Privacy policy

The controller of your personal data (as defined by GDPR) is Yuliya Chepikava (sole proprietorship registered in Poland), with mailing address ul. Williama Szekspira 4, 01-913 Warsaw, Poland, Tax ID (NIP) 1182241803, REGON 522029471. Privacy contact: support@mieszk.pl.

• Otodom listing URLs you analyze — processed to build the report, cached for up to 24 hours to speed up repeat requests.
• Public Otodom listing index— we maintain our own comparables index built from publicly available apartment sale listings on the Otodom portal: price, area, district, description, photos, build year, and — to the extent the lister chose to publish them — real-estate agency name, agency ID, contact first name. The data comes exclusively from publicly visible listing content; we don't access any non-public material and don't combine it with other sources. In the public Mieszk.pl interface we don't display first names or surnames of private sellers, nor phone numbers. Lister email addresses are not published by Otodom, so they don't reach us.
• IP address and HTTP headers — for rate-limiting (abuse prevention) and diagnostics.
• Payment info — processed by Stripe Payments Europe Ltd. (Ireland) when buying the full analysis. We don't store card numbers — only transaction status and a token.
• Email — if you leave it at payment for a receipt.
• Technical analytics — device type, browser, referrer. Collected via Cloudflare Analytics (anonymous, no cookies) and PostHog Cloud EU (only after consent via the cookie banner).

• Delivering the service — analysis, report generation, PDF delivery (legal basis: contract performance, art. 6(1)(b) GDPR).
• Building the comparables index — we index publicly available Otodom listings so we can show users accurate price comparisons and market statistics. Legal basis: legitimate interest (art. 6(1)(f) GDPR). Balancing test:we process only data that listers have themselves made publicly available on the Otodom portal; we keep the scope to what is necessary for market comparisons; we don't enrich the data from external sources; we don't use it for marketing, profiling people, or resale. People whose data appears in indexed listings (e.g. agents, sellers) have the right to object — see §6 below, with a 72-hour removal SLA.
• Payment processing — art. 6(1)(b) GDPR.
• Security and abuse prevention — rate-limiting, error logs (art. 6(1)(f) GDPR — legitimate interest).
• Tax and accounting — storing payment receipts for 5 years after the end of the tax year (art. 6(1)(c) GDPR — legal obligation under Polish VAT law).

To perform the analysis we share listing content and metadata with:

• OpenAI (US) — AI text + photo analysis via gpt-4.1-mini / gpt-5 / Vision API. Transfers under Standard Contractual Clauses (SCC) per art. 46 GDPR.
• Cenogram Sp. z o.o. (Poland) — transaction data from the official RCN registry.
• Google (Google Ireland Ltd., EU) — Google Directions API for paid-tier commute calculations.
• Otodom (Grupa OLX Poland) — public listing pages we parse. We don't pass your data back to Otodom.
• Cloudflare (US/EU) — hosting, CDN, KV cache. SCC per art. 46 GDPR.
• Stripe Payments Europe Ltd. (Ireland) — card and Blik payment processing.

We do NOT sell or share your data to ad networks, data brokers, or for third-party marketing targeting.

We have a written data processing agreement (art. 28 GDPR) with each of the above processors, entered into under their standard terms of service. Transfers of personal data outside the EEA happen only under Standard Contractual Clauses approved by European Commission Implementing Decision 2021/914 of 4 June 2021.

Mortgage consultation (separate case). If you request a free consultation — via the mieszk.pl website or via our AI-assistant integration (ChatGPT or Claude through our MCP server) — we share the name, phone number and optionally e-mail you provide with an independent mortgage partner (a licensed mortgage intermediary registered with the Polish FSA / KNF) so they can contact you and present loan offers. Legal basis: your consent (art. 6(1)(a) GDPR), which you may withdraw at any time. The data scope and recipient are identical regardless of channel. We do not store your conversations with the assistant; we keep only the request data and technical call logs without the raw IP address.

• Analysis cache — up to 24 hours (summary), up to 7 days (geo), up to 30 days (description translations).
• Logs (IP, errors) — up to 30 days.
• Payment receipts and tax documents — 5 years past the tax year-end (Polish legal obligation).
• Email and account data — until account deletion or request.
• Mortgage-consultation request data (name, phone, email) — until the consultation is completed, no longer than 24 months, or until consent is withdrawn / deletion is requested.

You can at any time:

• Request access to the data we hold (art. 15 GDPR).
• Correct inaccurate data (art. 16).
• Delete data ("right to be forgotten", art. 17) — except data we're legally required to keep (payment receipts).
• Restrict processing (art. 18).
• Receive a portable copy (art. 20).
• Object to processing based on legitimate interest (art. 21).
• Complain to UODO (Polish DPA) — uodo.gov.pl.

Send requests to support@mieszk.pl — we respond within 30 days.

Listing removal procedure (comparables index).If you appear in a public Otodom listing (as an agent, seller, or contact person) and don't want it in our comparables index, email the listing URL to support@mieszk.pl. Within 72 hours of verifying your identity:

• the listing is removed from the comparables index;
• the associated cache is purged;
• the URL is added to our internal blocklist — re-indexing will not happen even if the listing reappears under the same address;
• you receive an email confirmation with the blocklist entry ID for audit purposes.

Mieszk.pl uses cookies and localStorage in three categories. All categories other than "Strictly necessary" load only after explicit opt-in via the cookie banner (art. 398 of the Polish Electronic Communications Law / PKE, art. 7 GDPR).

• Strictly necessary — selected language (cookie locale), stored consent decision (localStorage mieszk.consent.v1), Stripe checkout session. These don't require consent under art. 361 of the Polish Electronic Communications Law (PKE).
• Analytics — PostHog Cloud EU (Brussels), Google Analytics 4 (with IP anonymization and Google Consent Mode v2). Used for aggregated traffic stats and to understand what works on the site. Before you decide in the cookie banner, PostHog runs in a cookieless mode (in-memory, pageviews only) under legitimate interest (art. 6(1)(f) GDPR). After you consent we enable the full mode: localStorage persistence, click autocapture, and session replays of your UI interactions. All form fields, email addresses, and other personal data are masked before being sent.
• Marketing — advertising pixels: Meta Pixel (Facebook/Instagram, Meta Platforms Ireland Ltd.), TikTok Pixel (TikTok Technology Ltd., Ireland), Google Ads (Google Ireland Ltd.). Used to measure campaign performance and for ad targeting. Transfers to the US are covered by Standard Contractual Clauses (SCC) under art. 46 GDPR.
• Server-side conversion measurement — after signup and payment we send hashed (SHA-256) email and account ID, together with request metadata (IP, user-agent, page URL), to the Meta Conversions API. This happens on our backend, independent of the cookie banner decision. Legal basis — performance of contract (recording activation/purchase) and legitimate interest in measuring marketing effectiveness (art. 6(1)(b) and (f) GDPR). Cookies _fbp/_fbc (only with Meta Pixel consent) additionally improve match quality but are not required.
• Server-side product analytics — key funnel events (signup, analysis created, checkout started, purchase) are sent from our backend to PostHog Cloud EU (Brussels) with the account ID and event metadata (plan, amount, locale). This happens independent of the cookie banner decision. Legal basis — performance of contract and legitimate interest in measuring product performance (art. 6(1)(b) and (f) GDPR). No transfer to third countries.

You can change or withdraw consent for analytics and marketing at any time via the "Cookie settings" link in the footer. Withdrawing consent is as easy as giving it (art. 7(3) GDPR).

TLS for all connections, Cloudflare KV with encryption at rest, rate-limiting against abuse. Third-party API keys live in environment secrets, not in code.

We may update this policy. The current version is always at this URL, with the last-updated date at the top. We'll notify paid users by email about material changes.

This policy is governed by Polish law and GDPR. Disputes are handled by the court with jurisdiction over the controller's registered address.