← Back to listings

Privacy Policy

Last updated: August 2026

1. Data Controller

The data controller for this service is:
Milano Cerco Affitto
Email: [email protected]
Website: https://milano-cerco-affitto.com

2. What Data We Collect

We collect the following personal data:

• Account data: email address and hashed password when you register.
• Favorites and notes: listings you save and any notes you write about them.
• Push notification token: if you enable notifications in the iOS app, we store the Apple push token for your device so we can alert you to new listings. Tokens for signed-in users are deleted when you delete your account.
• Newsletter address: if you subscribe to the email newsletter, we store your address, the time you subscribed, and the IP address it came from (abuse prevention). Removed when you unsubscribe or delete your account.
• Technical data: IP address (for rate limiting and security), session cookies (for OAuth login flows).

3. What We Do NOT Collect

• We do not use analytics or tracking cookies.
• We do not share your data with third parties for marketing.
• We do not profile you or make automated decisions about you.

4. Legal Basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): processing your account data and favorites is necessary to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): IP-based rate limiting to protect the service from abuse.
• Consent (Art. 6(1)(a)): you consent to this policy when creating an account.

5. Cookies and Local Storage

We use:

• Session cookie (essential): used only during OAuth login flows (Google/Facebook). This is a strictly necessary cookie and does not require consent under the ePrivacy Directive.
• Local storage: your authentication token is stored in your browser's local storage to keep you signed in.
• First-visit cookie (apt_first_visit): records the date of your first visit so the site can tell returning visitors from new ones. It holds a date, not an identifier, is not shared with anyone, and is not used for advertising, analytics or profiling.

We do not use advertising, analytics, or third-party tracking cookies.

6. Listing Data

Where listings are published: on this website, in our iOS app, and in our public Telegram channel. A removal request covers all three.

Apartment listings displayed on this service are collected from publicly accessible Facebook group posts. We display listing details (price, location, images, free-form post text) but actively redact personal contact information before display: phone numbers, email addresses, social media handles, and WhatsApp/Telegram contacts are automatically removed from the visible text. The original poster's name (Facebook profile name) is never stored.

Legal basis: we process this publicly available listing data on the basis of legitimate interest (GDPR Art. 6(1)(f)) — providing a free, search-engine-style aggregator of public rental listings to help people find housing. We have weighed this against the rights of the original posters by (a) only using public posts, (b) automatically redacting personal contact details, (c) never republishing the poster's identity, (d) removing listings from the live feed after at most 72 hours, and (e) honouring removal requests within 48 hours.

Retention: a listing leaves the live feed at most 72 hours after we first see it. Behind that, our scraper holds a non-public working copy for up to 7 days (to re-check whether a listing is still online and to avoid re-alerting on the same post), and we keep up to 50 rolling feed snapshots — roughly two to three weeks — with contact details stripped before writing. If a user has saved a listing to their Favorites, their private copy of it persists until they remove it. Full detail is in section 7.

Removal requests: if you are the author of a listing and want it removed, you have two options:

• Click the "Report" button on any listing card on the website. The listing is queued for removal and we typically take it down within hours.
• Or email [email protected] with the listing URL or a screenshot. We will confirm removal within 48 hours.

Removed listings are added to a permanent block list, keyed to the original post, so the same post is not republished if our scraper encounters it again.

7. Data Retention

• Account data: retained until you delete your account.
• Favorites and notes: retained until you delete them or delete your account.
• Listing data (live feed): a listing disappears from the site at most 72 hours after we first see it.
• Listing data (working copy): our scraper keeps a working copy of collected posts for up to 7 days so it can re-check whether a listing is still online and avoid re-alerting on the same post. This copy is not public.
• Listing data (archive): we keep up to 50 rolling snapshots of the feed (roughly two to three weeks) for debugging and quality tracking. Contact details are stripped from these snapshots before they are written, and the oldest is deleted as new ones are added.
• Saved (favorited) listings: when you favorite a listing we store a copy of it on your account so it does not vanish from your Favorites when the original ages out. That copy lives until you unfavorite it or delete your account — it is visible only to you, and it is the one case where listing data is kept beyond 72 hours.
• Removal requests: we keep a record of takedown requests (including any email you give us) so we can prove the request was honoured and stop the listing reappearing.
• IP addresses: kept in memory for rate limiting, and stored in the activity log for security auditing. Activity log entries are automatically deleted after 90 days.

8. Your Rights (GDPR Art. 15–22)

You have the right to:

• Access your data — use the "Export my data" button in your account settings.
• Rectify your data — you can update your favorites and notes at any time.
• Erase your data — use the "Delete account" button to permanently delete all your data.
• Data portability — export your data as a JSON file using the export feature.
• Object to processing — contact us at the email above.
• Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at garanteprivacy.it.

9. Data Security

We protect your data with: encrypted passwords (bcrypt), HTTPS encryption in transit, restrictive Content Security Policy headers, rate limiting on all authentication endpoints, and file-level access controls on stored data.

10. Third-Party Services

• Google / Facebook / Apple OAuth (optional): if you choose to sign in via Google, Facebook, or Apple, their privacy policies apply to the authentication flow. We only receive your email address.
• Resend: sends our transactional email (verification, password reset, newsletter). See Resend's privacy policy.
• Hetzner (Germany): hosts the servers this website runs on. Your account data is stored in the EU.
• Cloudflare: routes and protects traffic to the site.
• Anthropic: we send listing text to Anthropic's Claude model to classify posts and rewrite descriptions into clean Italian. Phone numbers, email addresses and social handles are stripped out before the text is sent. No account data of yours is ever sent.
• Apple (iOS app only): Apple's Push Notification service delivers notifications to your device.
• Telegram: we also publish listings to a public Telegram channel. Contact details are stripped before publishing. See section 6 for how removal works.

Anthropic, Cloudflare, Apple and Telegram may process data outside the European Economic Area. Where that happens we rely on the transfer safeguards in Chapter V of the GDPR (adequacy decisions or standard contractual clauses, as applicable to each provider).

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights, we will notify the Italian Data Protection Authority (Garante) within 72 hours and inform affected users without undue delay, as required by GDPR Articles 33 and 34.

12. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will reflect changes. We will notify you of material changes via email. If you do not agree with the updated terms, you may delete your account.

13. Accuracy of Listings — No Warranty

Listings displayed on this service are scraped from publicly accessible Facebook group posts and presented to you as collected, with automated processing only (filtering of obvious non-rental posts, deduplication, geocoding of mentioned locations). We do not verify the accuracy, availability, legality, or current status of any listing.

In particular:

• Prices are extracted from the original post text and may be outdated, missing, or differ from what the landlord ultimately asks.
• Availability is not guaranteed — listings may already be rented, withdrawn, or have been posted in error. We attempt to remove dead listings on a best-effort basis but cannot guarantee timeliness.
• Map pin locations are inferred from text in the post (street names, neighborhood mentions, metro stops). Inference is approximate; a listing with no precise address will be pinned to the centre of the mentioned area, not the actual building. Always confirm the address with the original poster before visiting or signing anything.
• Listing content (descriptions, photos, contact details) is the sole responsibility of the original poster on Facebook. We are not the author and cannot assess whether a listing is genuine, current, or compliant with rental law.

To the maximum extent permitted by law, this service is provided "as is" without warranties of any kind. You agree that you are responsible for verifying any listing before acting on it, and that we are not liable for losses, damages, or fraud resulting from inaccurate or misleading content sourced from third-party Facebook groups.