Privacy policy

1. Data controller

The controller of personal data is the operator of Kviko.cz. Identification and contact details are on the Operator page. For privacy matters: the support email or the support form.

2. What data we process

• Identity and contact data: email, chosen name (display name), optional profile photo, optional phone (stored encrypted).
• Listing data: listing content, photos, videos, town and region (no exact address and no GPS from the phone), price and delivery preferences.
• Communication: chat messages, reviews, support tickets and related metadata.
• Technical and security data: a hashed IP on phone reveals (to stop contact scraping), essential login and site cookies.
• Payment references: payment identifiers from the Comgate gateway; we never store card numbers.
• Optional: notification preferences and consent to product news.

3. Purposes and legal bases

• Contract / steps toward a contract (Art. 6(1)(b) GDPR): running the account, publishing and managing listings, chat, optional paid services, user support.
• Legitimate interest (Art. 6(1)(f) GDPR): service security, spam, fraud and contact-abuse prevention, content moderation, operational analytics in the necessary scope.
• Legal obligation (Art. 6(1)(c) GDPR): keeping accounting and tax records related to payments.
• Consent (Art. 6(1)(a) GDPR): optional product news and similar marketing. You can withdraw consent anytime in account settings or via the email link.

4. Processors and recipients

We only pass data to processors who run the service for us, and only to the extent needed for that purpose:

We have a data-processing agreement (or equivalent contractual safeguards) with each processor. We do not sell data or pass it to ad networks for targeted ads.

• Supabase: database, authentication and file storage
• Vercel: hosting and delivery of the site
• Resend: sending transactional and optional emails
• Comgate: payment gateway for payments in the service
• Anthropic (Claude): automatic listing-content checks (text and downsized photos; never phone, password or payment data)

5. Transfers outside the EEA

Some processors may process data outside the EEA. Where needed, we use GDPR-appropriate safeguards, especially the European Commission’s standard contractual clauses or other legally recognised mechanisms.

6. Retention

• Active listing: 60 days from publication, with a free extension option.
• Sold listings: 14 days public, then archive / deletion under operational rules.
• Unfinished (draft) listings: 7 days.
• Phone-reveal records: 90 days.
• Chat history: until one side deletes their account (the other side keeps an anonymised history).
• Payment accounting records: for the period required by law.
• Account and profile: until the user deletes the account, or until legitimate claims or legal duties are settled.

7. Security

• Phone numbers are stored encrypted; public display only with the user’s setting and typically after a deliberate reveal.
• Uploaded photos are converted to WebP and we strip EXIF metadata including GPS. We do not publish the original file.
• Access to data is limited by technical and organisational measures (including access control and encryption in transit).

8. Your rights

In relation to personal data you have in particular the right to:

You delete the account in settings: we remove personal data and listings; the other side may keep chat history labelled “Deleted user”. We handle requests without undue delay, within GDPR deadlines. You may lodge a complaint with the Czech Data Protection Authority (uoou.cz).

• access to data and its rectification
• erasure (“right to be forgotten”), where the legal condition is met
• restriction of processing
• objection to processing based on legitimate interest
• data portability, if processing is automated and based on a contract or consent
• withdrawal of consent, if processing is based on consent

9. Cookies

We only use cookies and similar technical means that are necessary for login and the running of the service. Details are on the Cookies page.

10. Changes to this policy

We may update these principles when the service or the law changes. The current text is always on this page with the update date. Material changes will be announced in a reasonable way (for example on the site or by email to registered users).