Privacy Policy

1. Who We Are

One Place is an AI-powered real estate search engine operated by:

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address (required for account creation)
• Name (optional, for personalization)
• Authentication credentials (securely hashed, never stored in plain text)

2.2 Property Search Data

• Search queries and filters
• Saved properties and favourites
• Location preferences
• Chat conversations with our AI search assistant

2.3 Automatically Collected Data

• Device information - device type, browser, OS
• Usage data - pages visited, time spent, click patterns, the searches you run, and the properties you open. We store this with a random device identifier, and with your account identifier if you are signed in.
• Geolocation - country and city from IP address
• Cookies - our own op_aid and op_sid cookies, and the other cookies described in our Cookie Policy

2.4 Advertising and Attribution Data

If you reach One Place by clicking one of our advertisements, we record how you arrived so we can measure which campaigns are worth running:

• Advertising click identifiers that the ad network adds to the link (for example Google's gclid)
• Campaign tags in the address you arrived with (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
• The page you first landed on, and the address of the website that referred you (the site only, not the full link)

We keep only the first visit that brought you here. If you go on to create an account, we store it on that account so we can tell which campaign led to it. We do not use it to build advertising profiles or to target you individually, and we never sell it.

This applies only to visits that begin with a paid advertisement. Arriving through a search result, an ordinary link, or by typing our address in records nothing at all. Where it does apply, our legal basis is our legitimate interest in measuring advertising we have paid for, and you can object at any time by contacting us. What is kept in your browser is discarded after 90 days; if you opened an account in that time, the record stays with the account.

3. How We Use Your Data

We use your data for:

• Providing property search services and personalized results
• Processing AI-powered search queries
• Sending essential account notifications
• Improving our services through aggregated analytics
• Preventing fraud and abuse
• Complying with legal obligations
• Measuring which advertising campaigns bring people to One Place

Legal Basis for Processing (GDPR)

• Contract: Processing necessary to provide our services
• Legitimate Interest: Analytics, service improvements, and measuring advertising we have paid for
• Consent: Marketing communications
• Legal Obligation: Compliance with laws

Automated Decision-Making and Profiling

We use automated processing, including profiling, to rank and personalize the property results and recommendations we show you, based on your searches, saved properties, and stated preferences. This helps us surface the listings most relevant to you. These automated processes do not produce legal effects concerning you or similarly significantly affect you, and we do not make decisions producing such effects based solely on automated processing. You can ask about the logic involved, express your point of view, or object to this processing by contacting [email protected].

4. Third-Party Data Processors

• Cloudflare, Inc. - Infrastructure, hosting, and content delivery
• Google Ireland Limited - Website analytics and advertising measurement (Google Analytics and Google Ads)
• AI Providers - For search query processing and property analysis (data minimized, not stored by providers)
• PostHog, Inc. - Product analytics and session recording, on servers in the European Union. A session recording plays back what a visit looked like: the pages you saw, your mouse movement, your clicks, and your scrolling. Text that you type is hidden by default. Passwords, email addresses, and telephone numbers are never recorded. The search fields and the message box of our search assistant are the exception, because those words are the search itself. We keep recordings for up to 30 days.

We do not sell or transfer user data to third parties outside of the approved use cases described in this policy.

5. Data Retention

6. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion ("right to be forgotten"). This includes the analytics records that are linked to your device identifier, and you can ask for it even if you have no account.
• Portability: Receive data in machine-readable format
• Restriction: Limit processing of your data
• Object: Object to legitimate interest processing
• Withdraw Consent: Withdraw consent at any time
• Lodge a Complaint: With a supervisory authority in your country

Exercise these rights by contacting [email protected]. We respond within 30 days.

7. Cookies

We use cookies to provide our services:

• Essential Cookies - Required for core features. Cannot be disabled.
• Analytics Cookies - Help us understand usage. Google Analytics runs only with your consent. Our own op_aid and op_sid cookies and PostHog are used for every visitor. You can object, or ask us to erase what we hold, at any time.
• Marketing Cookies - For personalized content. Requires consent.

See our full Cookie Policy for details, including cookie management.

8. Data Security

We protect your data with:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest for sensitive data
• Password hashing using industry-standard algorithms
• Access controls and authentication
• Regular security assessments

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where the risk is high, inform affected users, in line with GDPR Articles 33 and 34.

9. International Data Transfers

Our primary processing occurs in the EU. For transfers outside the EU, we use:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission

10. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such data, we will delete it promptly.

11. AI Assistants (One Place for ChatGPT)

One Place offers a plugin for ChatGPT. It lets you search One Place listings from a ChatGPT conversation. You do not need a One Place account to use it. This section describes the data that the plugin handles.

What we receive from ChatGPT

• The search details that ChatGPT sends to the plugin: the place name and the search criteria (for example price, surface or number of bedrooms) that ChatGPT took from your conversation.
• Your language and region setting (for example fr-FR).
• Two anonymized identifiers that ChatGPT sends to every plugin: one for you as a ChatGPT user and one for the conversation.

We do not receive your name, your email address, your chat history or your precise location. ChatGPT can also send an approximate location (city or country). We do not use or store it.

How we use it and how long we keep it

• Anonymized identifiers: we use them only for rate limiting, which limits the number of requests. We keep them as counters in our cache for at most about 65 seconds.
• Operational logs: for each request, we record the tool name, the outcome, the response time, the number of results, the listing type (sale or rent) and the results page. We keep these logs for 90 days. They contain no search text, no identifier and no IP address.
• Place names: our geocoder finds the place that you asked for. If a name is ambiguous or is not an administrative area, our geocoder can send it to our geocoding provider (Geoapify) and to an AI provider that helps it choose the correct place. This is the same processing as for the search box on our website.

When you open One Place

• Links to one-place.com carry these tags: utm_source=chatgpt, utm_medium=ai_assistant and utm_campaign=openai_plugin. When you open one-place.com, this privacy policy and our Cookie Policy apply, as for any other visit.
• Links to the original source of a listing go through api.one-place.com/api/redirect/, which forwards you to the source website and stores no record of the click.
• The plugin cannot contact sellers. To contact a seller, you need a One Place account on our website.

The plugin shows no advertisements, does not promote subscriptions and takes no payments.

OpenAI processes your ChatGPT conversations under its own privacy policy.

12. Changes to This Policy

We will notify you of changes by posting the updated policy on this page, updating the "Last updated" date, and sending email notification for material changes.

13. Contact Us

Questions about this policy? Contact us:

Supervisory Authority

You may lodge a complaint with the Estonian Data Protection Inspectorate: