

Chatwoot (self-hosted live chat at chat.bixbuz.co.uk) - live chat and customer support - the signed-in user's identifier, name and email address plus a HMAC hash derived from them; an anonymous identifier for guests - BixBuz's own, self-operated system - on infrastructure operated by BixBuz; the widget loads only after analytics consent.

Szamlazz.hu (KBOSS.hu Kft.) - invoice issuance - billing profile (name, address, tax number) and purchase data - processor - on Szamlazz.hu's own infrastructure.

European Commission - VIES VAT-number validation - the buyer's VAT number and the VIES response (validity, name, address), stored in the billing profile - processor - in the Commission's system.

OpenStreetMap - Nominatim geocoding and tile server - the address/locality text you provide in a listing and, when the map loads, the visitor's IP address - processor - on OpenStreetMap Foundation infrastructure.

ExchangeRate-API - exchange-rate lookup - currency pairs (not personal data) - processor - on the provider's own infrastructure.

LLM translation service - translation of listing and message text - the text submitted for translation - processor - on the provider's own infrastructure.

Plausible Insights OU - web analytics - page views and events at domain level; Plausible is cookie-free by default - processor - on Plausible's own infrastructure; loads only after analytics consent.

Google Ireland Ltd. - Google Analytics 4 measurement and conversion tracking - events (sign-up, purchase, funnel), the site domain and GA cookies - processor - on Google's own infrastructure; loads only after analytics consent.

International transfers: according to the project documentation Supabase (eu-west-1) and Vercel (dub1) store data inside the EEA. For providers outside the EEA (in particular Stripe, Resend and some Google services) the transfer is based on the standard contractual clauses approved by the European Commission (SCCs, Decision 2021/914) and/or the EU-US Data Privacy Framework where the provider holds a certification.

The exact registered addresses of the providers and the applicable data-processing agreements are available on request at support@bixbuz.eu.

Account deletion in the product is implemented as soft delete: the profile is marked with soft_deleted_at, profile fields are cleared/anonymized, and the auth email is replaced with an anonymized address. Access is blocked while soft-deleted.

Listing images and related marketplace records may remain as needed for integrity, moderation, dispute handling, or legal claims.

Security and moderation records may be retained as long as necessary for investigation and platform safety.

Billing and accounting records are retained for the applicable statutory period.

Analytics identifiers follow the respective provider settings and your consent state; rejecting analytics stops loading those scripts and clears A/B measurement cookies set by BixBuz.

We retain technical submission and checkout diagnostics for 90 days; the writer of the log itself deletes rows older than 90 days, without a separate scheduled cleanup.

You may request access, rectification, erasure, restriction, portability, and objection where applicable under GDPR, and you may withdraw consent for analytics at any time.

Use in-product Settings to delete your account (soft delete), or email support@bixbuz.eu for privacy requests.

You may lodge a complaint with a supervisory authority. For the controller established in Hungary, the primary authority is the National Authority for Data Protection and Freedom of Information (NAIH), Hungary. Contact details are published by NAIH; we do not invent alternate addresses here.

How to submit a request: email support@bixbuz.eu, or use your account Settings for rectification or account deletion.

Response deadline: we respond without undue delay and in any event within 1 month of receiving the request. For complex or multiple requests the deadline may be extended by a further 2 months, and we will inform you within 1 month of receiving the request.

Your request is answered on behalf of the controller by the data-protection contact at support@bixbuz.eu.

Identity verification: before fulfilling a request we check that it was sent from the email address registered to the account; if that cannot be established we ask for additional confirmation and suspend fulfilment until it is provided.

Requests are free of charge. For repetitive or manifestly unfounded requests we may charge a reasonable fee under GDPR Art. 12(5) or refuse the request with reasons.

Portability: on request we provide the data concerning you in a machine-readable format (for example JSON or CSV). This is currently a manual, email-based process at support@bixbuz.eu.

Personal data breach: if processing leads to a breach affecting your rights, we notify the supervisory authority within 72 hours of becoming aware of it and inform you without undue delay where the breach is likely to result in a high risk.

Supervisory authority: National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11., Hungary; email: ugyfelszolgalat@naih.hu; web: naih.hu.

At registration, Google sign-in, message sending and listing submission we record the IP address on the basis of legitimate interest to prevent abuse and fraud and to comply with requests from authorities, and retain it for no more than 90 days. For messages sent by accounts younger than 72 hours we additionally store a keyed, irreversible HMAC hash of the IP address for long-term abuse detection; the raw IP cannot be recovered from it.

Where an authority or the police requests data, we disclose it as required by law and do not delete the records concerned until the request has been answered.