Privacy Policy

Last updated: June 1, 2026

1. What we collect

• Telegram account data — your user ID, username, and display name, received automatically when you start the bot.
• Search criteria — city, price range, number of rooms, preferred districts, commute destination and transport mode. You set these yourself during onboarding.
• Apartment ratings — which listings you liked (👍) or hid (👎).
• Delivery history — which listings were sent to you, to avoid duplicates.
• Transaction records — credit purchases: amount paid, date, and a payment gateway order ID. We do not store card numbers or bank details.
• Activity events — which commands you ran and when, used for debugging and product improvement.
• Language preference — the language you selected (pl / en / ru / uk).

2. How we use it

• To find rental apartments matching your criteria and deliver them when you request via /show N.
• To maintain your shortlist (/liked) and avoid sending the same listing twice.
• To process credit purchases and keep financial records.
• To diagnose technical errors and improve reliability.

We do not use your data for advertising, profiling, or sell it to third parties.

3. Third parties we interact with

• Telegram — the platform that delivers messages. See Telegram Privacy Policy.
• PayU Poland / Autopay — payment processing. Only the payment amount and order ID are shared. Your card or BLIK details never reach our servers.
• Photon by Komoot — open-source geocoding service, used to convert your commute address to coordinates. Only the address text is sent, no personal identifiers.
• OSRM (Project-OSRM) — open-source routing engine, used to calculate drive/walk times. Coordinates only, no personal data.
• OLX, Otodom, GetHome, Morizon, NieruchomościOnline, Immobooking, Domiporta — we scrape publicly available listing data from these portals. We do not share your data with them.

4. Data retention

• Your account, criteria, ratings, and delivery history are kept as long as your account exists.
• Transaction records are kept for accounting purposes even after account deletion (they contain no personal data beyond your Telegram ID).
• Catalog listings (apartment data from portals) older than 30 days and never interacted with are automatically deleted.
• Activity event logs are kept for up to 90 days.

5. Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, rectify, or erase your personal data.

• Delete everything — send /delete to the bot. This permanently wipes your account, criteria, ratings, and activity logs. Transaction records are retained for legal accounting requirements.
• Access / export — send /export to receive your liked apartments as a file.
• Questions — email us at secretwebplace@gmail.com.

6. Security

Data is stored in an encrypted-at-rest SQLite database on a server located in the EU. Daily backups are kept for 7 days. Only the bot operator has access.

7. Changes to this policy

We may update this page. Significant changes will be announced via the bot. Continued use of Najmi after changes constitutes acceptance.

8. Contact

For privacy questions: secretwebplace@gmail.com