Privacy Policy — «Expat Market»

1. Who processes the data

The operator of the «Expat Market» service is Sergei Korolenko, a sole proprietor registered in Georgia (identification code 305650676; correspondence address: Georgia, Tbilisi city, Nutsa Ghoghoberidze street, N9, floor 4, apt. 19, building "A"). The operator determines the purposes and means of processing users' personal data.

2. What data we collect

Telegram user identifier;
first name, last name, username, interface language, profile photo (if public in Telegram), Telegram Premium status, and service launch parameters provided by Telegram as part of initData;
listing data, responses, saved items, and actions within the service;
the source of the user's first visit to the service (marketing tag), where the visit followed a partner or advertising link;
technical data: IP address, user agent, device information, request logs, cookies and local browser storage data, diagnostic information;
behavioural analytics data: events relating to viewing and posting listings, searches, category navigation, interface interactions, and technical metadata for those events — session ID, listing ID, category, platform, Telegram client version. This data is collected automatically;
data on payments via Telegram Stars (paid digital features and voluntary donations) and associated service transaction identifiers.

The service does not request more data from the user than is necessary for the operation of marketplace functions, listing processing, payments, security, and support.

3. Public nature of listings

By publishing a listing, the user makes its content publicly available: the text, photographs, price, category, city, as well as the seller's display name and Telegram username are visible to other users of the service. The listing content (without the seller's name and username) is also published on publicly accessible web pages of the service on the Internet, available without authentication, including for indexing by search engines.

The user independently determines the scope of the information they publish and must not include in a listing any data they are not prepared to disclose to an unlimited audience (exact address, phone number, documents). After a listing is unpublished, its copies may remain for a limited time in search engine and CDN caches, over which the operator has no direct control; upon request, the operator will assist in removing such copies by the means available to it.

Listing photographs are stored with a file storage provider (CDN) and are accessible via direct links without authentication for the duration of the listing's publication; after the listing is closed or deleted, they are removed within a technological period and, until then, may remain accessible via previously issued direct links.

By sending a response to a listing, the user agrees that their display name and Telegram username are shared with the listing's author for contact purposes.

4. Purposes of processing

providing access to the service and user authentication;
publishing and displaying listings;
processing responses, support requests, and complaints;
sending service notifications via the bot (moderation and listing statuses, responses, changes in the service's operation), as well as the operator's informational messages about the service;
fulfilling paid features, processing voluntary donations, verifying payments, and processing refunds;
security and anti-fraud;
moderation of listing content (text and photos) — automated, including via third-party AI services, and manual — to check for prohibited goods and violations of the service rules;
analysing user behaviour, improving the interface and service features, error diagnostics, and development planning (behavioural analytics). For this purpose, the operator's own event collection system is used. Analytics data does not contain payment card data (payment events include the amount in Telegram Stars and the transaction type — the feature purchased or a donation) and is not shared with third parties for advertising purposes. The legal basis for this processing is the operator's legitimate interest in maintaining and developing the service; the user may object to the processing of their data for analytics purposes (see "User rights");
complying with legal requirements and responding to government authority requests.

5. Legal bases

Processing is carried out on the basis of the user's consent, performance of the user agreement, compliance with mandatory legal requirements, and the operator's legitimate interest in ensuring the service's operation, security, and protection against abuse.

Processing of personal data is carried out primarily in accordance with Georgian personal data protection legislation (the Law of Georgia on Personal Data Protection of 14 June 2023, as amended). Georgian users may lodge a complaint with the Personal Data Protection Service of Georgia (pdp.gov.ge). Where the legislation of the user's country grants them additional rights in relation to personal data (including EU Regulation 2016/679 (GDPR) for users from EU member states), the operator will facilitate the exercise of such rights in accordance with the "User rights" section of this Policy; the user may also lodge a complaint with the data protection supervisory authority of their country.

6. Transfers to third parties and cross-border processing

Data may be transferred to hosting providers, file storage and delivery providers (CDN), and other contractors involved in the operation of the service at the operator's direction. If a user makes a purchase or a voluntary donation via Telegram Stars, some data is also processed by Telegram and its payment infrastructure under their own terms and policies.

For automated moderation of listings, their content — the listing text and attached photos — may be transmitted to a cloud AI service provider (Google) solely for the purpose of checking the content against the service rules and applicable law. Such data is used only for moderation, is not used to train third-party models, and is processed in accordance with the provider's data processing terms. Some checks are performed by the service's built-in rules without transmitting data to the external AI service; transmission to the external AI service occurs only to the extent necessary to check a specific listing.

Telegram is not the operator of this service. In relation to the functions of the Telegram platform itself (including Telegram Stars payments), Telegram acts as an independent controller and processes data in accordance with its own privacy policy.

