What personal data we collect, why, how long we keep it, and your rights.
Who is responsible
Bina Al ([Street, Baku, Azerbaijan]) is responsible for personal data processed through Bina Al. Contact us about privacy at [email protected].
We process personal data in line with the Law of the Republic of Azerbaijan “On Personal Data” and, for visitors from the European Economic Area, the GDPR.
What we collect
Account data: your email address, name (optional), preferred language, plan, and a one-way hash of your password. We never store your password itself.
Payments: the plans you bought, amounts, currencies, dates and status. For Azerbaijani cards: Epoint’s transaction ID, the masked card number (for example 416973******1234) and a card token issued by Epoint for renewals. For international cards and PayPal: Lemon Squeezy’s subscription, customer and invoice IDs, the card brand and last four digits, and invoice links. We never receive your full card number, expiry date or CVV.
Sign-in sessions: a hash of your session token, when it was created and last used, its expiry date, and your browser’s user-agent string.
Things you save: favorite listings, saved searches and their alert settings, and the notifications we create for you.
Web server logs: for every request, your IP address, the date and time, the page or API address requested, the response status, the referring page, your browser’s user-agent string and, when traffic passes through Cloudflare, its request ID.
Analytics: Google Analytics 4 records pages viewed, approximate location (city or country), device and browser type, and how you interact with the site. If you accept analytics cookies, it uses cookies with random identifiers and, when you are signed in, your account number (never your email). Before you choose, and if you reject, it only receives cookieless measurements: no cookies, no identifier stored on your device, and nothing that links them to you.
Ads: pages of Bina Al can show ads served by Google AdSense. To choose and deliver an ad and to detect fraud, Google receives your IP address, browser and device information and the address of the page. These ads are non-personalised (see Who else is involved).
Your IP address is also kept briefly in memory to limit repeated sign-in attempts and daily free-plan limits.
If you browse without an account, we keep only web server logs and, if you accepted them, analytics data.
Listing data
Listings come from public pages of bina.az and may include names that sellers or agencies chose to publish. We show this information only to help people evaluate listings, and we link to the original. To have a listing corrected or removed, contact bina.az or the seller. To remove it from Bina Al, email [email protected].
Why we use it
To provide your account, favorites, saved searches and alerts (performance of our agreement with you).
To charge for paid plans and renew them (performance of our agreement with you), and to keep payment records as required by tax and accounting law (legal obligation).
To keep the service secure and prevent abuse, for example by rate-limiting sign-in attempts (legitimate interest).
To apply your plan’s limits (performance of our agreement with you).
To operate, secure and troubleshoot the service using web server logs (legitimate interest).
To understand how the site is used and improve it with Google Analytics: with cookies only with your consent; without consent only as anonymous, cookieless measurements (our legitimate interest in counting visits). You can change your choice at any time under “Cookie settings” in the footer.
To show ads from Google AdSense, which help keep Bina Al free to use (legitimate interest). The ads are non-personalised and don’t use advertising cookies.
We don’t sell personal data. Apart from Google showing the non-personalised ads described here, we don’t share it for advertising or any other third-party purpose.
How long we keep it
Account data, favorites and saved searches: until you delete your account.
Sign-in sessions: 30 days, or until you sign out.
Notifications: 90 days.
Payment records: as long as tax and accounting law requires, even after you delete your account.
Web server logs: rotated automatically and normally kept no longer than 30 days.
Google Analytics data: up to 14 months, then deleted by Google.
Cloudflare logs: according to Cloudflare’s own retention policy.
Database backups: kept for 14 days, so data you delete disappears from backups within 14 days.
When you delete your account in your profile, your account, sessions, favorites, saved searches and notifications are deleted immediately, and any subscription stops renewing. Payment records are kept as described above.
Who else is involved
We don’t sell personal data or share it with third parties for their own purposes. These providers process data on our behalf to run the service:
Our hosting provider stores the servers and databases.
Epoint (epoint.az) and the card-issuing bank process Azerbaijani card payments. You enter your card details on Epoint’s payment page, not on our site, and they are handled under Epoint’s own terms and privacy policy.
Lemon Squeezy (lemonsqueezy.com) sells our plans to you as our reseller (merchant of record) when you pay with an international card or PayPal. It receives your email, name, billing country and payment details on its own checkout page, and handles them under its own terms and privacy policy; we receive the subscription status, plan, amounts and the card brand and last four digits.
Cloudflare protects and speeds up the site. All traffic passes through Cloudflare, which processes IP addresses and request data and keeps its own logs under the Cloudflare Privacy Policy.
Google (Google Analytics 4 and Google Tag Manager, linked to our Firebase project bina-al) receives usage data: with analytics cookies if you accept them, otherwise only cookieless measurements (Google Consent Mode). Advertising storage, ad personalization and Google signals are always off.
Google (AdSense) shows ads on Bina Al. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this and other websites; Google’s advertising cookies let it and its partners serve ads to people based on their visits to this site and other sites on the internet. On Bina Al we don’t allow this: Google Consent Mode tells Google that advertising storage and ad personalisation are denied, so it shows only non-personalised ads without advertising cookies. You can opt out of personalised advertising from Google at adssettings.google.com, and from other vendors at www.aboutads.info. How Google uses data from sites that show its ads: policies.google.com/technologies/partner-sites.
Listing photos load directly from bina.az’s image servers, so those servers see your IP address when you view photos.
Maps load OpenStreetMap data from OpenFreeMap’s servers, which see your IP address when you view a map.
If you turn on browser notifications, your browser gives us a push address run by its maker (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). We send the notification text through that service to your browser. We store the push address until you turn notifications off or it stops working.
If you allow notifications in the Bina Al mobile app, the app gives us a device token from Google’s Firebase Cloud Messaging, which delivers the notifications to your phone. We store the token with the app’s language and your buy/rent choice (and your account, if you are signed in) until you turn notifications off or uninstall the app.
Your rights
You can view and correct your details and delete your account at any time in your profile. You can also ask us for a copy of your data, to correct it, to restrict or object to processing, or to delete any data we hold about you, including web server logs and analytics data linked to you, by emailing [email protected]. We reply within 30 days. You can also complain to the data protection authority where you live.
Security
Passwords are hashed with scrypt, session tokens are stored only as hashes, and sign-in attempts are rate-limited. No system is perfectly secure; if you think your account was compromised, change your password, which also signs out your other devices, and contact us.
Children
Bina Al is not intended for anyone under 18, and we don’t knowingly collect their data.
Changes
If we change this policy, we’ll update the date at the top and, for significant changes, tell signed-in users in the app.
