Lero.al
HomeListings

Privacy Policy

Last updated: 17 October 2026.

Lero.al is a platform for free property listings in Albania. This Policy explains the personal data involved in browsing, accounts, property advertisements, inquiries and support. It also covers Google sign-in, statistics and diagnostic services. Free publication and the platform’s beta status do not reduce your data protection rights.

1. Responsibility and contact

Lero.al is the platform operator responsible for the processing described here. Contact support@lero.al or our contact form about privacy, your account or a particular listing. Identify the account or listing concerned and explain your request; do not send passwords or unnecessary identity documents. Processing is subject to applicable Albanian law, including Law No. 124/2024 on Personal Data Protection.

2. Information and its sources

We receive account and profile information from you: your name, email, authentication information and the profile fields you complete, including telephone or WhatsApp number, photograph, company or professional role, location, language and currency preferences. Listing information includes descriptions, photographs, property features, price, address or map coordinates and advertiser contacts. Your use of account features creates favorites, collections, saved searches, alert preferences and viewing history.

Inquiries, contact messages, reports and review requests contain the contact details, text and supporting information supplied by the sender. A report or inquiry can therefore contain information about an advertiser or another person who did not submit it. We receive that information from the sender and use it to handle the inquiry, report or related issue. Technical information comes from requests to the platform and its service providers. Provide other people’s data only where you have a lawful reason.

2.1. Sign in with Google (Google OAuth)

Google sign-in is optional and uses Supabase Authentication. Google provides identity information permitted by the authorization presented to you, such as your Google account identifier, name, email address and profile image. We use it to authenticate you, create and manage your Lero.al account and protect access. We do not receive your Google password. This feature does not require access to Gmail messages, Google Drive files, Google Contacts or Google Calendar.

The provider, international-processing, retention and rights sections below apply to Google-derived personal data too. Google explains its own processing in its Privacy Policy. Our handling of information received from Google is subject to the Google API Services User Data Policy, including Limited Use requirements where applicable.

Review or remove Lero.al’s connection through your Google Account connections. Removing that connection does not delete your Lero.al account or information already stored here. Request deletion through account settings or support. Google authorization is separate from consent for optional tracking or marketing.

3. Purposes and legal grounds

We distinguish the purposes of processing as follows:

  • Accounts, listings and requested features: identity, authentication, profile and listing data, saved items, search settings and inquiries support account access, publication, search, alerts you enable and communication. The legal ground is performance of our contract with you or steps you request before entering it, to the extent the processing is necessary for those features.

  • Security, moderation and support: relevant account data, requests, technical identifiers, reports and correspondence help prevent abuse, investigate suspicious activity, assess content, resolve problems and protect legal rights. We rely on legitimate interests where the processing is necessary and those interests are not overridden by your rights.

  • Statistics and performance: viewing and contact events, browser information and diagnostic records help measure listing activity, understand service use and investigate technical problems. This purpose is distinct from publishing an advertisement. For necessary and proportionate activity statistics and technical diagnostics, we rely on legitimate interests in understanding demand, operating the service and correcting errors, subject to your rights. Consent is required for optional device storage or tracking where applicable law requires it; legitimate interests do not replace that consent.

  • Legal obligations: relevant records are processed when needed to comply with an applicable legal requirement, including responding to a lawful request from a competent authority.

Information marked as required in a registration or contact form is needed to complete that request; optional profile fields can remain empty. Saved-search email alerts are optional and can be managed in the relevant settings or through support. Accepting the Terms, browsing or using Google sign-in does not itself authorize optional tracking or promotional communications.

4. What other people can see

Published listings expose their descriptions, photographs, property location and the profile or contact details displayed with them to visitors. Search engines and third parties can index or copy public information. Check the exact details displayed before publishing, especially a home address, telephone number or photograph containing other people.

When you send a listing inquiry, your name, email and message are supplied to the advertiser so they can respond, including through email delivery. An inquiry is not the same as a public listing. The advertiser is responsible for their subsequent use of it. WhatsApp links open an external service, whose privacy terms also apply to messages sent there. Removing information from Lero.al does not automatically remove another person’s copy; applicable erasure rights and our obligations concerning public data remain available.

5. Technical information, statistics and diagnostics

Platform requests generate IP addresses, browser and device information, request times, visited pages and interaction or error records. Contact and listing-inquiry records can include the sender’s IP address for abuse prevention. Listing-view and WhatsApp-click statistics use account identifiers for relevant signed-in events or pseudonymous identifiers derived from IP and browser information. Hashing an identifier does not necessarily anonymize it.

Vercel measurement and Sentry diagnostics process usage or performance information. Diagnostic configuration enables personal-data collection and performance tracing; error records can include account, request or user information associated with an incident. These records are not represented as anonymous. Browser storage controls do not necessarily stop server request logging, account-linked statistics or diagnostic transmissions.

6. Providers and other recipients

The services supporting these functions include:

  • Supabase: authentication, account identity and platform database storage, including listings, saved items and communications stored by the platform.

  • Cloudinary: storage and delivery of uploaded images; requesting an image also involves a connection to its delivery infrastructure.

