Privacy Policy

Last updated: 27 October 2026

Translations of this policy are provided for convenience. This English version is always the most current one and prevails if the versions differ.

Data Controller: DailyMind LTD, HE 439959, Idaliou 19, Galaxia Court Flat 201, 3021 Limassol, Cyprus

Contact: info@research.cy

1. What we collect

We collect only what is necessary to operate the service:

Inquiry form (property pages, until 27 October 2026; replaced by purchase help): your name, contact details (email, phone, or messenger), and your message. Used to connect you with the property seller or developer.
Newsletter/waitlist sign-up: email address. Stored in Resend (US-based email delivery service, operating under EU Standard Contractual Clauses). We do not share your email with third parties or use it for third-party marketing.
Checklist lead forms: email address and optional city, planned move-in month, and rental stage. Used to send the requested checklist and understand rental demand by area.
Account: your email address and a one-time login code, the favourites and saved searches you create, and the date and version of the Terms of Service you accepted.
Subscription (€9.99 per month): payments are handled by Stripe. We never see or store your card details. We store your Stripe customer ID and the date your paid access ends.
"Help me with the purchase" requests (free): your first name, last name, phone number with country code, your account email (confirmed with a one-time code; we create the account if you have none), the property you asked about, and a search profile derived from it (buy or rent, budget, region, bedrooms). The agent handling your request may add notes and the next follow-up date.
"Show me the direct links" clicks: the property, the time and, if you are signed in, your account. Used to measure interest in the subscription (legitimate interest, Art. 6(1)(f)); deleted after 12 months.
Analytics — Umami (no consent required): We use Umami, a cookie-free, privacy-focused analytics tool self-hosted on our own server at u.vigilcom.dev (currently shared instance with expats.cy). Umami collects aggregate data only: page views, referrer URL, device type, browser, and country. It does not set any cookies, does not collect personal data, and does not track individual users across sessions. No consent is required under ePrivacy Directive Art. 5(3) because no information is stored on or read from your device.
Analytics — GoatCounter (no consent required): GoatCounter for lightweight, cookieless page view counting. GoatCounter is self-hosted within the EU (Hetzner, Germany), open-source, does not use cookies, does not collect personal data, and does not track individual users.
Behaviour analytics — Microsoft Clarity (consent required): Microsoft Clarity records heatmaps and anonymized session replays (clicks, scroll depth, mouse movements, page interactions) to help us improve usability. Clarity is loaded only after you give consent via the cookie banner. If you decline, no Clarity data is collected. See Microsoft's Privacy Statement.
Server logs: standard HTTP logs (IP address, request path, timestamp, user agent) retained for 30 days for security and debugging. No personal profiling.

2. Why we collect it

Inquiry form: to forward your message to the relevant property seller or developer so they can respond to you.
Newsletter email: to send weekly property market updates and platform news only when you opt in. You can unsubscribe at any time by emailing info@research.cy. We do not sell or share your email with third parties. No third-party marketing.
Checklist delivery: to send the specific checklist you requested by email. A checklist request is not newsletter consent.
Account and subscription: to log you in, keep your favourites and saved searches, and give paid features to subscribers.
Purchase help requests: to pass your request to a real estate agent of CYPRUSINVEST.ONE, who contacts you (by phone or WhatsApp) to help you buy that property. We alert the agent through Telegram, but the alert carries no personal data: it only links to the property and to the agent's cabinet on research.cy, where your details stay.
Analytics (Clarity): to understand which features interest visitors and improve the product. Collected only with consent.
Analytics (Umami): to measure aggregate traffic patterns (page views, popular pages, traffic sources). No personal data is collected; no consent is needed.
Server logs: to maintain security and investigate abuse.

3. Legal basis (GDPR Art. 6)

Consent (Art. 6(1)(a)) — for analytics cookies (Clarity) and marketing emails (newsletter).
Legitimate interest (Art. 6(1)(f)) — for server logs, security, cookie-free aggregate analytics (Umami), and forwarding inquiry form submissions to property sellers.
Contract performance (Art. 6(1)(b)) — for inquiry form processing (you request information about a property, we facilitate the connection), your account, your subscription, and purchase help requests (steps you ask us to take).

4. Cookies

We use the following cookies:

cookie_consent — stores your cookie preference (accept/decline). Strictly necessary, no consent required. Duration: 365 days.
_clck — Microsoft Clarity cookie that stores a unique user identifier. Set only if you accept analytics cookies. Duration: 12 months.
_clsk — Microsoft Clarity cookie that connects page views into a single session recording. Set only if you accept analytics cookies. Duration: 1 day.

Umami does not set any cookies. It is loaded on every page without requiring consent.

