Privacy policy

Operator and contact

SmallPlace Labs Ltd
info@smallplace.ge

Listings from public sources

Some listings are sourced from other public websites or company pages and include published descriptions, photos, advertiser names and contact details. Origin and page-check dates are recorded internally for verification. Managed listings may be published natively on SmallPlace without an off-site redirect. We use these details to help people contact advertisers about suitable spaces or business offers. Inclusion does not create a SmallPlace account or establish a partnership. For information about processing, corrections or removal, contact info@smallplace.ge with the listing link.

Listing drafts on this device

Text and fields for a new listing started before registration are saved in this browser’s localStorage; selected photos are saved in IndexedDB when supported. A draft is intended for continuation on the same device. It is not sent to the server until a signed-in user submits it. It is removed on the next visit after 7 days without a save, after successful submission, or when you choose Clear saved draft. Clear drafts after using a shared computer.

Google and Facebook sign-in

When you choose a provider, you are redirected to Google or Meta. SmallPlace verifies the response and stores the provider account identifier, name and supplied email address; your provider password is not sent to us. For marketplace sign-in alone, we do not request access to posts, contacts or social Page management. The separate SmallPlace AI connections are described below. Sign-in tokens are used for verification and are not retained permanently. The protected attempt cookie and encrypted state expire within 10 minutes; expired state is removed during subsequent authentication activity. Connecting an existing account requires the user to sign in first. Provider connections can be removed in My account; deleting the SmallPlace account also removes its provider identifiers. Google and Meta process sign-in data under their own policies.

Bot protection

Cloudflare Turnstile protects registration, confirmation-email resends and password-recovery requests. Cloudflare processes network, browser and device signals to detect bots and abuse. Our server validates a short-lived, single-use token. We do not use this check to build advertising profiles.

What we process

You can create an account using your email and password. Email accounts store your name, email and one-way password/recovery-code hashes, not the password or recovery code itself. We store the profile, listings, phone/email, address, cadastral code, coordinates, photos, saved spaces, private conversations and read status that you provide or generate. Hosting providers may also process IP addresses and technical security logs.

Purpose and basis

The intended legal basis for the account, listing, saved-space and messaging services you request is performance of the service agreement. Platform and user safety is the legitimate interest supporting security and abuse prevention. Moderation and abuse prevention protect the platform and its users. Account features require sign-in; a listing requires a title, location, terms and at least one contact method. Every listing, including business requests, requires at least one photo. Company, cadastral code and coordinates are optional. Without required data, the corresponding feature cannot be provided.

Who can see information

Approved listing content and its contact details are available to the site audience. Phone display requires a click; that is not a confidentiality or anti-scraping guarantee. Profile and sign-in emails are not automatically published. Private conversations are visible to their participants. Email/password registration requires confirmation using an emailed link. This checks access to the address and does not establish a person’s legal identity. Administrators have moderation and service-management access. Do not submit another person’s information without authority.

Providers and external services

The site uses hosting services and Cloudflare database and photo storage. Brevo processes recipient addresses and confirmation/reset emails. Brevo also processes technical email-delivery information. Confirmation links expire after 24 hours and reset links after 30 minutes; only their hashes are stored, and the links can be used once. Opening a map loads OpenStreetMap. Providers may process data outside Georgia. Providers process data under their applicable data-protection terms. Contact the operator at info@smallplace.ge for information about processing and international transfers.

Storage and controls

Profiles and records are kept while the service is used. My account lets you edit a profile/listing, delete a listing, download your profile, listing and saved-space data, and delete your email/password account using your current password and a separate confirmation. A secure session cookie lasts up to 30 days; sign-in abuse limits use 10-minute windows. Accounts are not automatically erased for inactivity. Deleting a listing also deletes its uploaded photos unless another saved listing uses them. Their direct links stop working once deleted. Removed photos are deleted when an edit is saved, unless another listing uses them. Unused uploads can be deleted in My account; unused uploads older than one day are cleaned up when the account is opened. If storage removal fails, access is revoked immediately and removal is retried on later account requests. Deleting a listing removes it from published results; its title and messages remain in existing conversations for participants. Deleting your account removes your profile, listings, uploaded photos, saved spaces, messages you sent, sessions and email confirmation/reset tokens. Other participants retain their own messages; your name and account identifier are replaced with an anonymous label, your listing titles are removed and the affected conversations close. Emails already received in a mailbox are not deleted by this action. Language and currency preferences are stored in this browser. We do not add advertising trackers to marketplace pages or send promotional email through its account-notification system. SmallPlace AI social publishing is described separately below.

