Privacy Policy

The controller is Rymote LLC, registered in the State of Wyoming, United States, which operates Skautik. Privacy questions go to privacy@skautik.com, and our data protection contact is dpo@skautik.com.

When you send an enquiry to a seller or agent, they become an independent controller of what you sent them, and their own privacy policy governs what they do with it afterwards.

We do not ask for special category data, which includes health, religion, ethnicity, and sexual orientation, and we ask you not to put it in listing text or enquiries. Payment card numbers never reach our servers: they go directly to our payment processor, and we receive only a token and the last four digits.

Where we rely on legitimate interests we have weighed them against your rights and concluded the processing is proportionate. You can object at any time, and we will stop unless we can show compelling grounds that override your interests.

Search ranking and match scoring are automated, and they shape what you see. They do not produce legal or similarly significant effects: nothing is approved, refused, priced, or withheld from you on the basis of a profile.

Protected characteristics are never inputs to ranking or matching, and we do not infer them in order to filter results. The constraints we place on this are set out in the fair housing notice. You can browse without personalisation by using search while signed out.

• Sellers and agents you contact, who receive your enquiry and the contact details you provide.
• Infrastructure and hosting providers that run the platform and store its data under contract.
• Payment processors for subscription billing, tax calculation, and chargeback handling.
• Email and notification providers that deliver service and marketing messages.
• Mapping and geocoding providers that resolve addresses and render maps.
• Google Ireland Limited, as our processor for Google Analytics 4, and only where you have accepted analytics. What it receives is described in the cookie policy: pages read, events such as a search or a listing opened, the amount of a completed subscription payment, and the approximate location and device Google derives from the request. It does not receive your name, your email address, or the contents of your searches and enquiries.
• Error monitoring providers, restricted to what diagnoses a fault.
• Professional advisers, authorities, and acquirers, where law requires it or in connection with a merger or sale of the business, in which case we tell you before your data moves.

Every processor is bound by contract to use the data only on our instructions, to keep it secure, and to delete or return it when the engagement ends.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA and CPRA. We do not operate an advertising network and we do not offer housing advertisers targeting by protected characteristic.

Analytics is the one place a regulator would look for this, so to be explicit: Google Analytics is configured with advertising features and Google Signals switched off, every event we send is flagged as not for advertising personalisation, and we do not use it to build or export an audience.

We honour Global Privacy Control signals: a browser that sends one is never asked for analytics consent and never granted it. Further detail and the route to make a formal request are on the privacy rights page.

Skautik serves users in many countries and our operator is established in the United States, so personal data is transferred internationally, including from the European Economic Area and the United Kingdom to the United States.

Those transfers rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision where one applies. We assess the destination country and add technical measures, including encryption in transit and at rest, where the assessment calls for them. Ask privacy@skautik.com for a copy of the safeguards.

Google Analytics specifically. Our contracting entity is Google Ireland Limited, and Google processes analytics data in the United States as well as within the European Union. That transfer relies on the Standard Contractual Clauses in Google's data processing terms and on Google LLC's certification under the EU-US Data Privacy Framework. Google states that it does not log or store the IP addresses of visitors to Analytics properties, and that traffic from the European Union is received on European servers before the address is used to derive an approximate location and then discarded. This transfer happens only if you accept analytics.

Retention periods are in the table above. The principle behind them is that we keep data for as long as it serves the purpose we collected it for, plus any period a law requires.

Delete your account and we remove your profile, saved searches, and saved listings within 30 days, apart from: billing records we must keep for tax, enquiry threads the counterparty also holds, content you published that others rely on, and backups, which age out on their own cycle within 90 days.

Analytics data held by Google is set to expire 14 months after a visitor's last activity, which is the shortest period Google offers that still allows a year-on-year comparison. Deleting your account does not reach into it, because nothing in it identifies you: the way to remove yourself from it is to refuse analytics, which also stops anything further being sent.

Data is encrypted in transit with TLS and at rest. Access is limited to staff who need it, over authenticated and logged paths. Passwords are stored only as salted hashes, never in a recoverable form, and credentials used to reach third-party portals are encrypted with keys held separately from the data.

No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we notify you and the relevant regulator within the deadlines the law sets, which is 72 hours for a notifiable GDPR breach. Report a vulnerability to security@skautik.com; we will not pursue good-faith research that respects user privacy.

You can access, correct, delete, port, and object to the processing of your data, withdraw consent, and opt out of any sale or sharing. We extend these to every user regardless of where you live.

The privacy rights page explains how to exercise each one, how we verify you, and how long we take. Exercising a right never degrades your service or price.

The platform is not directed at children and accounts require you to be 18 or the local age of majority. We do not knowingly collect data from children. If you believe a child has given us personal data, write to privacy@skautik.com and we will delete it.

We update this policy as the product changes. For material changes we give at least 30 days' notice by email or in the product before they take effect, and we revise the effective date above. We do not apply a materially different use to data already collected without a fresh legal basis for it.

Write to privacy@skautik.com with any privacy question, or to dpo@skautik.com to escalate.

You may complain to a supervisory authority without contacting us first: your national data protection authority in the EEA, the Information Commissioner's Office in the UK, the California Privacy Protection Agency or your state attorney general in the US, or the Office of the Privacy Commissioner in Canada.