Privacy Policy

Axia Home (axiahome.gr) provides free AI-powered property valuation estimates based on real market data for Thessaloniki, Greece. This Privacy Policy describes what data we collect, why we collect it, and how we protect it, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

When you use our service, we collect:

• Contact details: First name, last name, email address.
• Mobile phone number: Used exclusively for identity verification via OTP (one-time password). Stored only as a cryptographic hash (HMAC-SHA256) — the actual number is never stored in readable form.
• Property details: Type, location, surface area, year of construction, condition, and other characteristics you enter in the estimation form.
• Technical data: IP address (used only for rate limiting — abuse prevention) and functional session cookies.

We do not use your data for advertising purposes, we do not sell it to third parties, and we do not send marketing emails without separate consent.

• OTP session: Automatically deleted within 10 minutes of creation or immediately after successful verification.
• Valuation results: Retained for 30 days and then automatically deleted.
• Lead data (contact details + estimate): Retained for up to 2 years for service improvement purposes, unless you request earlier deletion.
• System logs: Up to 90 days.

Data is stored in a PostgreSQL database hosted by Neon (EU, central European data centre) and on Vercel servers (CDN within the EEA).

All providers have signed Data Processing Agreements (DPA) and comply with GDPR. We do not transfer data to countries outside the EEA without appropriate safeguards (standard contractual clauses).

We use only strictly necessary session cookies to maintain the state of your estimation form and OTP verification. We do not use third-party, advertising, or analytics cookies without your explicit consent.

You have the right to:

• Access — receive a copy of your data.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — request permanent deletion of your data.
• Restriction of processing — limit how your data is used in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdrawal of consent — at any time, without retroactive effect.

To exercise any right, contact us at privacy@axiahome.gr. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA — www.dpa.gr).

We implement technical and organisational measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Phone number stored exclusively as a cryptographic hash (HMAC-SHA256).
• OTP codes stored as hashes — never in readable form.
• Rate limiting to prevent abuse.
• Database access restricted to authorised personnel only.

We may update this Policy from time to time. The date of the last revision appears at the top of this page. For material changes, we will notify you with a prominent notice within the service.

For any questions regarding the processing of your personal data, contact us at: privacy@axiahome.gr