Email notifications

We use Brevo to email verified account addresses about new private conversations and listing approval or return for changes. Private message text is not emailed; return emails include the administrator’s note. One email alerts you to an unread conversation; another can arrive after you read it and receive a new message. You can switch message emails off in My account. This does not disable listing or account-security emails. Delivery-queue entries contain account and record identifiers and delivery status; they are removed after 30 days during the next queue processing. Temporary failures are retried during subsequent site activity.

Visitor statistics

We use Cloudflare Web Analytics to measure visits, referrers, popular pages and loading performance. Its beacon uses no analytics cookies or visitor identifiers stored in browser storage. Cloudflare processes page paths, referrers, device/browser type, country and performance metrics; it does not log query strings in analytics. Cloudflare states that it discards the source IP address at its nearest data center and does not store it in core RUM databases or logs. Cloudflare reports cover the previous six months. Separately, our Cloudflare D1 database stores only daily totals for visits, page views and registration, listing and enquiry forms opened, successfully submitted or closed before completion. To estimate visits, temporary sessionStorage in the browser tab holds only the last page-view time (smallplace-activity-time); this is not a visitor identifier and is never sent to the server. It is cleared when the tab is closed. A new visit starts after a 30-minute gap between page views. Visits estimate tab sessions, not unique people. Opening or reloading a page, or returning with Back/Forward, adds a page view. These counters contain no names, email addresses, passwords, text, account/visitor identifiers or IP addresses. Counters older than 90 days are removed during the next analytics operation. Our analytics code skips administration, email-confirmation and password-reset pages and respects browser Do Not Track / Global Privacy Control signals. We use the statistics to improve the service and do not build individual advertising profiles.

Automatic listing review

Listing text, fields and edits are checked against SmallPlace rules for sufficient detail, placeholders, links and possible duplicates. Monthly rent below GEL 100 or above GEL 50,000, or a total sale price below GEL 1,000 or above GEL 5,000,000, and phone numbers, email addresses or WhatsApp/Viber/Telegram in descriptions require administrator review. USD prices are checked in GEL using a current official rate; without one it requires human review. Every listing, including business requests, requires at least one photo; submission or publication without one is blocked. Property offers without a cadastral code cannot publish automatically. A submission may be published, returned with a note or sent to an administrator. New photos require administrator approval before publication. Unchanged, previously approved photos do not need another approval. Every edit is checked again; listings awaiting review are hidden from public view. We retain the latest decision source, rule version, reasons, time and record revision. These checks do not verify ownership, legal identity or market value. Administrators can override decisions; contact info@smallplace.ge to request human review.

Recovery copies

Marketplace recovery copies, when created, are encrypted and subject to a 30-day retention period, with expired copies erased during the next automated retention check, and restricted to the operator. They cover database records and uploaded photos. A retained recovery copy may contain earlier data, including information later deleted from the live service. They are used only for recovery; obsolete copies must be erased and deletion requests reapplied before a restored service is reopened. Recovery does not reactivate old sessions or email links and requires passwords to be reset.

Your rights

You may request information, access/copies, correction, erasure, restriction and portability where applicable, and withdraw consent where processing relies on it. Reasonable identity verification may be needed. You may also complain to Georgia’s State Audit Office or a court.

