Homable privacy policy
Last updated: 6 September 2026
1. Controller and EU representative
Controller under Article 4(7) GDPR:
Yagut LTD
Vaja-Pshavela Avenue, Block VII, Bld. 8, Apt. 10, 0186 Tbilisi, Georgia
Email: dmytro@homable.de
Representative in the EU under Article 27 GDPR:
Dmytro Grinshpun
Email: dmytro@homable.de
2. Scope and sources
This policy applies to Homable's website, accounts, and transaction features. Data comes directly from users, from use of the service, and—when the relevant feature is used—from Veriff, Dropbox Sign, PayU, or participants in a property transaction. Where personal data is not obtained from the person concerned, Homable will also provide the information required by Article 14 GDPR unless an exception applies.
3. Personal data we process
- Account and contact data: name, email, telephone, authentication, and profile data.
- Identity verification: verification status and extracted identity attributes; Veriff processes identity-document images and facial captures.
- Property and listing data: address, description, price, features, media, floor plans, energy and ownership evidence.
- Pre-qualification data: employment, income, financing, household details, credit or other evidence submitted by the user.
- Transaction and contract data: enquiries, viewings, offers, reservations, payments, signatures, and exchanged documents.
- Communications: messages, support requests, and notification preferences.
- Technical and usage data: IP address, device/browser data, timestamps, security and audit logs and—only with consent—analytics data.
Public listing information is visible to visitors. Confidential documents and pre-qualification data are disclosed only according to the selected feature and access permissions.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Accounts, listings, enquiries, and transaction features | Article 6(1)(b) GDPR |
| Identity, ownership, fraud, and platform security | Article 6(1)(b) and (f) GDPR |
| Biometric identity verification | explicit consent under Article 9(2)(a) GDPR where required |
| Payments, accounting, evidence, and statutory retention | Article 6(1)(b) and (c) GDPR |
| Support and operational communications | Article 6(1)(b) or (f) GDPR |
| Optional analytics | consent under Article 6(1)(a) GDPR and § 25 TDDDG |
| Establishing, exercising, or defending legal claims | Article 6(1)(f) GDPR |
Our legitimate interests are a secure and functional service, fraud prevention, error diagnosis, and the defence of legal claims. If data is required for a contract or by law, the relevant feature cannot be provided without it. Homable currently makes no solely automated decisions producing legal or similarly significant effects, including profiling under Article 22 GDPR.
5. Recipients and processors
Depending on the feature used, recipients include:
- Supabase (database, authentication, and storage) and Vercel (hosting and delivery);
- Veriff (identity verification), Dropbox Sign (electronic signatures), and PayU (payment processing);
- Mapbox (address and map services);
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Gmail/Google Workspace (email), transferred on the basis of the EU Standard Contractual Clauses (SCC);
- potentially Twilio (SMS);
- Google Analytics 4 only after analytics consent;
- Sentry (error and security diagnostics according to production configuration);
- Anthropic when an expressly offered AI feature is used and the described data is submitted to it;
- other users, notaries, authorities, advisers, or service providers where necessary for a requested transaction, legal duty, or legal defence.
6. International transfers
Yagut LTD is established in Georgia, and some providers may process data outside the EEA. Transfers take place only under an adequacy decision or appropriate safeguards, particularly the EU Standard Contractual Clauses and any necessary supplementary measures. Information about, or a copy of, the relevant safeguards may be requested using the contact details above.
7. Cookies and similar technologies
Essential cookies or browser storage support authentication, security, language choice, and consent records. Optional analytics is activated only after consent. The Cookie policy lists purposes, storage periods, and withdrawal controls. Withdrawal operates for the future and does not affect earlier lawful processing.
8. Retention
Homable deletes or anonymises data when its purpose ends unless a legal duty or overriding claim requires retention. Current technical policy generally provides:
| Category | Standard period |
|---|---|
| Deals, payment, and contract documents | 7 years after completion |
| Listings, offers, and reservations | 3 years after completion or last activity |
| Profile/account data | no more than 5 years after last activity; earlier erasure on request where possible |
| Authentication, security, and audit logs | 2 years |
| Consent records | as long as needed to demonstrate compliance and address limitation periods |
Legal holds and mandatory retention prevail. Veriff, payment, and signature providers also apply their contractually agreed lawful periods. Backups expire under the documented rotation schedule.
9. Your rights
Subject to the GDPR, individuals may request access, rectification, erasure, restriction, portability, and object to processing. Consent may be withdrawn at any time for the future. Requests may be sent to the controller or Dmytro as EU representative. We may verify identity to prevent unauthorised disclosure.
You may also complain to an EU data-protection supervisory authority, particularly where you live, work, or believe an infringement occurred.
10. Security, children, and changes
Homable applies proportionate technical and organisational measures, including encrypted transmission, access controls, and logging. No internet service can guarantee absolute security. The service is intended for adults with legal capacity who are at least 18. Material changes will be published with a new date and, where required, actively notified or presented for renewed consent.
11. Contact
Privacy requests: dmytro@homable.de
Post: Yagut LTD, Vaja-Pshavela Avenue, Block VII, Bld. 8, Apt. 10, 0186 Tbilisi, Georgia