  • Resend: sending account and service emails, search alerts and inquiry notifications, using the delivery address and content needed for each message.

  • Vercel: application hosting, Analytics and Speed Insights for usage and performance measurement.

  • Sentry: error reporting and performance diagnostics involving the technical and incident information described above.

  • Cloudflare Turnstile: bot protection and the technical information needed to assess requests. Cloudflare processes this information as described in its Turnstile Privacy Addendum.

  • Google: the optional identity provider when you select Google sign-in.

  • OpenStreetMap resources: map display; requesting map tiles exposes connection information, including IP and browser information, to the resource provider.

Provider access follows the particular function: an email provider receives delivery information and message content, while an image provider handles images and image requests. Authorized support and moderation personnel access information relevant to their work. Competent authorities and professional advisers receive relevant information where disclosure is required by law or necessary to protect legal rights. The public and advertisers receive information in the circumstances described in section 4.

7. Processing outside Albania

Using external authentication, hosting, database, email, image and diagnostic infrastructure can involve processing outside Albania. Hosting location alone does not describe every support or subprocessor access location. International processing is governed by Albanian transfer requirements, including the applicable rules on adequate protection or other legally permitted safeguards.

Contact support@lero.al for information concerning recipients, destinations and the transfer safeguards applicable to your information, including how to obtain relevant details or a copy of safeguards. Naming a provider does not establish that every destination it uses is adequate. Google sign-in authorization and publication of this Policy are not, by themselves, permission for an otherwise unlawful international transfer.

8. Cookies and browser storage

Authentication storage: authentication cookies support sign-in, session continuity and security. Deleting them can end a browser session; it does not delete the underlying account.

Language preference: the public language switcher uses the cookie admin-locale. Its configured lifetime is 365 days from the latest setting or update.

Recently viewed listings: for guests, rv_listings contains up to 25 listing identifiers. Its expiry is set to 30 days when the history is updated, so later updates renew that expiry. For signed-in users, viewing history is associated with the account in the database instead.

Session storage: browser session storage supports returning after login, restoring a listing-list position and remembering performance-related display information. It is separate from database records.

You can inspect, remove or block cookies and site storage in your browser. Removing local history or signing out does not automatically erase server records. Measurement, diagnostics, bot protection and external resources also involve technical processing that is not necessarily a cookie. Necessary authentication and optional history or measurement serve different purposes. Where consent is legally required, it must be freely given, specific and capable of withdrawal; this notice does not collect that consent. Contact support with questions or objections concerning these operations.

9. Retention and account deletion

Retention is assessed by category and purpose. Account and authentication information supports the account while it is maintained. Listings and uploaded images support publication and management of the offer. Favorites, searches, alert preferences and viewing history support the corresponding account feature until removed or no longer needed for it. Closing or archiving an offer is distinct from deleting all records about it.

Inquiry and support records concern the handling of the communication and any justified follow-up. Reports, moderation and security records concern the incident, review or abuse investigation they document. Diagnostic records concern troubleshooting and performance analysis. Relevant legal retention duties and limitation periods can justify retaining limited information for a claim. These criteria do not authorize indefinite retention merely because storage remains available.

Account deletion is available in account settings. The deletion process archives applicable listings, removes the user profile and removes the Supabase authentication identity. If the platform reports an error during deletion, contact support to check whether the request completed and obtain help with any remaining steps. Public removal and deletion of account records do not establish that every image copy, provider log, diagnostic event or backup has been erased at the same moment. Contact support for deletion assistance or information about a particular remaining category; any continuing retention remains subject to a lawful purpose and your applicable rights.

10. Your rights and requests

Under applicable legal conditions, you can request confirmation of processing, access and a copy, correction, erasure, restriction and portability. You can object to processing based on legitimate interests and object to direct marketing. You can withdraw consent without affecting processing that was lawful before withdrawal. Rights concerning solely automated decisions with legal or similarly serious effects apply where the statutory conditions are met; you can also ask support for human review of a moderation decision.

Email support@lero.al to make a request. Where there are reasonable doubts about identity, proportionate verification information can be requested. Requests are normally free; legally permitted exceptions concern clearly unfounded or excessive requests. We respond as soon as possible and within 30 days, subject to lawful extensions. An extension requires notice within the initial 30 days and reasons. You can complain to Albania’s Commissioner for the Right to Information and Protection of Personal Data through idp.al and pursue available legal remedies without contacting us first.

11. Security and younger users

Account authentication, access restrictions, moderation and bot protection help protect the service and information. These measures do not guarantee absolute security or validate every advertiser’s identity. Protect your credentials, check what you upload and tell support about suspected unauthorized access. Account creation and listing publication are intended for people aged 18 or over. If a child has supplied information inappropriately, contact us so the information and circumstances can be assessed and addressed.

12. Updates and further contact

We update this Policy when processing or legal requirements change, show the update date and communicate material changes through an appropriate available channel. Updating a notice does not itself authorize a new purpose or processing requiring fresh consent. For privacy questions and requests, contact support@lero.al.