No advertising cookies. No third-party tracking pixels. No Google Analytics.

5. Data processors and sharing

We do not sell your data. We share data only with the following processors:

Resend, Inc. (US) — email delivery for inquiry form submissions, login codes and newsletter. Resend processes email addresses and message content on our behalf. Data may be transferred to the US under EU Standard Contractual Clauses (SCCs). See Resend's Privacy Policy.
Microsoft Corporation — Clarity behaviour analytics data (heatmaps, session replays), only if you consent. Data may be transferred to the US under EU-US Data Privacy Framework. See Microsoft's Privacy Statement.
Hetzner Online GmbH (Germany) — our server provider. Data processing agreement in place.
Cloudflare, Inc. (US) — DNS and content delivery proxy, plus Cloudflare Web Analytics for cookie-free aggregated page-performance metrics, and Cloudflare Turnstile, which checks that the login and purchase help forms are used by a person (it processes your IP address and browser signals for that check). Cloudflare may process IP addresses and request metadata as part of its proxy service. Data may be transferred to the US under EU-US Data Privacy Framework. See Cloudflare's Privacy Policy.
DeepSeek (China) — translation of property listing descriptions between languages. Only public listing text is sent (never personal data). No EU adequacy decision exists for China; processing is limited to non-personal property data that is already publicly available on developer websites.
Anthropic, PBC (US) — content generation and data structuring for property listings. Only public listing text is sent (never personal data). Data may be transferred to the US under EU-US Data Privacy Framework.

Umami analytics data is self-hosted on our own server and is not shared with any third party.

Recipients that are not our processors:

Stripe — processes your payment on our behalf, and also uses payment data for its own purposes such as fraud prevention and legal compliance, as an independent controller. See Stripe's Privacy Policy.
CYPRUSINVEST.ONE and the independent real estate agents working with it — receive the data of your purchase help request (name, phone, email, property, search profile) so an agent can contact you. They are independent businesses and separate data controllers for their own work with you. If you talk to an agent on WhatsApp, WhatsApp's own privacy terms apply to that chat.

6. AI and automated processing

Property listing data (descriptions, features, locations) is processed using automated tools to improve the platform:

DeepSeek — for translating property descriptions between languages (Russian, English, Arabic).
Anthropic Claude — for content generation and data structuring.

Only property listing text is sent to these AI providers. Your personal data (name, email, phone, messages) is never sent to AI providers. No automated decision-making affects you as defined in Art. 22 GDPR. AI processing is used solely to improve listing quality and availability across languages.

7. Data retention

Inquiry form data: retained for 12 months, then deleted automatically.
Account data: kept while your account exists; email info@research.cy to delete it.
Subscription data: your Stripe customer ID and paid-until date are kept while your account exists. Stripe keeps its own payment records under its policy.
Purchase help requests and the related contact record: kept while the request is being handled, then deleted automatically 12 months after it is closed (completed or abandoned).
Backups: deleted data disappears from our server backups within 8 days.
Newsletter data: retained in Resend until you unsubscribe.
Checklist lead data: retained in Resend and internal lead notifications for up to 12 months. To delete it, email info@research.cy.
Property listing data: retained as long as the source listing is active. Removed when the source listing is taken down.
Clarity analytics: 30 days (Microsoft default retention for session recordings and heatmaps).
Umami analytics: retained indefinitely as aggregate statistics on our own server. No personal data is stored.
GoatCounter: anonymous page view data retained indefinitely on our own server. No personal data is stored.
Server logs: 30 days.

8. Your rights

Under GDPR, you have the right to:

Access your data (Art. 15)
Rectify inaccurate data (Art. 16)
Delete your data (Art. 17) — "right to be forgotten"
Restrict processing (Art. 18)
Data portability (Art. 20)
Object to processing (Art. 21)
Withdraw consent at any time (Art. 7(3))

To exercise any right, email info@research.cy. We will respond within 30 days.

You also have the right to lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy).

9. Security

Data is transmitted over HTTPS (TLS 1.2+). The database is not publicly accessible. Access is restricted to authorized personnel only.

10. Changes

We may update this policy. Material changes will be communicated via the newsletter email. The "Last updated" date at the top reflects the latest revision.

11. Additional disclosures

We have not appointed a Data Protection Officer as we do not engage in large-scale processing of special categories of data (Art. 37(1) GDPR).

Providing your personal data is not a statutory or contractual requirement. You can use the property search without providing any personal data. Personal data is only needed if you want to send an inquiry, create an account, subscribe, or request help with a purchase.

Other languages: Политика конфиденциальности (RU) • سياسة الخصوصية (AR)