Privacy notice for Afër

The controller responsible for the processing of personal data in connection with Afër is:

Afër is the name of the platform offered at aferteje.com.

Which data is processed depends on which functions of Afër are used.

Registration and account

When registering with a password, the following are processed in particular:

• email address;
• authentication and account data;
• email confirmation data;
• sign-in and session data;
• times and versions of acceptance of the terms of use;
• 18+ self-confirmation.

For the 18+ self-confirmation, Afër currently collects neither a date of birth nor an identity document or identity document number. The confirmation does not constitute a verified age check.

If a supported external sign-in provider is used, the identity and authentication data of that provider required for signing in may also be processed.

When Apple is used again to prove identity before account deletion, Afër attempts on the server through Apple’s revocation API to revoke the refresh and access tokens supplied by Apple at that time. This applies to the website and apps. The tokens are processed only in memory for this attempt and stored neither in the database nor in cookies; only the outcome is stored. A failed attempt or a missing token does not stop account deletion; the confirmation then explains how to withdraw access in Apple settings.

Profile

Users can in particular provide a public display name and a municipality or bashkia.

The email address is not part of the public profile.

The public profile may also show the year of registration, whether the email address has been confirmed, the average and number of reviews received and a typical response time. This information is calculated from the use of Afër. There is no public numerical trust score.

Phone number

Users can voluntarily add a mobile number from Kosovo or Albania and choose whether they want to be contacted by call, WhatsApp and/or Viber. On their active listings the number is shown masked (for example “+383 44 XXX XXX”). Only signed-in users with a confirmed email address see it in full, after explicitly clicking “Show number”. The number is not verified by SMS and can be changed or removed at any time.

To prevent mass collection of phone numbers, Afër logs every retrieval (requesting user, listing, time, result) and limits the number of retrievals per user and day. This log is not public; its entries are deleted after 30 days.

If a signed-in user uses the “Call”, “WhatsApp” or “Viber” button for a number shown to them, both receive a notice in their Afër inbox with the other person's display name, the chosen channel and the time; both can continue writing in the related conversation. Such a notice is created at most once per listing, channel and day.

Business accounts

Anyone who runs a business account provides the company name, the business address (country, municipality/bashkia, street, optionally postal code) and the registration number. An exact location, a short description, opening hours and a website are optional.

The company name, business address, exact location, short description, opening hours and website are publicly visible on the dealer profile and on the dealer's listings. The registration number is not public; only the dealer and Afër, for handling reports, can see it.

A stored business phone number – for business accounts this may also be a landline – is shown in full to signed-in users. Unlike for private accounts it is not masked, and retrieving it is neither logged nor limited.

If a dealer uses “Use current location” in the form, the browser asks once for the device's position. Afër stores only the point that was accepted; it can be changed or removed at any time.

Afër keeps a change log of the company details, with the time and earlier company names, in order to detect abuse. This log is not public and is deleted together with the account.

Listings

When a listing is created, the following may in particular be processed:

• title and description;
• category and subcategory;
• country and municipality/bashkia;
• price and currency;
• condition and whether the price is negotiable;
• further category-specific information;
• up to eight uploaded images.

Active listings and the seller's public display name are publicly visible. Drafts are not public.

For listings from private accounts, Afër currently does not require an exact address and does not use the device's GPS location.

Uploaded images are technically processed for use on Afër and converted into a web format. Original image metadata is not carried over in the process.

However, users may themselves publish personal information in free text or images. Users should therefore not publicly post any personal information that is not necessary for the listing.

Saved searches

Signed-in users can save searches. The name given, the selected search filters and the time of saving are assigned to their account on the server. Saved searches are not public and can be deleted at any time.

Messages

Messages between users are stored on the server.

Ordinarily, the participants in a conversation can access their conversation.

If a specific message is reported, a suitably authorized moderator can view the specific reported message to the extent necessary to handle the report.

Persons with specially authorized administrative database access may technically have more extensive access. Such access must be limited to necessary administrative and technical purposes.

Afër also uses technical measures to protect against abuse, for example rate limits, blocking and restrictions on certain links.

