Domie Privacy Policy
This policy explains how Domie handles personal data about:
• residents, meaning people who use the Domie resident app on iOS, Android or the web, and people listed in a Residency's resident register;
• partner staff, meaning people who use the Domie partner panel for a Residency or a service Provider;
• Providers, meaning service businesses and their staff in the Domie marketplace;
• visitors and leads, meaning people who visit our website or contact us.
1. Who we are
Your country · Domie company responsible
Azerbaijan · [COMPANY LEGAL NAME – AZ], VÖEN / reg. no. [REG NO], [ADDRESS] [CHECK: not yet registered]
Other countries · [COMPANY LEGAL NAME – EE] OÜ, registry code [REG NO], [ADDRESS], Estonia
Privacy contact: [PRIVACY CONTACT EMAIL]. Data protection officer: [DPO NAME / CONTACT, or "not appointed"]. [CHECK: whether a DPO is mandatory, given regular and systematic monitoring at scale is unlikely; and whether the AZ company needs a named responsible person under Law 998-IIIQ]
2. Laws that apply
• Azerbaijan: the Law of the Republic of Azerbaijan "On Personal Data" No. 998-IIIQ (2010, as amended) and related regulations, including the rules on cross-border transfer and on registering personal data information systems. [CHECK: current amendments and the competent supervisory authority]
• Estonian company / EU: the EU General Data Protection Regulation 2016/679 (GDPR) and the Estonian Personal Data Protection Act.
• Kazakhstan, Uzbekistan, Georgia and other countries: a local addendum will be added before we launch there. Kazakhstan requires personal data of its residents to be stored in Kazakhstan. [CHECK]
3. Who is responsible for what (controller and processor)
Your data can be handled by Domie, by your Residency or by a Provider, each in a different role. In plain terms:
Data · Who decides (controller) · Domie's role
The Residency's resident register: names, phones, emails, apartment, ownership or tenancy, household members, car plates, staff notes · Your Residency · Processor: we store and process it on the Residency's instructions
Residency fees: tariffs, balances, debts, cash or bank payments recorded by staff, receipts, settlement reports · Your Residency · Processor
Requests, announcements and polls between you and your Residency, and gate or reception lookups by Residency staff · Your Residency · Processor
Your Domie account: phone number, name, profile, language, settings, sign-in and device data, push tokens · Domie · Controller
Membership verification: your request to join, and whether you are verified · Domie and the Residency, each for its own part: Domie runs the request and the account status, and the Residency decides on approval and updates its register [CHECK: joint controllership vs separate controllers] · Controller for its part
Payments you make in the app: transaction records, payment tokens, masked card details · Domie (record of the transaction, fraud prevention, accounting) and the Residency for fee payments (its own ledger). The PSP is an independent controller for card processing · Controller
Services marketplace: orders, addresses, notes, messages, reviews, disputes, proof-of-visit photos · Domie for running the marketplace. The Provider is an independent controller of what it receives to carry out your order · Controller
Community features: forum, lost and found, marketplace listings, group activities, reports and moderation · Domie. For residency-only areas, Residency staff may also moderate · Controller
Partner staff accounts: name, work email, phone, role, sign-in and audit logs · Domie for account security and audit. Your employer (the Residency or Provider) for managing its staff · Controller
Support tickets and legal requests · Domie · Controller
Website visitors, leads and demo requests · Domie · Controller
What this means for you:
• Questions about your fees, balance, apartment details or being in the resident register go to your Residency. We'll help pass the request on.
• Questions about your Domie account, payments in the app, services, community content or this policy go to Domie.
• If you register without a subscribing Residency, only Domie (and Providers you book) handle your data.
