WhitesLove 1. Who is responsible
The controller is [not provided by the operator], a natural person who operates whiteslove.me and its related services (Flat Finder, job and CV search, Telegram subscriptions).
For any question about personal data, write to [not provided by the operator]. No Data Protection Officer has been appointed.
2. What the service does
WhitesLove collects public housing listings, job vacancies and CVs from open sources and shows them in one place. It also checks listings for signs of copying, fake availability and repeated reposting.
Most people whose data we process did not give it to us directly: it comes from public advertisements and profiles. This section and section 4 are the information Article 14 GDPR requires us to give them.
3. Where the data comes from
- Public housing listings: OLX, public Telegram channels, public Facebook pages and groups, owner and agency websites.
- Public vacancies and CVs: job boards (for example hh, work.ua, robota.ua, rabota.kz, enbek.kz, djinni.co, ejobs.ro, bestjobs.eu), public LinkedIn pages, Telegram, Facebook and Threads.
- Public messenger and social profiles named in listings: username, display name, profile description.
- The operator's internal registry (previously kept in Google Sheets): notes about realtors, numbers and aliases.
- Reports from users about outdated or incorrect listings.
- Derived information: integrity signals the system computes from the sources above.
- Data you give us yourself: a Telegram search subscription, a data request.
- Technical data from site visitors: IP address and chosen settings (see the Cookie policy).
4. What data, and why
We do not intentionally collect or infer special-category data: health, religion, political opinions, sexual orientation, biometrics. Listing photos are compared only to find copies, never to recognise people.
| Purpose | Data | Legal basis |
|---|---|---|
| Showing housing listings and contact buttons | Listing text and photos, the published contact (phone, Telegram, etc.), source link | Legitimate interests (Art 6(1)(f)): helping people find housing; the contact was published to be contacted |
| Detecting copied, fake and repeatedly reposted listings | Listing history, photo fingerprints, availability check results | Legitimate interests: fraud prevention |
| Recognising the same advertiser across channels | Phone numbers, usernames, display names and their changes, role (owner, agent) | Legitimate interests: fraud prevention |
| Integrity assessment (profiling) | Reason codes and evidence | Legitimate interests: fraud prevention |
| Showing vacancies | Company, job title, vacancy text, recruiter contact | Legitimate interests: helping people find work |
| Showing CVs | Name, role, city, experience, skills, languages, salary expectations, gender and age (where stated by the candidate), source link | Legitimate interests: helping employers find candidates who published a CV |
| De-duplicating CVs | Email, phone, Telegram ID, profile link | Legitimate interests; merged only when these match, never on a name |
| Telegram subscriptions | Telegram ID and chat, username, first name, language, saved searches | Contract (Art 6(1)(b)) |
| Handling data requests and disputes | Your email, the identifiers you give, request text, outcome | Legal obligation (Art 6(1)(c)) |
| Security and abuse prevention | IP address | Legitimate interests |
5. Legitimate interests
Listings and CVs are published in order to be seen and answered; searching them in one place is an expected use. Fraud checks protect people looking for housing, and honest advertisers whose listings are copied.
We have assessed that these interests are not overridden by your rights, given the safeguards: risk information and identity history are never published, no decisions with serious consequences are taken about people, data is kept for limited periods, and you can object at any time (section 10).
6. Automated assessment and profiling
The system assesses listings and advertisers on several separate dimensions (whether the property is real, availability, where the listing came from, consistency, payment risk, behaviour) and stores the reasons for each assessment.
Only neutral statements about a listing may be shown publicly: "availability not confirmed", "listing appears repeatedly", "source information is inconsistent". We do not publish accusations about people.
The service takes no decisions about people: it does not block anyone, hide all of their listings or publish conclusions about them. Automated assessments are used only for neutral notes about a listing. You can contest anything we hold about you (section 10).
7. Who receives the data
Risk information, identity history and the internal registry are not shared with anyone or published.
- Site visitors — listings, vacancies and CVs as published at the source.
- The hosting provider whose servers run the service.
- AI providers that analyse listing text and photos (through our gateway; depending on configuration: Groq, Google Gemini, NVIDIA, Hugging Face, LLM7, OpenRouter, Mistral, Cloudflare Workers AI). Contacts are removed from text before analysis, and in translations they are replaced by placeholders and restored afterwards, so providers never receive them.
- Telegram — to deliver subscription notifications.
- OpenStreetMap — map tiles are loaded by your browser directly, so OpenStreetMap receives your IP address.
- Google — only to read the operator's internal registry.
8. Transfers outside the EEA
Some AI providers are located outside the European Economic Area, including in the United States. Transfers take place on those providers' terms. To find out which safeguards apply to a particular transfer, write to [not provided by the operator].
9. How long data is kept
Nothing is kept indefinitely. Indicative periods:
- Active listings — while published at the source; listing history — 12 months.
- Username and display-name history — 12 months.
- Contacts no longer seen in listings — 18 months.
- Risk information — 18 months after it was last observed.
- CVs — while active at the source and 6 months after.
- Telegram subscriptions — until you unsubscribe; inactive ones 12 months.
- Data requests and disputes — 36 months after closure.
- Technical logs — overwritten in rotation, at most 30 MB per service.
- Data under an open dispute is kept until the dispute is decided.
10. Your rights
Send a request from the "Your data" page or directly to [not provided by the operator]. We reply within one month; complex requests may take two further months, and we will tell you why.
To avoid disclosing someone else's data, we check that the phone, account or email you give is yours. We do not ask for identity documents.
You have the right to lodge a complaint with a data protection supervisory authority where you live, work, or where the alleged infringement took place.
- Find out what data we hold about you and get a copy.
- Have inaccurate data corrected.
- Have data erased.
- Restrict processing, for example while accuracy is checked.
- Object to processing based on legitimate interests, including profiling.
- Receive data you provided yourself (Telegram subscription) in a machine-readable form.
- Contest information about your identity, role, contacts or risk.
11. Security
Connections are encrypted, internal information is not reachable through the public site, and error logs contain no personal data.
12. Changes
We update this notice when processing changes. The date of the last update is shown at the top of the page.