There is currently no routine, comprehensive automated analysis of the content of all messages for fraud or spam.

Notifications

In the browser, users can be informed on a device by Web Push notification when someone writes them a message on Afër. To do so, they explicitly switch on notifications in the settings or via the suggestion after their first own message, and allow them if the browser or the phone asks. Switching them on is voluntary and counts as consent, which can be withdrawn at any time.

For each device on which Web Push notifications are switched on, Afër stores with the account the delivery address (endpoint) and the keys that the browser generates for this, the language and the times of setup and of the last update. At most ten devices are stored per account; when another one is added, the one not updated for the longest time is removed.

When someone writes to a user, Afër sends a notification to each of these devices via the push service of the browser vendor (see “Recipients and service providers”). It names the title of the listing but not the text of the message; clicking it opens the conversation. Afër encrypts it for the device so that the push service cannot read its content; only the device decrypts it and displays the notification. If the conversation is currently open in the foreground there, the device shows no notification; only in Safari does it appear even then.

The data remains stored until users switch notifications off in the settings or sign out on the device or the associated session ends; Afër then removes this device. When account deletion is requested, Afër immediately removes all devices and sends no more notifications. If the push service reports that a delivery address is no longer valid, Afër deletes the device as well. In addition, the permission can be revoked at any time in the settings of the browser or the phone; the device then no longer shows notifications.

In the Afër store apps for Android and iPhone, notifications are delivered through Google Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs), respectively. Afër stores with the account the device token, platform, language and times of setup and last update. Firebase also processes a Firebase installation ID on Android. The website keeps the device token only in memory within the app’s web view. Operating-system permission alone does not mean that the device has been registered with Afër.

Unlike Web Push, native notifications are not end-to-end encrypted: Google or Apple can read the notification content and the listing title. The message text is not sent. No further notification is shown for a conversation visibly open on screen; for other conversations the open app shows an in-app notice, and in the background a system notification.

Registration for native notifications ends when notifications are switched off in Afër, on sign-out, when the associated session ends or when account deletion is requested; Afër then removes the device token. The limit of ten devices per account applies jointly to Web Push, APNs and FCM. Invalid device tokens are also removed. Withdrawing operating-system permission prevents notifications from being displayed; the app checks it on the next use.

Completed transactions and reviews

When users confirm a completed transaction within Afër, the accounts involved, the link to the corresponding conversation and the status and time information required for this are processed.

This confirmation documents a statement by the users within Afër and is not proof of payment or delivery.

For reviews, the following are processed in particular:

• users involved;
• link to the confirmed transaction;
• rating of 1 to 5 stars;
• optional review text;
• creation and publication data.

Published reviews appear with the author's public display name on the profile of the person reviewed.

Reports and moderation

When a report is made, the following may in particular be processed:

• reporting user and affected user;
• reported content;
• reason for the report;
• necessary evidence;
• moderation decision;
• handling and time information.

This information is used to investigate rule violations, to protect other users and to prevent abuse.

Afër may also examine listings and accounts and decide on them without a prior report. For every decision, the listing or account concerned, the kind of decision, the reason, the time and the deciding team member are stored.

If moderation removes a listing or suspends an account, Afër shows the reason to the account concerned: for a removed listing under “My listings”, for a suspension after signing in.

To handle violations and enquiries, authorised team members can view the data of an account, such as listings, reports and earlier decisions. The e-mail address and the stored phone number are visible only to team members with extended authorisation.

Technical data is generated when Afër is operated.

This may include in particular:

• IP address;
• date and time of access;
• requested path;
• browser and device information;
• session and authentication information;
• technical request data;
• status and error codes;
• security and authentication events.

Afër itself logs brief event names and error codes for certain application errors. Message content and passwords are not to be written to application logs intentionally.

If a search on Afër finds no listing even after all fallback steps, Afër stores the cleaned search term together with the language, country and date in order to add missing words and spellings. Neither the account nor the IP address is stored; search terms that look like phone numbers, e-mail addresses or links are not stored at all. These entries are deleted after 90 days.

