Privacy Policy

(last revised 25.05.2025)

This Privacy Policy explains how "Mean" SIA ("we", "our", "us") collects, uses, and protects your personal data when you use our website https://nopo.app (the "Service").

1. Who We Are

We are "Mean" SIA, a company registered in the Commercial Register of the Republic of Latvia (registration number 40203407098).
Company address: Riepnieku 2, Riga, Latvia, LV-1050.
For any questions or data requests, contact us at [email protected].

2. What Information We Collect

We collect the following types of personal data from users:

Account Information

  • First name and last name

  • Email address

  • Phone number

  • Authentication provider (Google, Facebook, Apple, or email)

  • Social media links or handles (optional)

  • Bio or description (optional)

Listing Information

  • Listing title and description

  • Property photos

  • Address and location data

  • Listing category and other listing metadata

  • Pricing information

KYC (Know Your Customer) Data (if applicable)

  • Documents or identity verification data submitted by users

Technical Data

  • IP address

  • Browser type and settings

  • Device type

  • Pages visited, time spent
    (Collected via self-hosted Umami analytics – no personal data leaves our servers)

3. How We Collect Information

We collect data:

  • Directly from you when you create an account or submit a listing

  • From third-party authentication providers (Google, Apple, Facebook)

  • Through communications with us (e.g., emails)

  • Automatically through our self-hosted analytics system

We do not use tracking cookies or third-party analytics tools (e.g., Google Analytics or Facebook Pixel).

4. How We Use Your Information

We use your data for the following purposes:

  • To create and manage your account

  • To publish and display real estate listings

  • To ensure platform safety, prevent fraud, and detect abuse

  • To communicate with you (email or SMS confirmations, platform updates)

  • To comply with legal obligations (e.g., KYC compliance if required)

5. Legal Bases for Processing (GDPR)

We process your data based on:

  • Contractual necessity: to provide the services you request (account, listings)

  • Legitimate interests: to protect platform integrity, prevent fraud

  • Legal obligations: compliance with applicable laws

  • Consent: for optional data you provide (e.g., social media links, bios)

6. Cookies

We only use functional session cookies that are essential to operate the platform. We do not use tracking, advertising, or marketing cookies.

7. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes.

We only share personal data with a limited number of service providers, solely to operate and maintain the platform. These providers are:

  • Railway: We use Railway as our infrastructure provider. User and listing data may pass through this system securely and encrypted.

  • Resend: We use Resend to send transactional emails (such as account confirmations or platform notifications). Your email address and, where relevant, your name are shared with Resend for this purpose only.

  • Twilio: We use Twilio to send SMS messages. If you provide a phone number, it may be used by Twilio to send you relevant messages (e.g., confirmation codes).

All services are either GDPR-compliant or used in a way that ensures no personal data is transferred outside of the European Economic Area (EEA) without adequate protection.

8. Data Retention

We retain personal data only as long as necessary for:

  • Providing our services

  • Legal and regulatory compliance

  • Security and fraud prevention

You may request data deletion at any time.

9. Your Rights (Under GDPR)

You have the right to:

  • Access your personal data

  • Correct inaccuracies

  • Delete your data ("right to be forgotten")

  • Object to processing under certain conditions

  • Withdraw consent at any time for data processed on that basis

  • Lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija)

To exercise any of these rights, contact us at [email protected].

10. Data Security

We use modern encryption and access control practices to protect your data. However, no system is completely secure. If you believe your data has been compromised, contact us immediately.

11. Children’s Privacy

Service is not intended for individuals under the age of 18. We do not knowingly collect data from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a platform notice. Continued use of the Service indicates your acceptance of the updated policy.