Privacy notice · Apraiz

This notice explains what personal data Apraiz collects on this site before launch, why we collect it, what we are allowed to do with it, who else handles it, how long we keep it and what you can require of us. It is written to cover everything Article 13 of the GDPR requires us to tell you.

1. Who is responsible for your data

Apraiz Europe OÜ is the data controller for everything described in this notice. That means we decide why and how your personal data is used, and we are the ones you can hold to it.

Registered office: Peetri tn 11, 10415 Tallinn, Estonia.
Registry code: 17472217, in the Estonian Commercial Register, where the company was first entered on 31 March 2026.
VAT number: EE102971367.
Email: contact@apraiz.eu.

For anything about your data, including any of the requests in section 9, write to that address and put "data protection" in the subject line.

We are established in the European Union, so we do not need an Article 27 representative. We have not appointed a data protection officer: we do not carry out large-scale monitoring or process special categories of data, so Article 37 does not require one. If that changes we will name one here.

2. What this notice covers

It covers apraiz.eu and the pre-launch waitlist. The Apraiz product is not open yet. When it opens, valuing a property will involve more data than a waitlist signup does, and we will publish a fuller notice before that happens rather than stretching this one to cover it.

3. What we collect, and where it comes from

If you join the waitlist

You give us:

Your email address. Required. Without it there is nothing to add to a waitlist.
The country you select. Optional. You can leave it on the placeholder and still join.
Your consent, and the moment you gave it. We record that you ticked the box so that we can show, if we are ever asked, that we had your permission.

And we record automatically, from the request itself:

Your IP address as our servers see it, and the user agent string your browser sends, which names your browser and operating system. We keep the first address in the forwarding chain and the first 500 characters of the user agent.
A random identifier for the row, and the time it was written.

We do not ask for your name, your phone number, your address or anything about a property, and there is nowhere on this site to give them to us.

If you only read the site

Our host writes ordinary server logs, which include IP addresses, and our analytics tools record which pages were viewed. Section 5 sets out exactly what each tool does and which of them needs your permission first.

4. Why we use it, and our lawful basis for each purpose

The GDPR requires a lawful basis for every purpose, not one basis for the whole site, so they are listed separately.

To email you when Apraiz opens in your country. Lawful basis: your consent, Article 6(1)(a). This is the only thing your email address is for. We do not run a newsletter and we do not have any other mailing list to move you onto.
To keep a record that you consented. Lawful basis: our legal obligation under Article 7(1), which requires a controller relying on consent to be able to demonstrate it.
To know which countries people are signing up from, so we can decide where to open next. Lawful basis: legitimate interests, Article 6(1)(f). Our interest is in planning where to launch. We use the country you chose, and we look at it in aggregate rather than by person.
To keep the form from being abused, and to investigate if it is. This is what the IP address and user agent are for. Lawful basis: legitimate interests, Article 6(1)(f). Our interest is in a signup list that is real rather than stuffed by a script, and in being able to tell the difference.
To measure how the site is used. Lawful basis: your consent for Google Analytics, which is why it does not run until you allow it, and legitimate interests, Article 6(1)(f), for the cookieless counting described in section 5. Our interest there is in knowing which pages are read at all.

Where we rely on legitimate interests we have weighed our interest against your privacy. The data involved is limited, it is not used to build a profile of you, it is not combined with anything else about you, and you can object to any of it under section 9.

5. Cookies and anything else stored on your device

Estonian law implementing the ePrivacy Directive says that storing or reading anything on your device needs your permission first, unless it is strictly necessary to provide what you asked for. Three things are worth separating here.

Google Analytics. Sets cookies named _ga and _ga_ followed by our property id, which last up to two years and let Google recognise a returning browser. This needs your consent, and it does not load until you give it. If you say no it is never loaded, and if you change your mind and withdraw, we delete those cookies.
Umami. Counts page views without cookies. It stores nothing on your device and reads nothing back, so it falls outside the consent rule and it runs whatever you choose above. It does not track you between sites or between visits.
Strictly necessary storage. A single entry recording your cookie answer, so we do not ask again on every page. Members of Apraiz staff who sign in to the internal admin area also get a session cookie named apraiz_admin. Neither of these needs consent and neither is used to track anyone.