In addition, the infrastructure and security providers used keep their own technical logs.

Afër processes personal data in particular:

• to provide and manage user accounts;
• to enable sign-in and authentication;
• to store and publish listings;
• to enable communication between users;
• to provide transaction confirmations and reviews;
• to handle reports and rule violations;
• to prevent fraud, spam, unauthorized access and other abuse;
• to ensure the security, stability and functionality of the platform;
• to handle requests from users;
• to evaluate the reach and use of the website in aggregated form;
• to fulfill applicable legal obligations.

Depending on the processing, the legal basis may in particular be the necessity to provide the platform services requested by the user, a legal obligation, consent or legitimate interests of the operator or of other users.

Legitimate interests may in particular include IT security, abuse prevention, protection of other users, error analysis, reach measurement without cookies and enforcement of the platform rules.

Afër uses cookies and other browser storage technologies. Some of them are necessary for the technical provision of the platform. Others are used – where enabled and legally permissible – to analyze and improve the website.

Under the current technical setup, the technically necessary storage mechanisms include in particular:

• Supabase session data for authentication and sign-in;
• a short-lived signed auth intent cookie;
• afer-location to store the selected search region;
• afer-locale to store the language you last chose for up to twelve months;
• afer-consent to store the consent decision for up to twelve months;
• localStorage for favorites, recently used search terms and temporary listing drafts;
• localStorage for the decision to display maps from Google Maps, for up to twelve months;
• localStorage for the decision not to show the suggestion to switch on notifications for 30 days;
• sessionStorage for temporary message drafts.

Listings saved for offline use: If you agree in the settings or in the installed app, Afër stores the public details of the listings you viewed last (title, price, condition, category, municipality, description, the seller's display name and up to two photos) as well as when you last viewed them, in your browser's storage on your device, so you can view them without an internet connection. At most 20 listings are stored; listings older than 7 days are no longer shown and are deleted the next time you open Afër. This data does not leave your device. You can withdraw your consent at any time in the settings; the stored listings are deleted then, when you sign out and when you request the deletion of your account. Your browser also stores Afër's program files, an offline page and the language you used last; they contain no information about you.

Neither Google Analytics nor Hotjar loads in the iOS app on iPhone; its consent banner lists only necessary storage. In the Android app, Google Analytics and Hotjar load only after consent, as in the browser. The iOS app does not save listings for offline viewing; in the Android app the described offline storage remains available after consent. In the browser and apps, Afër requests location only after a click on “Use current location” in the company form, subject to system permission where required, never automatically or in the background.

In addition, Afër uses Google Analytics to analyze the use of the website. These services may use cookies and similar technologies. They are only activated after users have given their consent via the consent banner. The consent applies to Google Analytics jointly and can be changed or withdrawn at any time via “Cookie settings” at the bottom of the page.

Listings, dealer profiles, the selling flow and the company form can show a map via Google Maps: for private accounts the municipality, for business accounts the business address or the dealer's exact location. The map is only loaded after users have clicked “Show map”. When it loads, Google receives the IP address, browser and device information and the place shown (municipality, address or coordinates) and may use cookies and similar technologies. In the company form this button is labelled “Load map and address suggestions”; there, an interactive map from Google Maps loads in addition. While it is loaded, Google also receives the address a dealer types, in order to show suggestions, and the map area the dealer views, even before anything is saved. This also applies if maps were already allowed in this browser before. The decision applies to all maps in this browser, is stored there for up to twelve months and can be withdrawn at any time via “Stop loading maps automatically” below a displayed map. Google processes this data under its own responsibility in accordance with the Google Privacy Policy (https://policies.google.com/privacy). Use of the map is also subject to the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps/).

In the browser, Afër uses Vercel Web Analytics to measure how often which pages are viewed. Vercel (see “Recipients and service providers”) processes the data for this on behalf of Afër. This lets Afër see which content is used, where visitors come from and which devices they use Afër on.

