Legal
Last updated: July 2026
This Cyprus property marketplace at noirestates.com is operated by NoirEstates ("we"). We are the controller of the personal data described here. For anything in this policy, write to [email protected].
The short version: we collect what the service needs to work, we run our own privacy-clean analytics as standard, we set no cookies unless you accept Google Analytics on the banner, and we never sell personal data.
Your account. Your email address, how you sign in (email link, or Google — in which case Google sends us your name and email), your account type, and things you save on the site (saved searches, watchlist). Used to operate your account. Legal basis: performance of a contract.
Agency and developer verification. If you apply to list as an organisation we collect your business name, registration number (CREA for agencies, HE for developers), business contact details and logo. Your registration number is used for verification only and is never shown publicly. Legal basis: contract and our legitimate interest in keeping the marketplace verified.
Enquiries you send. When you contact a lister we store your message, your email, and the name and phone number you choose to give — and we pass them to that lister so they can reply. When you reveal a phone number or open WhatsApp we record that an enquiry happened, without your identity. To prevent abuse we also keep a salted, one-way hash of your IP address for rate-limiting — the address itself is never stored. Legal basis: performance of a contract (delivering your enquiry) and legitimate interest (abuse prevention).
Google Analytics (only if you accept). If you choose “Accept” on the analytics banner, Google Analytics measures how the site is used: pages viewed, approximate location and device type. It sets the cookies listed on the Cookies page. Nothing is loaded from Google unless you accept, Google's advertising signals are switched off, and we do not link this data to your account. Legal basis: your consent, which you can withdraw at any time by clearing this site's data. There are no advertising networks and no cross-site advertising identifiers on this site.
Usage analytics (first-party, always on). A random identifier in your browser (not a fingerprint), the pages you visit on our site and the product actions you take. When you are signed in, events are linked to your account so features like lead counts work. This never leaves our own systems. Legal basis: legitimate interest in understanding and improving our own product.
Email. We send sign-in links and service email (for example, enquiry relays and organisation decisions) through our email provider. We do not send marketing email without asking first.
We never sell personal data. When you enquire about a property, your enquiry — including the contact details you provided — goes to the lister of that property, who may use it only to respond to you (see our Terms). Beyond that, data is handled by the service providers that run our infrastructure:
| Provider | What they do for us |
|---|---|
| DigitalOcean | Website and application hosting, database (Amsterdam, EU), photo storage and CDN — accounts, listings, enquiries |
| Resend | Email delivery (Ireland, EU) — sign-in links and service email |
| Anthropic | Ask Noir answers — your question and the market data behind it, only when you use that page |
| Google Ireland | Google Analytics — only for visitors who accept the analytics banner; may involve transfers outside the EEA under standard contractual clauses |
| Sign-in with Google, only if you choose it — Google shares your name and email with us | |
| Carto | Map tiles — when a map loads, your browser requests tiles from their servers |
Where a provider processes data outside the EEA, transfers rest on the European Commission's approved safeguards (adequacy decisions or standard contractual clauses).
Sign-in links work once and expire after 30 minutes. A signed-in session lasts up to 30 days. Account and organisation data is kept while your account exists. Enquiries are kept so the lister can manage them and so we can prevent abuse. If you close your account or ask us to, we delete your personal data unless a legal obligation requires keeping it.
Photos uploaded to listings have their embedded metadata — including GPS location — stripped before they are stored.
Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Email [email protected] and we will act on it. You can also complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
NoirEstates is not directed at anyone under 18. We set no cookies unless you accept analytics — details of those, and of the little your browser stores locally, are on the Cookies & local storage page. If this policy changes, the new version appears here with a new date; material changes are announced to account holders by email.