Privacy Policy

1. Controller

HotList.ee is the controller of your personal data under the EU General Data Protection Regulation.

2. Data We Collect

• account data: email, phone and password hash
• age verification: a non-reversible provider-specific pseudonym that prevents one identity verifying multiple accounts; no name, personal code, date of birth or raw provider subject is stored
• listing data: alias, age, city, description, images and contact details
• payment data: payment method, amount, time and necessary payment references
• technical data: IP address, device information and essential cookies

3. Why We Use Data

• account management and authentication
• age verification
• publishing and moderating listings
• processing payments
• protecting platform security
• meeting legal obligations

4. Legal Basis

Processing is based on contract performance, legitimate interest and legal obligations.

5. Data Sharing

• payment partners for payment processing
• Smart-ID or Mobile-ID providers for age verification
• authorities where required by law
• other users only see contact details the listing owner added and that were unlocked with credits

6. Retention

We retain data while the account is active, where law requires it, or where needed for disputes.

After account deletion, personal data is deleted within 30 days except for legal exceptions.

7. Your Rights

• access your data
• correct inaccurate data
• request deletion
• restrict processing
• data portability
• object to processing and complain to the Estonian Data Protection Inspectorate

8. Security

• SSL/TLS encryption
• hashed passwords
• Supabase Row Level Security
• restricted admin access

9. Cookies

We use only essential and functional cookies. Advertising cookies are not used.

10. Changes

Privacy policy changes are communicated by email or system message.

11. Contact

Privacy questions: privacy@hotlist.ee

Estonian Data Protection Inspectorate: www.aki.ee