For every page view, the time, the page viewed, the referring source, country, region and city, device type as well as browser and operating system including version are recorded. Before sending, Afër removes everything after “?” and “#” from the address, for example search terms and codes from confirmation and password links. On the pages for messages, account and settings, sign-in and password as well as for accepting the terms of use, only the area is recorded, not the individual page. Pages for confirming email addresses and sign-ins as well as moderation are not recorded.

Vercel Web Analytics does not set cookies and does not store an identifier in the browser. To tell visitors apart, Vercel derives a hash value from the request, which is discarded after 24 hours; this makes it impossible to recognise a visitor across several days or across other websites. The IP address is not stored together with the measurement data. Afër only sees aggregated figures.

The legal basis is Afër's legitimate interest in evaluating the reach and use of the website without cookies and without recognising individual visitors. The measurement therefore does not depend on consent given through the consent banner and also runs if no consent has been given or it has been withdrawn.

Vercel Web Analytics is not active in the iOS app or in the Android app.

Afër uses Google Analytics, a web analytics service provided by Google.

Google Analytics helps Afër understand how the website is used. In particular, information about page views, sessions, interactions, devices and browsers used, approximate geographic information and technical usage data may be processed.

Online identifiers and technical information such as the IP address may also be processed. Which data is collected specifically depends on the Google Analytics configuration used. Google Signals and ad personalization are disabled for Afër.

Afër uses the information obtained to analyze the use, reach and functioning of the platform and to improve its service.

Google Analytics is only activated after users have given their consent via the consent banner. Consent given can be withdrawn at any time via “Cookie settings” at the bottom of the page.

Afër currently does not send newsletters or other marketing emails.

Emails are currently used in particular for account-related and security-related processes such as registration, email confirmation and password recovery.

The use of Google Analytics does not mean that users are thereby automatically signed up to receive marketing emails.

Afër automatically checks the titles of new listings against fixed category rules. If, according to these rules, a title clearly does not match the selected category, the listing is not published immediately. Users can then change the category or submit the listing for review by a moderator, who then decides.

Afër also automatically checks the titles of listings when they are published against a fixed list of terms for items that are prohibited under the terms of use. If a title contains such a term, the listing cannot be published. Anyone who believes that their item is permitted can write to info@aferteje.com.

Afër also uses technical limits, for example on the number of new listings, contact requests or messages within a certain period and on certain links in messages. These limits serve to protect against spam, fraud and other abuse.

There is no decision based solely on automated processing that produces legal effects for users or similarly significantly affects them.

Personal data is only disclosed to the extent necessary for the purposes described.

Publicly visible information such as active listings, the public display name and published reviews can be viewed by all visitors to the platform. Messages are visible to the participants in the conversation concerned.

Afër uses in particular the following service providers for its operation:

• Supabase (Supabase, Inc., USA): database, sign-in and account management, image storage and real-time functions. The Afër project is operated in the Frankfurt am Main region (Germany).
• Vercel (Vercel Inc., USA): hosting and delivery of the website as well as reach measurement with Vercel Web Analytics. Server-side functions run in the Frankfurt am Main region; content may be delivered via Vercel's global network.
• Resend (Resend, Inc., USA): sending account-related emails such as registration confirmation and password recovery via the Ireland sending region.
• Cloudflare (Cloudflare, Inc., USA): Cloudflare Turnstile to protect registration, sign-in and password recovery against automated requests.
• Google (Google LLC, USA, or Google Ireland Limited, Ireland): sign-in with Google, if users choose this option, and operation of the info@aferteje.com mailbox via Google Workspace. In addition, Google Analytics, if users have given their consent. In addition, the display of maps via Google Maps.
• Apple (Apple Inc., USA, or Apple Distribution International Ltd., Ireland): sign-in with Apple, if users choose this option.
• WhatsApp (WhatsApp LLC, USA, or WhatsApp Ireland Limited, Ireland) and Viber (Viber Media S.à r.l., Luxembourg): when buyers use the corresponding buttons, the respective app opens with the phone number and, where applicable, a prepared text with the listing's title and link. Afër itself does not transmit any data to these services; further communication is governed by their privacy policies.
• Push services of the browser vendors, in particular Google (Firebase Cloud Messaging) for Chrome, Mozilla (Mozilla Corporation, USA) for Firefox, Apple for Safari and Microsoft (Microsoft Corporation, USA) for Edge: delivery of notifications to devices on which users have switched them on. The device's browser determines which service delivers them. The service receives the delivery address, the time and the encrypted notification but cannot read its content, and processes the delivery under its own responsibility in accordance with the respective vendor's privacy policy.
• Native push services: Google (Firebase Cloud Messaging, FCM) for the Android app and Apple (Apple Push Notification service, APNs) for the iPhone app. They receive the device token, delivery time and notification content with the listing title, but no message text; Google also processes the Firebase installation ID. Google or Apple can read this content. The services process delivery under their own privacy policies.

