Privacy policy

1. Controller

The Ruudud24 service is operated by Securesoft OÜ, registry code 17530831, address Sääse tn 5, Mustamäe linnaosa, 12918 Tallinn, Harju maakond. For questions concerning personal data and privacy, contact info@ruudud24.ee.

2. Data we process

Depending on how the service is used, we process account data (name, email address, one-way password hash, technical identifier for Google sign-in), session data, favourites, listing content and contact details, photos and their technical metadata, registry and address data, technical payment references, invoice recipient name, invoice email and, for a company invoice, the company name and registry code, as well as electronic invoice, consumer-withdrawal statement/confirmation, refund and credit-note data, moderation reports, the content of enquiries sent to advertisers and the sender's contact details, and technical logs required to operate the service. For portal usage statistics, a period-specific HMAC hash is created from the IP address and technical browser headers; the raw IP address is not stored in the analytics table.

If the user chooses My location, the browser provides the device coordinates only when the user presses the location control so Ruudud24 can determine the Estonian municipality/city and, where available, the district. Exact coordinates are processed only for this lookup and are not stored as a location preference. The remembered preference contains only the Estonian area.

Ruudud24 does not store a user's password in readable form or their Google password. For local password sign-in, only a salted one-way password hash is stored. Ruudud24 also does not store the payment-card or internet-bank authentication data used in Maksekeskus.

3. Why we use data

• creating accounts, signing users in and managing secure sessions;
• creating, publishing, editing, expiring and renewing listings free of charge;
• providing favourites and account self-service;
• initiating the €1.99 featuring payment, checking payment and refund status, recording and confirming consumer withdrawals, and creating and sending the related accounting invoice or credit note;
• preventing fraud, abuse and security incidents;
• handling user reports and moderation decisions;
• forwarding an interested person's enquiry to the advertiser of the selected listing;
• compiling aggregate statistics about portal use and listing views;
• monitoring service reliability, fixing errors and fulfilling legal obligations.

4. Legal bases

The legal basis for core service functions and account processing is performance of the service agreement with the user. For security, prevention of abuse, logging and service development, we rely on legitimate interests. For accounting and official requirements, we process data to comply with legal obligations. If a future function requires consent, we will ask for it separately.

5. Service providers and recipients

To operate the service, data may be processed to the necessary extent by the server and object-storage provider, email service provider, Google for sign-in, the email service provider for account verification and password links, Google Maps for the map view, and Cloudflare Turnstile for bot and abuse protection when opening contact details or adding a listing. To enrich address and technical property data, requests are made to Estonian public address, cadastre and Building Register services. When My location is used, the coordinate is processed transiently through the public Estonian address service to determine the administrative area.

Securesoft OÜ is the controller of personal data related to payments and transfers the personal data required to make payments to its processor, Maksekeskus AS. Maksekeskus processes data to initiate and confirm payments, prevent fraud and perform other operations necessary to provide payment services. Ruudud24 does not receive access to the user's internet-bank or payment-card authentication data.

The name, email address, phone number (if provided) and message entered in the contact form are sent to the advertiser of the specific listing. Ruudud24 does not store the content of the contact enquiry in a separate database; the message passes through the email service provider and remains in the recipient's mailbox according to that recipient's email retention rules.

When a listing is published, its address and content added by the user become publicly visible. The advertiser's phone number is released only after a Cloudflare Turnstile security check; when the contact form is used, the same check is not repeated separately within the form.

6. Retention

• a manually created active listing is valid for 30 days at a time; if it is hidden, marked completed or expires, the listing and its photos are retained for up to one year from becoming inactive so the user can republish it, after which they are automatically deleted; a reminder is sent where possible about 30 days before permanent deletion;
• imported listings are governed by the source-feed synchronisation and removal checks instead of the manual-listing expiry and one-year retention cycle;
• unfinished drafts and uploads are automatically cleaned up after the technical retention period;
• sessions expire and expired sessions are deleted;
• when an account is deleted, the account, OAuth connections, sessions, favourites, the user's listings and their photos are deleted;
• payment and invoice accounting records, including invoice recipient data, are retained for the statutory accounting retention period (generally seven years from the end of the relevant financial year);
• resolved or rejected moderation reports are deleted by default after 180 days; longer retention is possible only where required by a specific dispute or legal obligation;
• period-specific visitor HMAC hashes are retained only for deduplication until the end of the active day or month plus a short technical buffer; the hash used to deduplicate repeated listing opens for up to two hours; daily listing statistics for up to 70 days; and aggregate counts for as long as the listing exists.

7. Security

The application uses HTTP-only session cookies and, in production, Secure cookies, OAuth state validation, request rate limits, access-controlled S3 storage, short-lived signed image links and limited database connections. Images are uploaded directly to object storage and the application validates the file type before publication.

8. Cookies and local storage

Ruudud24 uses a session cookie that is necessary for sign-in. Usage statistics do not create a tracking cookie or store a persistent analytics identifier in the browser. Ruudud24 does not use advertising or marketing cookies. If the user enables My location, the selected Estonian area is stored in that browser's localStorage so it can be used on future visits; exact coordinates are not stored there. When the map, external authentication service or Cloudflare Turnstile bot protection is used, those third-party services may process technical data under their own terms.

9. Your rights

Subject to applicable law, you have the right to request access to your data, correction of inaccurate data, erasure, restriction of processing, to object to processing, and to request data portability. You can delete your account yourself in Account settings. For other requests, contact info@ruudud24.ee. You also have the right to contact the Estonian Data Protection Inspectorate or a competent court.

10. Changes

We may update this policy if the service, service providers we use, or legal requirements change. We will provide reasonable notice of material changes.