Confidentiality policy: controller and roles
The person identified on the Legal details page controls account, website, security, support and access-management data. It processes entered CRM data under the agreement's CRM section. Send requests to the stated email or address; proportionate identity verification may be required.
Data and sources
Data come from users and their agencies, Telegram and public listing sources, and, after card payment is enabled, Flitt. They include email, Telegram ID and profile, language, password hash, sessions, legal acknowledgements, filters and search history, subscriptions, channels, CRM contacts and notes, plan and trial, support and technical events. Listings may contain public seller contacts. After integration, payment data will include amount, currency, status, identifier and bank-provided masked information. BotRE does not store plaintext passwords, full card numbers or CVV.
Purposes and grounds
Contract and pre-contract steps: account, search, delivery, CRM and access. Legitimate interests: security, abuse prevention and reliability, balanced against individual rights. Legal duties: required records and authorised requests. Consent is used only where required. Accepting Terms and reading Privacy is not blanket consent for any purpose. Without required identity, contact or functional data, the relevant feature is unavailable; additional information is optional.
Recipients
Access is limited to authorised staff and hosting, storage, backup and monitoring providers. Telegram receives data for connected functions; Resend receives the address and service email. The planned Flitt payment integration is described below; payment data are not currently transferred through it. Property sources receive query parameters, not CRM contacts. Agency staff see data within their permissions. Advisers and authorities receive data on a lawful basis. Personal data are not sold for advertising.
Processing outside Georgia
Hosting, Telegram, email and monitoring providers may process data outside Georgia. Transfers require grounds and safeguards under Georgian law; this policy does not automatically certify any provider's safeguards. Specific recipients, countries and transfer grounds are available from support.
Retention and deletion
Accounts and CRM are retained for the service; account deletion irreversibly deletes working data. Scheduled cleanup: completed searches and subscription runs — 90 days; completed notification queues — 30; listing cache — 180; duplicate-delivery keys — until the subscription or parser profile is deleted; security events — 180; active web session — up to 30 days. Trial protection may be retained for up to two years. Backups expire through rotation and are not an active CRM. Necessary records for a legal duty or dispute remain until that basis ends; ask for the applicable period. Completed parser-run history is retained for 30 days, completed deliveries for 90, and unused full listing cards for 90 days after their last appearance, but only after associated deliveries have been cleared.
Rights and requests
As provided by law, request information and copies, correction, deletion, blocking, cessation or portability; object where applicable and withdraw specific consent without affecting prior processing. Statutory deadlines apply; the usual information period is ten working days, extended only as allowed by law with notice. Account settings support available changes and session revocation. For CRM data, contact the agent or agency first; BotRE assists the controller. Complaints may be filed with Georgia's State Audit Office or a court.
Security and changes
We use protected transmission, access restrictions, sign-in protection and backups. Absolute security is not guaranteed. Statutory incident notifications are made when required. Report suspicious access to support. Updates are dated and material changes communicated. The Cookie Policy covers browser storage.
Flitt: planned payment processing
Card payment is not yet enabled. The planned provider is Flitt, operated by Tpay LLC (identification number 402291220). When enabled, only payment and payer information necessary for the transaction, reconciliation, fraud prevention or legal duties will be exchanged. Exact required fields will be explained before purchase; free registration does not collect extra payer information. CRM contacts, client notes and search filters are not sent to the payment provider. Flitt also processes data for its own payment and legal duties under its privacy terms. Its documents envisage processing in Georgia, Germany and countries of payment systems; roles and lawful transfer safeguards must be confirmed before integration. BotRE will retain only necessary records, identifiers and masked information, never full card numbers or CVV.