1. Who We Are
One Place is an AI-powered real estate search engine operated by:
One Place OÜ
Registry code: 17329841
Country: Estonia, European Union
GDPR inquiries: [email protected]
2. Data We Collect
2.1 Account Data
When you create an account, we collect:
- Email address (required for account creation)
- Name (optional, for personalization)
- Authentication credentials (securely hashed, never stored in plain text)
2.2 Property Search Data
- Search queries and filters
- Saved properties and favourites
- Location preferences
- Chat conversations with our AI search assistant
2.3 Automatically Collected Data
- Device information - device type, browser, OS
- Usage data - pages visited, time spent, click patterns, the searches you run, and the properties you open. We store this with a random device identifier, and with your account identifier if you are signed in.
- Geolocation - country and city from IP address
- Cookies - our own op_aid and op_sid cookies, and the other cookies described in our Cookie Policy
2.4 Advertising and Attribution Data
If you reach One Place by clicking one of our advertisements, we record how you arrived so we can measure which campaigns are worth running:
- Advertising click identifiers that the ad network adds to the link (for example Google's gclid)
- Campaign tags in the address you arrived with (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
- The page you first landed on, and the address of the website that referred you (the site only, not the full link)
We keep only the first visit that brought you here. If you go on to create an account, we store it on that account so we can tell which campaign led to it. We do not use it to build advertising profiles or to target you individually, and we never sell it.
This applies only to visits that begin with a paid advertisement. Arriving through a search result, an ordinary link, or by typing our address in records nothing at all. Where it does apply, our legal basis is our legitimate interest in measuring advertising we have paid for, and you can object at any time by contacting us. What is kept in your browser is discarded after 90 days; if you opened an account in that time, the record stays with the account.
3. How We Use Your Data
We use your data for:
- Providing property search services and personalized results
- Processing AI-powered search queries
- Sending essential account notifications
- Improving our services through aggregated analytics
- Preventing fraud and abuse
- Complying with legal obligations
- Measuring which advertising campaigns bring people to One Place
Legal Basis for Processing (GDPR)
- Contract: Processing necessary to provide our services
- Legitimate Interest: Analytics, service improvements, and measuring advertising we have paid for
- Consent: Marketing communications
- Legal Obligation: Compliance with laws
Automated Decision-Making and Profiling
We use automated processing, including profiling, to rank and personalize the property results and recommendations we show you, based on your searches, saved properties, and stated preferences. This helps us surface the listings most relevant to you. These automated processes do not produce legal effects concerning you or similarly significantly affect you, and we do not make decisions producing such effects based solely on automated processing. You can ask about the logic involved, express your point of view, or object to this processing by contacting [email protected].
4. Third-Party Data Processors
- Cloudflare, Inc. - Infrastructure, hosting, and content delivery
- Google Ireland Limited - Website analytics and advertising measurement (Google Analytics and Google Ads)
- AI Providers - For search query processing and property analysis (data minimized, not stored by providers)
- PostHog, Inc. - Product analytics and session recording, on servers in the European Union. A session recording plays back what a visit looked like: the pages you saw, your mouse movement, your clicks, and your scrolling. Text that you type is hidden by default. Passwords, email addresses, and telephone numbers are never recorded. The search fields and the message box of our search assistant are the exception, because those words are the search itself. We keep recordings for up to 30 days.
We do not sell or transfer user data to third parties outside of the approved use cases described in this policy.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion |
| Search history | Until account deletion |
| Saved properties | Until removed or account deletion |
| Cookie consent | 2 years |
| Communication records | Resolved + 1 year |
| Analytics behaviour and the device identifier | 3 months |
| Business outcomes, such as a contact request | 25 months |
6. Your Rights (GDPR)
Under GDPR, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion ("right to be forgotten"). This includes the analytics records that are linked to your device identifier, and you can ask for it even if you have no account.
- Portability: Receive data in machine-readable format
- Restriction: Limit processing of your data
- Object: Object to legitimate interest processing
- Withdraw Consent: Withdraw consent at any time
- Lodge a Complaint: With a supervisory authority in your country
Exercise these rights by contacting [email protected]. We respond within 30 days.
8. Data Security
We protect your data with:
- Encryption in transit (TLS/HTTPS)
- Encryption at rest for sensitive data
- Password hashing using industry-standard algorithms
- Access controls and authentication
- Regular security assessments
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where the risk is high, inform affected users, in line with GDPR Articles 33 and 34.
9. International Data Transfers
Our primary processing occurs in the EU. For transfers outside the EU, we use:
- EU Standard Contractual Clauses
- Adequacy decisions by the European Commission
10. Children's Privacy
Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such data, we will delete it promptly.
11. Changes to This Policy
We will notify you of changes by posting the updated policy on this page, updating the "Last updated" date, and sending email notification for material changes.
12. Contact Us
Questions about this policy? Contact us:
Email: [email protected]
Company: One Place OÜ
Registry code: 17329841
Address: Kotkapoja tn 2a-10, 10615 Tallinn, Estonia
Country: Estonia, European Union
Supervisory Authority
You may lodge a complaint with the Estonian Data Protection Inspectorate:
