Privacy notice
This notice explains what personal data this website processes, why, and what rights you have. We do not sell personal data or use advertising trackers. Optional analytics, Google maps, sign-in and requested AI processing involve the providers described below.
1. Controller
Sonnen Stark GmbHMorsestraße 6
48432 Rheine
Germany
Email: info@siargaopropertyfinder.com
Data protection contact: info@siargaopropertyfinder.com
2. Overview of processing
| Activity | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Visiting the site | IP address, request time, URL, browser information; hashed network identifiers and usage counters | Page delivery, security and abuse prevention. Legitimate interest (Art. 6(1)(f) GDPR). | Technical logs follow the hosting provider’s retention settings; see section 7. |
| Map display | IP address, browser information, map view and interactions sent to Google | Optional map display with your consent (Art. 6(1)(a)); see section 4. | Your local preference remains until cleared; Google applies its own retention policies. |
| Sign-in | Email address, authentication identifiers and security metadata | Providing the account you request (Art. 6(1)(b)); abuse prevention (Art. 6(1)(f)). | While the account is used, or until a deletion request is processed, subject to necessary legal retention. |
| Listings | Public property facts and approved media; private contact details, role evidence, documents and notes | Preparing and publishing your listing (Art. 6(1)(b)); permission for another person’s data and contact disclosure (Art. 6(1)(a)); authority review (Art. 6(1)(f)). | Public while published. Drafts and originals remain until removed; see section 7. |
| Property conversations | Messages, account identifiers, private notification addresses, listing, timestamps and read status | Providing the requested conversation and service alerts (Art. 6(1)(b)); abuse prevention (Art. 6(1)(f)). | Conversation history remains until removed following a request or retention review. Alert jobs expire after 30 days. |
| AI processing | Uploaded documents and property media, sampled video frames, audio, your questions and relevant listing facts | Preparing and checking the listing service you request (Art. 6(1)(b)). | Suggestions and processing results are saved with the draft; provider retention is described in section 6. |
| Optional analytics | Cookie identifiers, general device information, public page views and consented usage events | Understanding site usage with your consent (Art. 6(1)(a)). | User/event data is retained for 14 months without automatic extension on new activity; aggregated reports may remain longer. |
| AI connections | Token hash, selected permissions, account, name, expiry and revocation information | Providing the integration you request and protecting access (Art. 6(1)(b), (f)). | While needed to operate and audit your connection; tokens expire after at most 90 days. |
3. Sign-in with a verified email
We use Firebase Authentication (Google Ireland Limited) in email-link mode. When you ask to sign in, we send a one-time link to the address you enter; nothing is sent until you submit the form. Clicking the link proves control of the address, which is why we call it a verified email. No passwords are created or stored. Your browser stores the email you entered locally until the link is used, so that the sign-in can be completed on the same device. Firebase processes your email address, IP address and security metadata on our behalf under its data processing terms. Sign-in data is not confined to our EU storage region; see section 9 about international processing.
4. Maps
The initial island overview uses locally served Natural Earth geography and does not contact Google Maps. Selecting Satellite or 3D requests Google Maps (Google Ireland Limited); your choice is remembered in your browser. When a Google map is shown, your browser connects to Google and transmits your IP address and map interactions. Listing data and the local overview remain available without Google Maps. You can withdraw the choice using the button below or by clearing site data. Google’s privacy policy describes its processing. Map availability is subject to daily allowances. If an allowance is reached, the property list remains available.
“Show my location” separately asks your browser for location permission. If you allow it, your coordinates are used to centre the Google map and display your device’s reported accuracy. We do not save this device location to your account. A property location that you save to a listing is different and can be public.
5. Listings, documents and contact details
- Public parts of a listing (title, type, location pin and accuracy, area, price, description, photos, videos, document types and statuses, role of the lister) are published after your final confirmation and the automatic checks.
- Private parts (contact name, email, phone, licence number, notes, uploaded documents) are stored in our EU-region Google Cloud Storage bucket and Firestore database, encrypted at rest. Access is restricted to the lister, authorised staff and the service providers needed to operate the service. Uploaded files are processed automatically as explained before upload and in section 6.
- Document files and original photos stay private. Only approved property-photo derivatives and approved videos are published. Documents are not available to buyers through the portal.
- New inquiries open a private conversation between the buyer and lister, linked to that property. Participant email addresses are not revealed automatically. If you type contact details into a message, the other participant can see them. A legacy contact-disclosure action, where available, requires a separate confirmation.
- New-message email alerts are delivered through ALL-INKL.COM – Neue Medien Münnich, Germany. Alerts contain the listing title and a link to your inbox, not the message body or the other participant’s email. You can switch these alerts off in Messages. Delivery is rate-limited and retried when needed; the saved conversation remains available if email fails. WhatsApp alerts are not enabled.
