1. General provisions
1.1. This Policy explains what personal data mavo (“we,” “us”) processes on the mavo.am website, why, who receives it, and how you can control it.
1.2. This Policy supplements the Terms of Service: the Terms’ section on personal data refers to it.
1.3. Personal data is any information that can identify a person: a name, an email address, a phone number, an IP address, photos and the like.
1.4. This Policy is drawn up in Armenian. The Russian and English versions are translations; if they differ from the Armenian text, the Armenian text prevails.
2. What data we process
2.1. If you sign in to an account:
- your email address — you use it to sign in to the website;
- your name, if you have provided it;
- your phone number, if you have added it; we cannot verify phone numbers yet;
- the history of linking email addresses and phone numbers to the account — when they were added and when they were unlinked;
- one-time sign-in codes and the session key — we store them only as hashes.
2.2. If you post a listing:
- information about the property: the building from the address database, the apartment number, price, area, floor, description and other details;
- photos together with the metadata recorded by the camera, including location data if the file contains it;
- moderation decisions on the listing and the reasons for them.
2.3. For all visitors, including those without an account:
- in the servers’ technical logs — the IP address, browser information and the addresses of the pages visited, and after a failure also the data that was in the request;
- the email address and the IP address from which a sign-in code was requested — whenever someone requests a code;
- when you reveal the phone number in a listing — the listing, the time and your account if you are signed in, or otherwise a hash of your IP address computed with a secret key, not the address itself;
- when the page of a published listing is shown on your screen — a view record: the listing, the day and a hash of your account if you are signed in, or otherwise a hash of your IP address together with information about your browser; the hash is computed with a secret key that is valid for one day and is then deleted, and the record contains neither your account nor your address;
- settings kept in browser storage — described in the section on cookies.
2.4. We currently do not accept or store identity documents, selfies or documents proving property ownership: identity verification is switched off for the launch period.
2.5. We do not use third-party analytics services, advertising networks or tracking scripts. We count listing views ourselves, and only the author of a listing sees their number.
3. Why and on what grounds
3.1. We process data in order to:
- sign you in to your account with the code from the email;
- publish and display listings;
- show the author of a listing how many people have viewed it;
- review listings before publication and resolve disputes about them;
- contact you about your account and listings;
- protect the website from code guessing, bulk requests and other abuse;
- limit how many phone numbers from listings can be revealed per day, so that they are not harvested in bulk;
- comply with the law.
3.2. Grounds for processing:
- performance of the Terms of Service — for sign-in, publication, moderation and counting listing views;
- your consent, which you give by continuing to sign in after reading this Policy;
- protection of the website and other users — for technical logs, request rate limits and the record of revealed phone numbers;
- the requirements of the law of the Republic of Armenia.
3.3. An email address is required: without it you cannot sign in. Your name and phone number are optional, but without a phone number buyers will not be able to contact you about a listing.
3.4. We do not make decisions about you solely by automated means: a moderator reviews every listing.
4. What other people see
4.1. A published listing is visible to all visitors of the website and to search engines: the street and building number, price, area, floor, description and photos.
4.2. The apartment number and the exact location of the property are not published: the point on the map is rounded to about 100 meters.
4.3. Published photos contain no metadata: we remove location data and camera information from the copies we display.
4.4. Your name and contact details are not shown in search results. Your phone number may be shown only on the page of your listing and only at a visitor’s request.
4.5. Only the author of a listing sees its number of views, in their Dashboard. We do not keep a record of who exactly viewed a listing.
4.6. A removed listing and its photos may stay in the caches of the website and of search engines for some time.
5. Who we share data with
5.1. Data is processed by contractors the website cannot work without:
- a cloud hosting provider — servers, the database, file storage and a content delivery network;
- an email delivery service — delivers sign-in codes to the address entered at sign-in, and notices to your account’s email address, for example about material changes to the Terms of Service or this Policy; for this it receives the email address and the text of the email.
5.2. We give contractors only what they need for these tasks.
5.3. Within mavo, data is seen by the platform’s staff — for example, the moderators who review listings.
5.4. We disclose data to government authorities only when the law requires it.
5.5. We do not sell personal data or share it for advertising.
6. Where data is stored
6.1. Data is stored on servers in the European Union, where the email delivery service also operates.
6.2. Requests to the website pass through nodes of a content delivery network; some of these nodes are located outside the European Union.
7. How long we keep data
7.1. Sign-in codes, together with the email address and the IP address from which they were requested, are deleted no later than two days after the request.
7.2. The session cookie is renewed each time you visit the website and is removed from your browser if you have not visited for 30 days or have signed out.
7.3. Automatic database backups are kept for 7 days.
7.4. The servers’ technical logs are overwritten as they fill up, while the database log is currently kept without a set period.
7.5. An unlinked email address or phone number is deleted one year after it was unlinked, unless the number is shown as the contact number of a listing; records of revealed phone numbers are deleted after one year. Account data, sign-in records, listings, photos, moderation decisions and listing view records are currently kept without a set retention period; their retention periods will be set out in the next version of this Policy.
7.6. The secret key used to compute view records is deleted no later than one hour after the end of the day it was valid for (Yerevan time).
8. Cookies and browser storage
8.1. Public pages of the website set no cookies.
8.2. After you sign in, we set one cookie, without which you cannot stay signed in. It is renewed on every visit and removed if you have not visited for 30 days or have signed out.
8.3. The website keeps only these values in browser storage, and they are not sent to the server:
- the selected currency;
- a note that you clicked “Remind me later” on the reminder to add your name — until you close the tab.
8.4. We do not use analytics or advertising cookies. You can delete the cookie and the stored values in your browser settings.
9. Your rights
9.1. You have the right to:
- find out what data of yours we process and obtain a copy of it;
- have inaccurate data corrected;
- demand that your data be deleted or its processing restricted;
- withdraw your consent to processing;
- object to processing;
- appeal our actions to the Personal Data Protection Agency of the Republic of Armenia or to a court.
9.2. You can change your name in your Dashboard, add a phone number and delete your account there: the “Delete account” link in your profile, confirmed with a code. Send all other requests, including requests for a copy of your data, to support@mavo.am from your account’s email address.
9.3. When you delete your account, we take your listings off the website and erase your name, email addresses, phone numbers, sign-in keys and favourites. Your messages stay with the people you wrote to, signed “Deleted user”. Moderation decisions and other records needed to resolve a dispute or required by law are kept, without your name or email.
9.4. If you withdraw your consent or demand the deletion of data without which the website cannot work — such as your email address — we will not be able to continue providing you with the website’s services.
10. How we protect data
10.1. Our protective measures include:
- the connection to the website is encrypted;
- the database and the server disks are encrypted, and the database cannot be reached from the internet;
- sign-in codes and session keys are stored only as hashes;
- the session cookie is not accessible to scripts on the page;
- original photos are kept in private storage;
- code requests and sign-in attempts are rate-limited.
10.2. No measure is a complete guarantee. In the event of a personal data breach, we will notify the Personal Data Protection Agency and you within the time limits and in the manner established by law.
11. Persons under 18
11.1. You must be at least 18 years old to sign in to an account and post listings. If you learn that a person under 18 has given us their data, write to support@mavo.am and we will delete that data.
12. Changes to this Policy
12.1. We may change this Policy. A new version is published on this page with its date and applies from that date.
12.2. We notify you of material changes in advance at your account’s email address.