Privacy Policy
Effective date: November 11, 2026
This Privacy Policy explains how Bayitoo ("Bayitoo", "we", "us") collects, uses, shares and protects personal information when you use https://bayitoo.com and our related services, applications, emails and newsletters (the "Service"). It should be read together with our Terms of Use. By using the Service you acknowledge this Policy.
1. Who is responsible for your data
Bayitoo, [Company address, Israel], is the controller (database owner) of the personal information described here. You can contact us about privacy at info@bayitoo.com.
2. Information we collect
2.1. Information you give us
- Account information: name, email address, telephone number, password (stored only in encrypted/hashed form), language and currency preferences, and, for professionals, company name, licence number and a short biography.
- Verification information: records that confirm that you control your email address (for example, verification tokens and the time of verification) and your acceptance of our Terms.
- Listing and Project content: property details, addresses, map locations, descriptions, prices, photographs, videos, documents, and contact details you choose to display, including names and telephone numbers. This content is public once published.
- Inquiries and messages: the details and message you send to an Advertiser or to us through contact forms, and our replies.
- Saved items: favourites, saved searches, alert settings and recently viewed properties.
- Payment information: when you pay, the payment is handled by our payment provider (currently Stripe). We receive confirmation, amount, date, plan and a payment reference, and may receive limited details such as billing name and email. We do not receive or store your full card number.
- Subscriptions and preferences: your email address and language for newsletters, and your unsubscribe choices.
- Support and communications: anything else you send us.
2.2. Information collected automatically
- Usage and device data: pages visited, search filters used, referring page, date and time, browser type and version, device type, language, and the IP address from which you connect. For visitor statistics we store a one-way hashed identifier derived from your IP address and the date rather than your raw IP address.
- Security logs: sign-in attempts, IP address and browser details, used to detect abuse and protect accounts.
- Cookies and similar technologies: see section 7.
- Location: we do not track your precise device location. Searching on the map uses the area you choose to display. If you enter an address when creating a Listing, we use it to place the pin on the map.
2.3. Information from others
We may receive information from payment providers (such as payment status), email-delivery providers (such as delivery, open, click, bounce and complaint events), social networks when you interact with our pages, and Advertisers or other Users who submit information that relates to you (for example, a Listing that names you as the contact).
3. How and why we use information
| Purpose | Legal basis (where GDPR or similar laws apply) |
|---|---|
| Create and manage your account; verify your email; authenticate you; provide the Service you requested | Performance of a contract |
| Publish and moderate Listings; display them to the public; send your inquiries to Advertisers | Contract; legitimate interests |
| Send service messages (verification, security, receipts, listing status, requested alerts) | Contract; legitimate interests |
| Process payments and keep accounting records | Contract; legal obligation |
| Send newsletters and marketing, with your consent where required | Consent; legitimate interests (where permitted) |
| Operate, secure and improve the Service; analytics; prevent fraud, spam, scraping and abuse; enforce our Terms | Legitimate interests; legal obligation |
| Personalise language, currency and recommendations | Legitimate interests; consent where required |
| Comply with law, respond to authorities, and establish, exercise or defend legal claims | Legal obligation; legitimate interests |
We do not use your personal information to make decisions that produce legal or similarly significant effects solely by automated means.
4. What is public
Content you publish in a Listing or Project (including photographs, descriptions, prices and any name, telephone number or email address you include) is visible to anyone on the internet, can be copied by third parties, may appear in search-engine results, and may remain in caches or archives after removal. Do not include personal information in a Listing unless you want it to be public. We may also share Listings on our social-media channels, newsletters and partner channels.
5. How we share information
We do not sell your personal information. We share it only as follows:
- With Advertisers and agents: when you send an inquiry, we give them your name, contact details and message so they can respond.
- With service providers that process data on our behalf and are bound by confidentiality and security obligations, such as: web hosting and infrastructure; email delivery (Mailgun); payment processing (Stripe); content and image delivery; map and geocoding services (OpenStreetMap tile servers and Nominatim, which receive your IP address and the places you search); and artificial-intelligence service providers that we use for editorial and translation tasks (we do not send account or contact data for this purpose).
- Social networks: when we publish content on our own pages, or when you choose to share a page.
- Legal and safety: where we believe disclosure is required by law, court order or authority request, or necessary to protect the rights, property, safety or security of Users, us or the public, to prevent fraud or abuse, or to enforce our Terms.
- Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, in which case the recipient will be bound to protect your data consistently with this Policy.
- Aggregated or de-identified data: statistics that cannot reasonably identify you may be shared or published.
- With your consent or at your direction.
6. International transfers
We are based in Israel, and our providers may process data in Israel, the European Economic Area, the United States and other countries. Where personal data is transferred from the European Economic Area, the United Kingdom or elsewhere to a country without an equivalent level of protection, we rely on lawful transfer mechanisms such as adequacy decisions (the European Commission has recognised Israel as providing adequate protection), standard contractual clauses or other safeguards recognised by law. Contact us to request more information.
7. Cookies and similar technologies
We use a small number of cookies and local-storage items that are necessary for the Service to work or that remember your choices:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in, protects forms against forgery (CSRF), and remembers items during your visit | Session (up to a few hours of inactivity) |
| Language and currency preferences | Remember the language and currency you select | Up to 1 year |
| "Remember me" token | Keeps you signed in on your device if you choose that option | Up to 30 days |
We do not use third-party advertising cookies. Our visitor statistics are generated on our own servers. Embedded third-party content (for example YouTube or Vimeo videos, maps, or social-media buttons) may set its own cookies, subject to that provider's policy. You can block or delete cookies in your browser settings, but parts of the Service (such as signing in) will not work without the necessary cookies.
8. Marketing and your choices
You can unsubscribe from newsletters at any time using the link in each email or by contacting us. You can change or stop saved-search alerts in your account. We will still send essential service messages. You can update your profile information in your account at any time.
9. How long we keep information
We keep personal information only as long as needed for the purposes described, and then delete or anonymise it. Typical periods: account data - while your account is active and for a reasonable period afterwards for legal and security purposes; accounts that are never verified - deleted after about 14 days; Listing content - while published, and in backups and records for a reasonable period afterwards; inquiries and messages - as needed to handle the matter and for our legal records; sign-in security logs - about 90 days; visitor statistics - up to about 13 months; payment and accounting records - for the period required by tax and accounting law (generally seven years in Israel); newsletter data - until you unsubscribe, after which we keep a record that you opted out. We may keep information longer where required by law or to establish, exercise or defend legal claims.
10. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, access controls, security logging, rate limiting, input validation and regular backups. However, no system is completely secure, and we cannot guarantee absolute security. You are responsible for choosing a strong, unique password and for keeping it confidential. If a security incident affects your personal information, we will notify you and the authorities as required by law.
11. Your rights
Depending on where you live, you may have the following rights, which you can exercise by contacting info@bayitoo.com:
- Access to the personal information we hold about you (for example, under the Israeli Protection of Privacy Law, 1981) and a copy of it.
- Correction of information that is inaccurate, incomplete or out of date. Much of your information can be edited in your account.
- Deletion of information (including the right to request that we delete or restrict our use of it), subject to legal exceptions.
- If the GDPR or UK GDPR applies: restriction of processing, portability, objection to processing based on legitimate interests or for direct marketing, withdrawal of consent at any time (without affecting earlier processing), and the right to complain to a supervisory authority in your country.
- If you are a California resident: the rights to know, delete, correct and to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights.
We may need to verify your identity before acting on a request, and we will respond within the time required by law (generally within 30 days). Requests may be declined where the law permits, for example where they affect other people's rights or our legal obligations. Content that you have published and that others have already copied cannot be recalled by us.
You may also complain to the Israeli Privacy Protection Authority (gov.il) or to the data-protection authority where you live.
12. Providing information is voluntary
You are not legally required to provide personal information to us. However, without certain information (for example a verified email address, or the details needed to publish a Listing or process a payment), we may not be able to provide you with all or part of the Service. By providing information, you consent to its collection, storage and use as described in this Policy, to the extent that your consent is required.
13. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
14. Third-party websites and services
The Service may link to third-party websites, advertisers and services that have their own privacy practices. This Policy does not apply to them, and we are not responsible for them. Please review their policies before providing information.
15. Changes to this Policy
We may update this Policy from time to time. We will post the new version with a new effective date and, for material changes, may notify you by email or on the Service. Your continued use of the Service after the update means you accept it.
16. Contact us
If you have questions, requests or complaints about this Policy or our handling of personal information, contact:
Bayitoo
[Company address, Israel]
Email: info@bayitoo.com