Privacy Policy

1. Introduction

This Privacy Policy explains how Arche Labs Ltd ("we", "us"), a company registered in the Republic of Cyprus, collects, uses, and protects your personal data when you use the Homefast platform at homefast.cy ("Service").

We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and applicable Cyprus data protection laws. Arche Labs Ltd is the data controller for your personal data.

2. Data We Collect

2.1 Account Information

When you sign in with Google, we receive and store your name, email address, and profile picture from your Google account. We do not store your Google password.

2.2 Information You Provide

• Phone number (optional, if you enable SMS notifications)
• Search criteria (cities, property type, price range, bedrooms, and other preferences)
• Votes and notes on property listings
• Email addresses of people you invite to collaborate on searches

2.3 Usage Data

We collect information about how you use the Service, including features accessed, searches created, and AI analyses performed. This data is used to enforce plan limits and improve the Service.

2.4 Payment Data

Payment processing is handled entirely by Stripe. We store your Stripe customer ID and subscription status but do not have access to your full credit card number. See Stripe's Privacy Policy for details on how Stripe handles your payment data.

2.5 Cookies and Analytics

We use the following cookies:

• Authentication cookies — Required for keeping you signed in. These are essential and cannot be disabled.
• Analytics cookies — We use Datafast, a privacy-focused analytics tool, which sets a visitor ID and session ID cookie. These help us understand how the Service is used in aggregate. No personal data is shared with third-party advertising networks.

3. How We Use Your Data

We process your personal data for the following purposes:

• Providing the Service — To create and manage your account, process searches, and display relevant listings.
• AI Analysis — Property listing text and images are sent to our AI providers to generate match scores and analysis. This data is not used to train AI models.
• Notifications — To send SMS alerts about new listings if you opt in by providing your phone number.
• Billing — To process subscription payments and manage your plan.
• Service improvement — To understand usage patterns and improve the Service.
• Communication — To respond to your inquiries and send important service-related notices.

Legal Basis (GDPR)

• Contract — Processing necessary to provide the Service you signed up for (account management, searches, billing).
• Consent — SMS notifications (you can opt out at any time by removing your phone number).
• Legitimate interest — Analytics and service improvement, fraud prevention.

4. Third-Party Service Providers

We share your data with the following third-party processors, solely to provide the Service:

We do not sell your personal data to any third party. We do not share your data with advertising networks.

5. Data Storage and Security

Your data is stored on Supabase infrastructure within the European Union. We use encryption in transit (TLS) and at rest. Access to production systems is restricted to authorized personnel only.

While we implement reasonable security measures, no system is completely secure. We cannot guarantee absolute security of your data.

6. Data Retention

• Account data — Retained for as long as your account is active. Deleted upon account deletion request.
• Search and listing data — Retained for as long as the associated search exists. Deleted when the search is deleted.
• Payment records — Retained as required by tax and accounting regulations (typically 6 years).
• Server logs — Automatically deleted after 30 days.

7. Your Rights (GDPR)

As a user in the European Union, you have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure — Request deletion of your personal data ("right to be forgotten").
• Portability — Request your data in a portable, machine-readable format.
• Restriction — Request that we limit how we process your data.
• Objection — Object to processing based on legitimate interest.
• Withdraw consent — Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at mehdi@chessigma.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

8. International Data Transfers

Some of our third-party providers (Stripe, OpenRouter, Vercel, Twilio) may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions by the European Commission.

9. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. The "Last updated" date at the top indicates the most recent revision.

11. Contact

For any privacy-related questions or to exercise your data rights, contact us at:

Arche Labs Ltd
Republic of Cyprus
mehdi@chessigma.com