SmallPlace AI and social-account connections

This policy also covers SmallPlace AI, SmallPlace Labs’ internal workspace for preparing, reviewing and publishing posts for its own Facebook Page, Instagram professional account and LinkedIn company Page. Only an administrator authorized to manage the account may connect it, by granting permissions on the platform’s own authorization page. Access and publishing require that authorization. These permissions are separate from ordinary Google or Facebook sign-in to SmallPlace.ge; using the marketplace does not require connecting a social Page. Each integration is available only when the platform has granted the required access and authorization remains valid.

Social connection data and its use

Within the permissions granted, we receive Page, organization and professional-account identifiers, Page names or Instagram usernames, administration roles, granted permissions, connection times and authorization expiry information. Access tokens let us verify account-management permissions and submit posts you approve. Application settings also retain the app identifier and secret. SmallPlace AI does not request or store your social-platform password. The current feature does not read private messages or friend lists, or collect other people’s profiles to build a marketing database. We do not sell received social data, provide it to data brokers or use it to build advertising audiences.

Drafts, approval and publication

The workspace stores draft text, links, uploaded images, the selected account, scheduled time, approval records, publication status, operator-entered business research/contact details and manual campaign totals. Drafts may use public listing details selected by an operator; marketplace sign-in data and private conversations are not automatically imported. AI draft generation does not itself publish a post. Publication requires review and approval of the exact content, account and time, followed by separate confirmation. The relevant platform receives the approved text, links, supported media and account identifier, and publishes the content under that Page’s visibility and platform rules. We retain the post identifier and link, time, status and error information to record delivery and prevent duplicate posts. The current version does not publish to groups or send private messages.

Storage, security and service providers

SmallPlace AI runs on a server hosted on Oracle infrastructure. Access tokens and application secrets are encrypted on the server, stored separately from workspace records and excluded from ordinary workspace exports. Access to the workspace and recovery copies is restricted. Service providers may process technical data needed for operation and security. The relevant Meta or LinkedIn service also receives data during connection checks and publication, under its own privacy policy. Processing may take place outside Georgia. Draft generation currently uses a local model running on our server; social authorization data is not used to train AI models. Security measures reduce risk but cannot guarantee absolute protection.

Disconnecting an account and revoking permissions

An authorized administrator can disconnect the relevant social connection in the Accounts section of SmallPlace AI. This removes the active connection and its access token from the primary store and blocks further publishing through that connection. Disconnection alone does not erase application configuration, drafts, approval and publishing history, or existing recovery copies. To revoke permission on the platform’s side, also remove access in LinkedIn or Meta settings. Marketplace account deletion and SmallPlace AI record deletion are separate controls; contact us about any listing information already copied to the marketing workspace. Disconnection or deletion from our storage does not remove posts already published on a social platform; manage those posts on that platform.

SmallPlace AI retention and recovery copies

Drafts, approvals and delivery records are not automatically erased merely through inactivity or disconnection. We retain them to continue the work, record outcomes and prevent repeat delivery, and remove them when no longer needed or following a verified request, subject to applicable legal and platform requirements. Each automatic SmallPlace AI backup series retains up to 14 daily snapshot dates; older copies are removed during the next successful run. Additional restricted maintenance or recovery copies are kept while needed and are also covered by deletion requests. These copies are separate from marketplace recovery copies and may contain earlier data later deleted from the primary store. Where needed to fulfill a deletion request, we clear or remove affected copies without waiting for normal rotation. After recovery, deletion requests must be reapplied before operations resume.

Request deletion of SmallPlace AI data

Send access, correction or deletion requests to info@labs.smallplace.ge or the privacy contact shown in this policy. Include “SmallPlace AI”, the public URL of the relevant Page or account, and the data you want deleted. We may reasonably verify your authority; do not send passwords, access tokens or application secrets. An administrator handles removal of the relevant connection data, tokens, configuration where requested, workspace records and affected recovery copies. We handle requests promptly within applicable legal and platform deadlines; requests by an account manager to delete stored LinkedIn marketing data are completed within 10 days or sooner when required. If the law requires retaining particular information, we explain the reason and scope.

Email a SmallPlace AI data-deletion request