These service providers process data either on behalf of Afër or – for example when signing in via Google or Apple – also under their own responsibility in accordance with their own privacy policies.

Beyond this, Afër only discloses personal data to authorities or other third parties where there is a legal obligation to do so or where this is necessary to establish, exercise or defend legal claims.

Afër is operated in Kosovo and is aimed at users in Kosovo and Albania. The database, file storage and server-side functions are operated in the European Union (Frankfurt am Main, Germany).

Several of the service providers named are based in the USA or use locations outside Kosovo, Albania and the European Union for operation, delivery and support. Personal data may therefore be transferred to these countries or become accessible from there.

Where the applicable law requires special safeguards for such transfers, Afër relies on the contractual data protection terms of the respective providers, in particular standard contractual clauses, or on other bases permitted under the applicable law.

Afër stores personal data only for as long as is necessary for the respective purposes or where legal obligations require longer retention.

As a rule, account and profile data are stored for as long as the account exists. Listings, messages, transaction confirmations, reviews, reports and security and log data are deleted or anonymized as soon as they are no longer needed for their purpose.

Users can request the deletion of their account in the settings under “Delete account”. Before the request they confirm their identity again. With the request the account is blocked immediately; the profile, listings and images are no longer publicly visible. The request cannot be withdrawn.

Within 30 days of the request at the latest, Afër deletes the account, the associated data and the images. The people the account talked to keep their conversation with the deleted account read-only for up to 12 months after the last message. Reviews written by the deleted account remain as a number without a name. Afër keeps individual records, for example about reports, confirmed transactions and the acceptance of the terms of use, for as long as is necessary to handle violations or for legal reasons, and deletes them afterwards.

Afër confirms the request by e-mail with a reference. Anyone who cannot delete their account themselves, for example because it is suspended, writes to info@aferteje.com; Afër verifies the identity and starts the deletion.

Users can delete data stored in browser storage on their own device (see “Cookies and browser storage”) themselves at any time via their browser settings.

The service providers used store technical logs and backups in accordance with their own retention periods.

Under the applicable data protection law, in particular Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo and Law No. 124/2024 on Personal Data Protection of the Republic of Albania, data subjects have in particular the following rights to the extent provided for therein:

• access to the data processed about them;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests.

Consent given can be withdrawn at any time with effect for the future. Consent to Google Analytics can be withdrawn via “Cookie settings” at the bottom of the page.

Requests can be sent to info@aferteje.com. To ensure that data is not disclosed to unauthorized persons, Afër may request reasonable proof that the request comes from the data subject, for example a request sent from the email address stored in the account.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority, in particular with:

• the Agjencia për Informim dhe Privatësi (Information and Privacy Agency), Prishtina, Kosovo;
• the Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (Commissioner for the Right to Information and Personal Data Protection), Tirana, Albania.

Publicly accessible areas of Afër can be used without providing personal data. A user account requires an email address or the data of a supported external sign-in provider, the login credentials, the 18+ self-confirmation and acceptance of the terms of use. Without this information, no account can be set up and the account-based functions cannot be used.

Afër updates this privacy notice when functions, service providers used or legal requirements change. The version published on Afër at the time in question is authoritative. Registered users will be informed of material changes in an appropriate manner.