The fonts on this site are served from our own servers rather than fetched from Google Fonts, so simply loading a page sends nothing to a font provider.

Change your mind

You can also clear cookies in your browser settings, which resets the question.

6. Who else handles your data

We do not sell your personal data. We do not share it with estate agents, brokers, advertisers or data brokers, and we never will. The only third parties who touch it are the suppliers who run our infrastructure, each under a written data processing agreement that forbids them from using it for anything of their own:

Google Cloud, which hosts the site and stores the waitlist. Acts as our processor.
Google Analytics, if and only if you allowed it in section 5.
Umami, for the cookieless page counts.

We may also disclose data if a law or a court order requires it. If that ever happens we will tell you unless we are forbidden from doing so.

7. Where your data is stored, and transfers outside the EEA

The waitlist is stored in Google BigQuery in the European Union multi-region, and the site itself runs in Google's europe-west1 region in Belgium. So the data at rest stays in the EU.

Two things can still involve a transfer outside the European Economic Area. Google may access data from outside the EEA for support and maintenance, and Google Analytics, if you allow it, sends data to Google in the United States. Both are covered by Google's Cloud Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses, and Google LLC is certified under the EU-US Data Privacy Framework, which the Commission has found provides an adequate level of protection. You can ask us for a copy of the safeguards that apply by writing to the address in section 1.

8. How long we keep it

Your waitlist entry is kept until Apraiz has opened in your country and you have had a fair chance to create an account, or until you ask us to remove it, whichever comes first. We review the list at least once a year and delete entries that no longer have a purpose, so it is not kept indefinitely on the chance that we might launch one day.
The record of your consent is kept for as long as we rely on it, and for one year afterwards, so that we can answer a complaint about whether we had permission.
IP address and user agent are deleted with the waitlist entry they belong to, and sooner if the abuse question they exist to answer has been settled.
Server logs are kept for the short period our host retains them.
Analytics is kept in aggregate. It is not linked to your waitlist entry and we cannot look you up in it.

9. Your rights

Under the GDPR you can ask us to do all of the following.

See your data. Get a copy of what we hold about you, Article 15.
Correct it. Have anything inaccurate put right, Article 16.
Delete it. Have it erased, Article 17.
Restrict it. Have us hold it but stop using it while a dispute is settled, Article 18.
Take it with you. Receive it in a machine-readable format, or have us send it to someone else, Article 20.
Object. Object to any use we base on legitimate interests, Article 21. Where you object to direct marketing we must stop, with no balancing test.

You can withdraw your consent at any time, using the unsubscribe link in any email we send or by writing to us. It is as easy to withdraw as it was to give. Withdrawing does not make what we did before it unlawful, and it does not cost you anything.

We answer within one month. We do not charge for any of this. If we ever needed to refuse a request we would tell you why and tell you how to challenge it.

10. Complaining to a regulator

If you think we have handled your data badly, please tell us first so we can fix it. You do not have to, and you are entitled to complain to a data protection authority instead or as well.

Ours is the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, aki.ee. You can also complain to the authority in the EU country where you live or work, or where you think the problem happened.

11. Do you have to give us anything?

No. Nothing on this site asks for personal data by law or under a contract. Joining the waitlist is voluntary. If you do not give us an email address we simply cannot tell you when we open, and nothing else follows from it.

12. Automated decisions and profiling

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you. Joining a waitlist triggers nothing but a row in a table.

When the product opens, an Apraiz valuation will be produced by an automated model. That is a value for a property rather than a decision about a person, and the notice we publish then will explain how it works.

13. Children

This site is meant for adults. We do not knowingly collect data from children. If you believe a child has given us their email address, tell us and we will delete it.

14. Keeping it safe

The site is served over HTTPS only. The waitlist is held in a managed Google Cloud database that is encrypted at rest, reachable only by the site's own service account, and protected against accidental deletion. Access is limited to the people who need it.

15. Changes to this notice

If we change what we collect or why, we will update this page and change the date at the top. If a change matters to you, for example a new purpose for your email address, we will ask you again rather than rely on an old yes.