Privacy Policy
This explains what we do with personal data — yours as a member, and also that of landlords and agents whose listings pass through our system. It is written under the GDPR (Regulation (EU) 2016/679) and Czech Act No. 110/2019 Coll.
The short version. We store your search preferences and almost nothing else. We do not keep your chat history. We set no cookies and run no analytics or tracking anywhere — not on this website, not in the bot. Your data sits in a database in the EU. We never sell it or share it for advertising. One command, /delete_my_data, erases it.
Contents
- Who is responsible
- What we collect from members
- What we never collect
- Messages you send us
- The waitlist form
- If you're a landlord or agent
- Who else handles data
- Data outside the EU
- How long we keep things
- Your rights, and how to use them
- Automated processing
- Security
- Age
- Complaining to the regulator
- Changes to this policy
1. Who is responsible
The controller of your personal data — the one who decides what is collected and why, and who answers for it — is:
- Controller
- PraguePad — a self-employed trader (OSVČ) identified by the IČO below
- IČO
- 07446195
- Registered address (sídlo)
- Korunní 2569/108, Vinohrady, 101 00 Praha 10
Contact for anything about data: hello@praguepad.cz. We are a small operation and there is no separate Data Protection Officer — we are not required to appoint one, and that email reaches the person actually responsible.
2. What we collect from members
Everything below comes either from your answers in the bot or from the fact of using the service. We do not buy data about you or enrich it from other sources.
| What | Why | Legal basis |
|---|---|---|
| Telegram user ID and first name | To know who you are and where to send your alerts. The ID is the only identifier the service really needs. | Performance of the contract, Art. 6(1)(b) |
| Your search profile — budget, districts, layout, minimum size, move-in date, pets, furnishing, whether you are a student, whether you need permanent-residence registration (trvalý pobyt), language | This is the whole product: it is what each new listing is matched against. | Performance of the contract, Art. 6(1)(b) |
| Membership status — trial used, paid-until date, pauses, whether you asked us not to contact you | To run your access, stop when it expires, and respect your choices. | Performance of the contract, Art. 6(1)(b) |
| Alert history — which listings we sent you and when, and your taps ("not for me", "report scam") | So we never send the same flat twice, can retry a failed delivery, and can improve matching. | Performance of the contract, Art. 6(1)(b) |
| Email address — only if you give us one (at checkout, or by writing to us) | To send a receipt, answer you, or reach you if Telegram fails. | Contract, Art. 6(1)(b); legal obligation for payment records, Art. 6(1)(c) |
| Payment records — amount, date, payment reference, payer email from Stripe | To activate your pass, and because tax and accounting law requires us to keep records of income. | Legal obligation, Art. 6(1)(c) |
| Consent record — the time you accepted, and the version of this policy | To prove we told you what we do with your data, which the GDPR requires us to be able to show. | Legal obligation, Art. 6(1)(c) |
| Technical logs — errors, delivery failures, timings, and internal events recorded against an anonymous internal ID | To keep the service running and to diagnose faults. These deliberately carry no name and no Telegram ID. | Legitimate interest in a working, secure service, Art. 6(1)(f) |
3. What we never collect
- No stored chat history. The bot reads your messages to act on them; it does not archive the conversation. (One narrow exception is in section 4 — please read it.)
- No card details, ever. Payment happens on Stripe's own page. We receive confirmation that money arrived and the payer's email — never a card number.
- No cookies, no analytics, no tracking pixels, no advertising networks on this website or in the bot. There is no cookie banner here because there is nothing to consent to.
- No location tracking, no contacts, no device fingerprinting.
- No special-category data — we never ask about health, ethnicity, religion, politics or anything similar. Please do not send it to us.
- We do not sell, rent or trade personal data. Not to landlords, not to agencies, not to anyone.
4. Messages you send us
Two things you can do in the bot involve content you have written, so we want to be exact rather than reassuring:
/help your message— this forwards your message, together with your first name and Telegram ID, to our private internal support channel on Telegram, so we can answer you. That is the point of the command, and it is the one case where something you typed is passed on rather than acted on and dropped.- Forwarding a listing link — if you send us a link to check, we fetch that public page and run our scam checks on it. We keep the listing data (which is public), not a record of your private browsing.
Support conversations stay in our internal channel while we deal with them and are cleared out when they are no longer needed. Please do not send us documents, ID scans or bank details — we do not need them and do not want them.
5. The waitlist form
If you signed up through the form on our homepage, we collect the name, email address and optional description of what you are looking for that you typed in, on the basis of your consent (Art. 6(1)(a)). We use it only to contact you about PraguePad — your spot, your setup, launch news.
That form is delivered by Formspree, Inc. (United States), which processes the submission on our behalf. You can withdraw your consent and have the entry deleted at any time by emailing us; withdrawal does not affect what we did lawfully beforehand. We keep waitlist entries for up to 24 months from your signup, or until you ask us to remove you.
We do not send marketing messages to members through the bot. Under Czech Act No. 480/2004 Coll. you can refuse commercial messages at any time, and we record that refusal against your account so it is honoured.
6. If you're a landlord, agent or advertiser
You did not sign up with us, so this section is your notice under Art. 14 of the GDPR. It matters, and most services in this field do not tell you at all.
What we hold. When you publish a rental advertisement on a public Prague portal, our system reads that public listing and stores it: the address or street, price, size, description, photographs, and any contact telephone number or email address published in the advertisement. Where a listing shows signs of fraud, or is reported to us as fraudulent, we may also record the relevant marker — a phone number, an email address, a name, an address, or a fingerprint of a photograph — in an internal scam register.