Data may be processed in countries other than the user's country, including in the infrastructure of hosting and data storage providers whose servers may be located outside the user's jurisdiction; analytics events are processed in the operator's own analytics system hosted with the operator's hosting provider. Such cross-border transfer is carried out subject to the safeguards provided for by applicable law: to countries ensuring an adequate level of data protection, or on the basis of the provider's contractual data protection obligations.

The operator may also disclose data where necessary to protect the operator's rights, prevent fraud, respond to a complaint, comply with the law, or respond to a mandatory request from a competent authority.

Listings from public sources. The service may display listings aggregated from public Telegram channels. In that case, only information published by the author in the open channel is processed: the listing text, photographs, and a public link to the author or the original post; during aggregation, the content of the public post is processed by an AI service (Google) to extract the listing parameters. The legal basis for such processing is the operator's legitimate interest in building a complete catalogue of offers; sensitive categories of data are not intentionally collected. The author of such a listing, including a person who is not a user of the service, may at any time request removal of their listing or object to the processing — via the @expatmarket_bot bot or at expat.apps@gmail.com, providing a link to the listing; the operator removes the listing no later than 10 business days after the listing's attribution to the requester is confirmed and does not re-import it.

7. Automated processing and recommendations

The decision to admit a listing for publication may be made automatically — based on the service's built-in rules and/or an assessment by a third-party AI service (Section 6). If a listing is rejected automatically, the user may request human review of the decision and provide explanations — via the @expatmarket_bot bot or at expat.apps@gmail.com; the re-check is performed by a moderator.

The use of recommendation technologies in forming the listing feed is described in a separate document: Recommendation Technologies. The service does not make automated decisions producing legal effects for the user beyond the content moderation described above.

8. Cookies and local storage

The service uses browser/Telegram WebView local storage (localStorage) and Telegram cloud storage (CloudStorage) to save interface settings, the selected city, search history, listing drafts, and technical session flags. This data is stored on the user's device or in their Telegram cloud and is transmitted to the operator only to the extent necessary for the features to work. Certain technical cookies may be used on the service's public web pages for their correct operation. The service does not use third-party advertising or tracking cookies.

9. Data retention

Personal data is retained no longer than necessary for the purposes of processing. Account and listing data is stored while the user uses the service and is deleted at their request or upon self-service account deletion in the app (after the request, a 7-day recovery period applies, after which the data is deleted irreversibly; payment records are anonymised). Behavioural analytics events are retained for no more than 24 months from the event. Technical logs and backups are retained for a limited time within rotation cycles. Certain data may be retained longer where necessary for legal compliance, protection of the operator's rights, or dispute resolution.

10. User rights

The user may request access to their data and a copy of it, rectification, erasure, restriction of processing, object to processing based on legitimate interest, request transfer of the data they provided in a structured, machine-readable format, withdraw consent, and obtain information about the processing procedure. The account and associated data can also be deleted by the user directly in the app settings. Requests to exercise these rights should be sent via the @expatmarket_bot bot or to expat.apps@gmail.com.

Since the account in the service is tied to a Telegram account and the operator holds no other user identifiers, to verify the requester's identity, requests concerning a specific account must be sent from the corresponding Telegram account via the @expatmarket_bot bot, or by email to expat.apps@gmail.com with subsequent confirmation via a message to the bot from the same Telegram account. The operator may refuse to fulfil a request whose requester's identity could not be verified, notifying the requester accordingly.

The operator responds to such requests without undue delay and no later than 10 business days from receipt. In exceptional cases (complexity of the request, volume of data processed), this period may be extended by no more than 10 further business days, of which the operator will notify the requester before the initial period expires, stating the reasons.

Some data may be retained after a deletion request if necessary for legal compliance, fraud prevention, or protection against claims.

11. Children's data

The service is intended for persons aged 16 and over and does not knowingly collect data of persons under that age. If the operator becomes aware that data has been provided by a person under 16, the relevant account and data are deleted; this can be reported at expat.apps@gmail.com.

12. Security

The operator takes reasonable organisational and technical measures to protect data from unauthorised access, loss, alteration, and other unlawful actions.

In the event of a security incident resulting in a personal data breach that creates a high risk to users' rights and freedoms, the operator will notify affected users within a reasonable time after discovery of the incident — through available communication channels (in-app notification or bot message). The operator notifies the Personal Data Protection Service of Georgia (pdp.gov.ge) of incidents in the cases and within the timeframes established by Georgian law (as a general rule, no later than 72 hours from the moment the operator becomes aware of the incident, where the incident may entail a significant risk to data subjects), as well as other supervisory authorities where required by applicable law.

13. Contact

For questions about data processing and privacy, please contact expat.apps@gmail.com or the @expatmarket_bot bot.

14. Policy updates and language versions

The operator may update this Policy. The current version is published at a permanent URL with its effective date indicated. In the case of material changes (new categories of data, new purposes, or new recipients), the operator will additionally notify users via the app or the bot before the changes apply.

This Policy is drawn up in Russian and English. In the event of any discrepancy between the language versions, the Russian version shall prevail.

Effective date: 16 July 2026.