Privacy Policy

Last updated: 2026-06-05.

1. Who we are

Zgjedhja Ime ("we", "us") operates the website zgjedhjaime.com. Our registered office is at 21 Dhjetori, Tiranë. For any question about this policy, write to info@zgjedhjaime.com.

2. What data we collect

Renter / tenant forms — name, phone, email, budget, neighborhood preferences and any free-text notes you provide.
Tenant accounts — email, hashed password, language preference, saved listings and saved searches.
Landlord submissions — name, phone, email, property details and uploaded photos (with EXIF metadata removed before storage).
Contact and inquiry messages — name, phone, email, subject and message body.
Agency partners — agency name, contact person, phone, email, signed cooperation agreement (name, IP address and timestamp of the digital signature), closed-deal details and invoice records.
AI assistant conversations — the messages you type into the AI chat widget and the parsed-search queries submitted from the hero search. We keep up to the last 24 messages of the active conversation.
Technical data — IP address, browser type, pages visited, referring URL. Stored in server logs for security, debugging and aggregate analytics.

3. Why we collect it

To match renters and landlords, and to manage properties brought to us by partner agencies (see §8).
To verify and publish landlord submissions, including a visible watermark on every photo.
To operate tenant and agency accounts (login, saved listings, lead and invoice management).
To respond to inquiries via the contact form.
To detect abuse and rate-limit form submissions.
To improve the site (aggregate analytics only).

4. Legal basis

We process your data on the basis of your consent (form submission, account creation, cookie banner acceptance) and our legitimate interest in operating the platform safely. For paid services to agencies, processing is also necessary for the performance of our cooperation agreement with you.

5. Cookies and local storage

We use only what we need to make the site work and (with your consent) to measure traffic.

lang — remembers your language preference (Albanian / English / Italian). Lifetime: 12 months.
zi_admin_session, zi_tenant_session, agency_session — set after you log in to the operator, tenant or agency portal. These are essential to keep you signed in. Lifetime: up to 14 days.
zi_oauth_state — short-lived cookie set during the "Continue with Google" flow to protect against CSRF. Deleted as soon as the login completes.
zi-cookie-consent — your accept/decline choice on the cookie banner. Stored in browser localStorage, not as a cookie. Lifetime: until you clear browser data.
Analytics — we use a self-hosted Umami instance at stats.zgjedhjaime.com to count page views and aggregate referrers. Umami is cookie-less by default; it does not set tracking cookies.

We do not use third-party advertising trackers, retargeting pixels, Google Analytics, Facebook Pixel or similar.

6. Data retention

Renter, landlord and tenant-account records: 24 months from last activity, then deleted on request or at the end of the retention window.
Inquiries and lead-routing records: 24 months.
Agency partnership records, signed agreements, closed-deal and invoice data: retained for the longer of 5 years or the minimum required by Albanian tax and accounting law.
AI assistant conversations: kept only for the duration of your active browser session; we do not maintain a per-user chat history beyond the last 24 messages of the current conversation.
Server access and error logs: 30 days, then rotated.
Off-site database backups: 60 days, then deleted.

7. Your rights (GDPR / Albanian Law No. 9887 on personal data protection)

You have the right to: access, rectify, erase, restrict processing, object and request portability of your data, and to lodge a complaint with the Albanian Information and Data Protection Commissioner. To exercise these rights write to info@zgjedhjaime.com.

8. Sharing with third parties

We do not sell your data. We share specific data with the following categories of recipient, only for the purposes stated:

Partner real-estate agencies — we do not share your name, phone, email or inquiry text with partner agencies. Agencies bring us properties to list; we handle all tenant-side contact ourselves.
Landlords — when you submit an inquiry on a specific listing, the landlord receives your contact details. For properties brought to us by a partner agency, the landlord's identity stays hidden behind the platform and the agency does not receive your contact details either.
Email delivery — outbound mail (verification, password reset, lead notifications, invoices) is sent through Namecheap Private Email (SMTP) with Resend as a fallback provider.
AI assistant provider — when you use the chat widget or the natural-language search, your message text is sent to OpenRouter (a US-based LLM gateway) for processing. We do not send your account identifier, email or phone with the message.
Google — only if you choose "Continue with Google" to sign up or sign in as a tenant. Google authenticates you and returns your email and profile name to us.
Error monitoring — if a server error occurs, the stack trace and request context (which may include your IP address and the URL you were on) are sent to Sentry to help us fix bugs.
Meta (Facebook, Instagram, WhatsApp Business) — we operate a Facebook Page, Instagram Business profile and a WhatsApp Business line that receive standard platform-level visibility data (page views, post reach, click-through metrics) on people who interact with our brand surfaces on those products. When you tap the "WhatsApp" button on the site you are redirected to wa.me, and the chat takes place inside Meta's infrastructure subject to WhatsApp's own privacy policy. We do not import or store your social profile data on our servers.
Telegram — we cross-post newly-published listings to our public Telegram channel @zgjedhjaime. Posts contain only the listing's public fields (title, price, neighborhood, public photo URLs); no personal data of yours is sent.
Hosting — the site runs on a Linux VPS in the European Union; that provider has technical access to encrypted data at rest.
Public authorities — only where required by Albanian or applicable law (court order, lawful regulator request).

9. International transfers

Some of the third parties above are based outside Albania and the European Economic Area — notably OpenRouter (United States) for the AI assistant, Sentry (United States) for error monitoring, Google (worldwide) for OAuth sign-in, and Meta (United States) for the Facebook / Instagram / WhatsApp Business surfaces. These transfers are limited to the minimum data necessary and are protected by the respective providers' standard contractual clauses and security certifications.

10. Security

Connections are over HTTPS with HSTS. Passwords are stored as bcrypt hashes. Photos uploaded via the landlord form are stripped of EXIF metadata before storage and stamped with a visible watermark. Operator access is restricted by per-account login. Inquiries and contact forms are rate-limited per IP. Server-side errors are monitored and we receive alerts on suspicious activity.

11. Changes to this policy

We may update this policy from time to time; the "Last updated" date above will change. For material changes affecting your rights we will surface a notice on the homepage.

12. Contact

Questions about this policy: info@zgjedhjaime.com or by post to the address above.