Why, and on what basis. We process this in our legitimate interests and those of our members (Art. 6(1)(f)): to tell members about available flats, to remove duplicate copies of the same advertisement, and — for the scam register — to prevent fraud against consumers, which the GDPR expressly recognises as a legitimate interest (Recital 47). We do not use your details for marketing and we never sell them.
Where it comes from. Publicly accessible rental portals — currently Sreality, Bezrealitky and iDNES Reality — and reports from our members.
Who sees it. Listing contact details are shown only to members whose search matches that flat, in the alert card, exactly as published. The scam register is internal and is not published.
Your rights. You can ask us what we hold about you, ask us to correct it, ask us to delete it, and object to the processing at any time — including to being recorded in the scam register. Write to hello@praguepad.cz and we will deal with it within one month. If you tell us an entry is wrong, we will review it and, unless we have solid evidence to the contrary, remove it. You can also complain to the regulator (section 14).
7. Who else handles data
We use a small number of established providers. They process data on our instructions under data processing agreements, except where noted that they act on their own account.
| Provider | What they do | Where |
|---|---|---|
| Neon | Hosts our database — this is where your profile lives | EU region (Europe); company based in the US |
| Vercel | Hosts this website and the application | Servers in Frankfurt, Germany; company based in the US |
| Telegram | Delivers every message and alert. Telegram is not our processor — it runs your messenger account on its own terms and its own privacy policy, which we do not control. | Outside the EU |
| Stripe | Takes payments and handles card data. Stripe is a separate controller for the payment itself. | Stripe Payments Europe (Ireland), with Stripe, Inc. (US) |
| Apify | Runs the programs that collect public listings. Never receives any member data. | Apify Technologies s.r.o., Prague, Czech Republic |
| Formspree | Delivers the waitlist form on our homepage only | United States |
| UptimeRobot | Checks every few minutes that the service is alive. Sees no personal data. | EU |
We may also disclose data where the law requires it — for example to a public authority acting within its powers.
8. Data outside the EU
Your profile and our database are held in the EU. Some providers above are US companies, and messages you exchange with the bot necessarily pass through Telegram's infrastructure outside the EU. Where personal data is transferred outside the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or another safeguard permitted by Chapter V of the GDPR.
If you would rather not send personal information through a non-EU messenger, that is a decision to make before you use a Telegram-based service — we cannot deliver alerts to you without Telegram.
9. How long we keep things
| What | How long |
|---|---|
| Your profile and alert history | While you are a member. When you delete, it is hidden immediately and permanently erased 30 days later — profile, alerts and feedback together. |
| A lapsed membership you never came back to | Deleted automatically 12 months after it expired, then permanently erased 30 days after that. |
| An interview you started but never finished | Deleted after 30 days. |
| Payment and accounting records | As long as tax and accounting law requires — up to 10 years. We cannot delete these on request; the obligation to keep them overrides erasure. |
| Technical event logs | Retained for diagnosis, identified only by an internal ID that no longer maps to anyone once you are erased. |
| Waitlist entries | Up to 24 months, or until you ask us to remove you. |
| Listings and scam register entries | See the note below. |
An honest note about listings. Advertisement records — including contact details published in them — and scam-register entries are currently kept without a fixed deletion date, because they are what makes duplicate detection and fraud prevention work over time. We would rather tell you that plainly than claim a schedule we do not operate. We are working on a defined retention period for both, and in the meantime any landlord or agent can ask us to remove their details under section 6.
10. Your rights, and how to use them
Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on it.
Most of it is built into the bot, so you do not have to ask anyone's permission:
/profile— see everything we hold in your search profile/privacy— the short version of this policy/pause— stop all processing for alerts;/resumeto start again/delete_my_data— erase your profile and alert history, after one confirmation
For anything else — a full copy of your data, portability, a correction, or an objection — email hello@praguepad.cz. We reply within one month, free of charge. We may ask you to confirm your Telegram account so we do not hand your data to someone else.
11. Automated processing
Two parts of the service run automatically:
- Matching — each new listing is compared against your saved preferences to decide whether it is worth sending you.
- Scam checks — rules and the scam register score each listing. A listing can be flagged with a warning, or withheld from delivery entirely.
Neither makes a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 of the GDPR — the worst outcome for a member is a flat alert you did not receive, and you can always search the portals yourself. If you believe a listing of yours was wrongly withheld or flagged, write to us and a human will look at it.
12. Security
Access to the database is restricted and authenticated; traffic is encrypted in transit; secrets and tokens are held in the hosting provider's encrypted storage, not in our code. Only the operator of PraguePad has access to member data. Internal event logs are deliberately written with an anonymous ID instead of your name or Telegram ID, so that a leak of the logs alone would not identify anyone.
No system is perfectly secure. If a breach ever occurs that is likely to result in a high risk to your rights, we will tell you, and we will notify the Office for Personal Data Protection within 72 hours as the GDPR requires.
13. Age
PraguePad is for adults renting flats. It is not intended for anyone under 18, and we do not knowingly hold data about children. If you believe a child has given us data, tell us and we will delete it.
14. Complaining to the regulator
Please try us first — hello@praguepad.cz — but you always have the right to complain to the Czech supervisory authority:
| Authority | Úřad pro ochranu osobních údajů (Office for Personal Data Protection) |
|---|---|
| Address | Pplk. Sochora 27, 170 00 Praha 7, Czech Republic |
| posta@uoou.gov.cz | |
| Phone | +420 234 665 111 |
| Web | uoou.gov.cz |
If you live in another EU country, you may also complain to your own supervisory authority.
15. Changes to this policy
When we change this policy we publish the new version here with a new version date at the top, and we record which version you accepted. If a change materially affects how we use your data, we tell you in the bot before it takes effect. Previous versions are available on request.
Contact
Anything at all about your data: hello@praguepad.cz. See also our Terms of Service.