- Conversations are protected by access controls, HTTPS in transit and storage encryption. They are not end-to-end encrypted. The service necessarily processes their contents; technical support or legal compliance may require authorised access. They are not sent to the listing AI merely because you use the chat.
- Photos may be labelled “AI visualisation” when a lister marks them as generated or edited; we show this label so that buyers are not misled.
6. AI assistant and document reading
The listing service uses the OpenAI API through our server. Before uploading, the form explains that uploaded documents, photographs and video are processed automatically to organise files, suggest property facts and screen public content. Document files or page images may be sent to OpenAI. Video frames are sampled every two seconds and audio may be transcribed. This is not an inspection of every frame and can miss short events. Processing can continue after you close the browser. Relevant extracted facts, your answers and your draft are used for follow-up questions. When you request pre-filling, supported suggestions can fill blank fields; conflicting values remain for you to resolve. Publication still requires your final confirmation. Automated publication checks screen the public text and media; they do not verify ownership or legal rights. Creating an AI-enhanced cover is a separate optional action based on an approved property photo; the original is kept and the result is labelled. Search assistance receives public listing facts. Private files are not made available to other buyers by this processing. We keep usage and budget records, but do not intentionally write document text or conversations to application logs.
Our text and vision response requests disable storage of the response as API application state. This is not a zero-retention guarantee: OpenAI’s standard abuse-monitoring logs may contain request and response content for up to 30 days, or longer where law or security requires it. API data is not used for training by default. See OpenAI’s API data controls. Remove unnecessary third-party personal data before uploading a document. AI results can be wrong and do not make decisions about your legal rights.
If you connect your own AI client under AI connections, that client can receive the account data covered by the permissions you grant, including private drafts or messages where selected. Its provider applies its own privacy terms. We show a new token once and store only its hash. Revoke access there whenever it is no longer needed; a revoked token cannot make new requests.
7. Hosting and processors
The site runs on Google Cloud (Cloud Run, Firestore, Cloud Storage, Firebase Hosting) with data at rest in EU regions where the service allows it. Google acts as our processor under the Google Cloud data processing terms. ALL-INKL provides notification email delivery. OpenAI provides requested AI processing. We do not use advertising networks, social media plugins or web fonts loaded from third-party servers.
Accounts, drafts, inquiries, uploaded originals and saved extraction suggestions do not automatically expire when you close the page or unpublish a listing. Contact us to request deletion. We remove data no longer needed for the service, except records required for legal obligations or the establishment, exercise or defence of claims. Deleted storage objects can remain recoverable for seven days under the bucket’s soft-delete policy. Cloud Logging ordinarily retains application/request logs for 30 days and required administrative audit logs for 400 days; provider security and authentication retention also applies.
8. Cookies and local storage
We do not set marketing cookies. Optional Google Analytics 4 loads only after you accept analytics in the privacy controls. Firebase Authentication stores a session token in your browser’s local storage or IndexedDB to keep you signed in. The listing form keeps your unsaved first-step answers in local storage on your device so they survive the sign-in email round trip. Google Maps may set its own cookies when it loads. You can clear all of these through your browser settings.
Google Analytics (Google Ireland Limited; measurement ID G-6FBHSDYW16) helps us understand which public pages and features are useful. We do not send document contents, private messages, contact fields, email addresses or authentication tokens to Analytics. Advertising features, Google Signals and enhanced measurement are disabled. User/event retention is set to 14 months, without resetting that period when activity resumes; standard aggregated reports are not governed by that setting. Analytics cookies can have a longer browser lifetime, independent of event retention. Rejecting analytics does not prevent browsing, listing or messaging. You can change your choice through the site's privacy settings and clear cookies in your browser.
See how Google processes service data andGoogle’s retention explanation. Google Search Console and Ahrefs are used to review public search performance and crawl public pages; they do not receive your private account documents or conversations.
9. Recipients outside the EU
Google and OpenAI may process data outside the EU, including in the United States. Their applicable processing agreements provide transfer safeguards, including EU standard contractual clauses where required; EU–US Data Privacy Framework coverage depends on the receiving entity and service. Contact us for information about the applicable safeguards. Listers and buyers may be in the Philippines or elsewhere. Sending an inquiry requests that your message be made available to that lister. Contact details are visible only if you choose to share them.
10. Your rights
You can request access to, correction or deletion of your data, restriction of processing, data portability, and you can object to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time with effect for the future, for example by asking us to remove a listing or an inquiry. Write to info@siargaopropertyfinder.com. You also have the right to lodge a complaint with a supervisory authority, including LDI Nordrhein-Westfalenat the controller’s seat. Where Philippine data-protection law applies, you may also contact the National Privacy Commission.
11. Changes
We update this notice when the service changes. The date above shows the current version.