Privacy Policy
Version of October 11, 2026
This page explains in plain words which personal data AI MAP processes, why, who receives it, how long we keep it and what your rights are. It describes how the service works today.
Who is responsible for your data
The website aimap.ge and the AI MAP service ("AI MAP", "we") are operated by Angels Investment. We are the controller of your personal data under the Law of Georgia on Personal Data Protection and, for visitors from the European Union, under the EU General Data Protection Regulation (GDPR).
The operator's details are published on a separate page. For any question about personal data, write to info@aimap.ge.
What data we process
What we process depends on what you use:
- Browsing without an account. Technical request data: IP address, browser and device type, page address and time. Our hosting and security services process it. To limit request rates we store a hash of the IP address, not the address itself, for no longer than 2 hours. Your language and currency are remembered in a cookie.
- Account. Email address, password (Supabase Auth stores only its hash), name, account type (private person, agent, agency, developer), language and currency; optionally a phone number and a profile photo; the date and version of the Terms and Policy you accepted. If you sign in with Google or Apple, we receive your name and email from them. For Apple we keep a token so that we can revoke access when you delete your account.
- Companies (agencies and developers). Name, identification code, legal name and address, office phone, website, and a registry extract used to verify the company. Also the names and phone numbers of staff and contact persons the company adds itself, and the email, name and role of invited colleagues.
- Listings and projects. Address, coordinates, cadastral code, features, price, description, photos and video of the property, contact phone and responsible person. Listings are public. The phone number is shown only to signed-in users, and only after an "I am not a robot" check.
- Requests ("Leave a request", mortgage rate request). Name, phone number, preferred contact method, message and calculation parameters. Only signed-in users can send a request.
- Proof of rights. For an "I am the owner" claim: a registry extract and a scan of an identity document. For confirming a company: a corporate email address or a document. The files are kept in private storage that only moderators can open.
- Reviews and reports. The rating and text of a review; the reason and comment of a report. A guest's report is linked to a hash of the IP address and browser, not to the IP address itself.
- Favourites and hidden authors: which properties you saved and whose listings you hid.
- AI search. The text you type into the aimap search, plus the current filters and language. The query is not stored with your account. Please do not type personal data into it.
- Developer information from public sources. So that the map shows every new development, we create developer and project profiles in advance. We take the data from the companies' own websites and from public sources: name, office address, business phone and email, project descriptions and photos. A company can take over its profile, correct it or ask us to remove it.
- Service emails: the recipient's address and the fact that the email was sent.
- Analytics, only with your consent (see "Cookies and analytics").
Why we process data and on what legal basis
- Running your account, publishing listings, delivering your requests, service emails: performance of our contract with you (the Terms of Use).
- Verifying companies and ownership, moderation, protection against spam, fraud and automated data collection, error monitoring: our legitimate interest in a safe and reliable service.
- Developer profiles from public sources: our legitimate interest, and that of buyers, in seeing every project on one map. The company can object to this processing.
- Usage analytics (PostHog, Vercel Web Analytics): your consent. You can withdraw it at any time.
- Alert e-mails about new listings for a saved search: your consent, given when you turn alerts on. You can withdraw it at any time through the link in the e-mail or in the Favourites section.
- Legal requirements and lawful requests from public authorities: legal obligation.
We do not sell personal data and do not show third-party advertising. AI helps us understand search queries, translate descriptions and sort photos into categories. Decisions with legal effects for you, such as blocking an account or rejecting a listing, are made by a staff member, not by an algorithm.
Who receives data
- Other users see what you publish: listings, reviews, company profiles. A phone number from a listing is shown to a signed-in user who asks for it.
- The recipient of your request. The developer or company receives your name, phone number and message by email, and in its own CRM if it has connected one. A copy goes to the CRM of Angels Investment (Bitrix24), so that we can check delivery and help the deal along. If the developer has not yet joined AI MAP, our team receives the request and contacts the developer; the request stays in the developer's profile. Mortgage rate requests are handled only by our team; we do not pass them to banks or developers.
- Our contractors (processors), who process data on our behalf: storage, email delivery, the "I am not a robot" check and so on. The list is in the next section.
- Public authorities, only where the law requires it.
Contractors and where data is processed
- Supabase: database, accounts and files. EU region (Frankfurt, Germany).
- Vercel: website hosting, with functions in Frankfurt (Germany). Also Vercel Web Analytics, cookieless visit statistics, only with consent. US company.
- Cloudflare Turnstile: the "I am not a robot" check at sign-in, registration, phone and cadastral code reveal, reviews and reports. US company.
- Resend: delivery of service emails. US company.
- Sentry: error reports. We have turned off sending personal data by default, and sessions are not recorded. US company.
- PostHog: product analytics, only with consent. Data is sent to PostHog's EU server.
- Google (Gemini): interpreting search queries, automatic translation of descriptions, and processing material that companies upload to import projects and listings. Anthropic is the fallback provider for the same functions. Both are US companies.
- Mapbox: address suggestions, routes and map elements. US company. The base map itself is loaded from our own storage on Vercel.
- Photon (komoot, Germany): searching for addresses and places by the text you enter.
- Have I Been Pwned: checking a password against known breaches. The password is not sent; only the first 5 characters of its hash are.
- Google and Apple, if you sign in with their account.
- YouTube and Vimeo: videos on property pages. The player loads only after you press play.
- Bitrix24: the CRM of Angels Investment for requests.
Transfers outside Georgia and the EU
Our main data is stored in the EU. Some contractors are based in the United States or may access data from there. We base such transfers on mechanisms recognised by Georgian and EU law: an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or standard contractual clauses. You can request a copy of the relevant safeguards at info@aimap.ge.
How long we keep data
- Account and profile: while the account exists. You can delete it at any time in your account (details below).
- Listings: while they are published or archived in your account. Abandoned listing drafts are deleted after 14 days, import drafts after 45 days, and uploaded import files after 30 days.
- Requests: with the recipient, while their account exists or until you ask us to delete the request.
- Documents for company and ownership verification: as long as needed for the check and for handling possible disputes. You can ask us to delete them.
- IP hashes used for rate limiting: up to 2 hours.
- Error reports and analytics: for the retention period set in Sentry and PostHog.
- Data we must keep by law: for the period the law sets.
When you delete your account, we immediately delete the login and profile, favourites, account links and sign-in tokens. Your listings are archived and detached from you. A company profile is hidden if you were its only member. Requests you sent stay with their recipients. You can ask us to delete documents and anything else through a data request.
Your rights
You have the right to:
- find out whether we process your data and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted or its processing restricted;
- object to processing based on our legitimate interest, including a company profile created from public sources;
- receive the data you gave us in a machine-readable format;
- withdraw your consent to analytics at any time; this does not affect processing that took place before the withdrawal;
- complain to the Personal Data Protection Service of Georgia (pdps.ge) or, if you are in the EU, to the supervisory authority of your country.
To use these rights, fill in the request form or write to info@aimap.ge. We may ask you to confirm that the request comes from you. We aim to respond within 10 working days.
Age
AI MAP is intended for people aged 18 or over. We do not knowingly collect children's data. If you believe a child has given us their data, write to info@aimap.ge and we will delete it.
How we protect data
The website works only over HTTPS. Database access is limited by row-level security rules (RLS), documents are kept in private storage, and only a small number of staff have administrative access. No safeguard removes all risk. If a breach affects your data, we will inform you and the regulator in the cases and within the time limits required by law.
Changes to this policy
If we change this document, the new version will appear on this page with a new date. We will also announce significant changes on the website or by email.
Contact
Questions about personal data: info@aimap.ge.