Privacy Policy

When you create an account we collect:

• Email address — for authentication and notifications
• Name and phone number — optional, displayed on your public profile
• Profile photo — optional, stored in Supabase Storage
• Listing content — titles, descriptions, images, price

We also collect standard web server logs (IP address, browser type, pages visited) for security and performance monitoring. We use PostHog for aggregate, anonymised analytics.

• To operate your account and display your listings
• To send you transactional emails (new messages, listing status updates)
• To send our optional weekly newsletter, if you subscribe
• To detect and prevent fraud and abuse
• To comply with legal obligations

We do not sell your personal information to any third party.

We use the following service providers to operate the Platform:

• Supabase — database, authentication, and file storage (servers in Canada/US)
• Vercel — hosting and CDN (servers in the US and globally)
• Resend — transactional email delivery
• PostHog — anonymised usage analytics

Each provider processes your data only as necessary to deliver their service and under data processing agreements consistent with applicable law.

Your account data is retained for as long as your account is active. Listings are retained for 30 days after expiry, then permanently deleted. You may request deletion of your account and associated data at any time.

Under the GDPR, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information (right to erasure)
• Withdraw consent for non-essential uses at any time
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection

To exercise any of these rights, contact us at privacy@lefkio.com. We will respond within 30 days.

We use a single session cookie ("lfk_city") to remember your preferred city. No advertising or tracking cookies are set. Analytics (PostHog) are collected without cookies using anonymised device fingerprinting.

You can clear cookies at any time in your browser settings without affecting Platform functionality.

All data is encrypted in transit (TLS 1.3) and at rest. Database access is controlled via row-level security policies. We conduct periodic security reviews and act promptly on reported vulnerabilities.

We may update this policy from time to time. Material changes will be communicated by email to registered users at least 15 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.