4. What we collect and why
Category · Examples · Source · Purpose · Legal basis (GDPR, and AZ equivalent) [CHECK: mapping to AZ Law 998-IIIQ grounds, which rely more on consent]
Identity and contact · Name, surname, phone number, email (optional), username · You; your Residency's register · Create and secure your account, sign-in by SMS code, contact you · Contract
Residence · Residency, building, block, floor, apartment, role (owner, tenant, family), household members, car plates · You; your Residency · Verification; show your residency features; gate and reception lookups · Contract; for register data, the Residency's legitimate interest or legal duties (as controller)
Location · Device location, only when you tap "My location" to find your residency or set an address · Your device · Find your residency on the map; service addresses and service areas · Consent (device permission)
Payments · Amount, date, purpose, status, receipt, PSP transaction ID, card token, masked card details (brand and last 4). We never see or store full card numbers or CVV · You; the PSP · Process payments, receipts, refunds, reconciliation, fraud prevention, accounting · Contract; legal obligation (accounting and tax)
Orders · Services booked, slots, service address, entrance, intercom, contact phone, notes, cancellations, reschedules, disputes, reviews · You; Providers · Run the marketplace, payments, refunds, disputes, quality and ranking · Contract; legitimate interest (marketplace safety and quality)
Photos and content · Lost and found photos, forum posts, marketplace listings, comments, proof-of-visit photos from Providers, profile photo · You; other users; Providers · Show your content; resolve disputes; moderate · Contract; legitimate interest (dispute evidence, safety)
Communications · Support chats, requests to your Residency, feedback, reports · You · Answer you; handle complaints and moderation · Contract; legitimate interest
Notifications · Push token, notification preferences, SMS and notification logs · Your device; our systems · Send service notices you need (orders, payments, security) and, if you agree, optional news · Contract; consent for marketing
Technical · IP address, device and app version, OS, language, crash and error logs, security logs · Your device · Keep the service working and secure; prevent fraud and abuse · Legitimate interest
Partner and Provider business data · Organisation name, VÖEN or registry code, signatories, bank account (IBAN), staff names, roles and permissions, activity logs, ratings and reliability metrics · The Partner; public registers · Onboarding and verification, payouts, security, ranking · Contract; legal obligation; legitimate interest
Leads · Name, work email, phone, residency name and size, ad campaign data · Website forms; ad platforms · Reply to enquiries, sales follow-up, measure campaigns · Legitimate interest; consent for marketing cookies
Special categories. We don't ask for health, religious, biometric or similar sensitive data. Please don't include it in posts, requests or notes.
Automated decisions. We don't make decisions with legal or similarly significant effects about you purely by automated means. Providers are ranked automatically by rating and reliability, as described in the Partner Terms. Simple automatic checks (for example matching your phone number to a residency register, or refusing a card that can't support a payment hold) can be reviewed by a person on request. [CHECK: whether automatic verification by phone match counts as an automated decision]
5. Who we share data with
• Your Residency. When you ask to join, we share your request (name, phone, apartment, role). Once you are verified, the Residency's authorised staff can see your membership, your fee payments made in the app and the requests you send it. Depending on their role, staff such as reception or watchmen see only limited data, for example apartment, owner, balance, phone, car plates and household members shown as first name plus initial.
• Providers you book. We share your name, the service address with access details, your contact phone and your order notes.
• Other residents. These see what you choose to post. Marketplace listings show your name and phone number when someone taps "Show details". Residency-only content is visible to verified members of that Residency.
• Payment service providers. Currently [PSP NAME – Yigim / Epoint] in Azerbaijan, and [Stripe / other] for subscriptions billed by the Estonian company. They process card payments as independent controllers under their own privacy policies.
• Sub-processors that host or deliver the service for us (section 6).
• Authorities. Where the law requires it, or to protect rights and safety, we check each request.
• A buyer or successor, if all or part of our business is sold or reorganised, under the same protections.
We don't sell personal data, and we don't share residents' personal data with Residencies that don't subscribe. To invite a building to subscribe, we only use aggregated counts (for example "40 residents of your building use Domie"), never names or contact details, and never counts below [5]. [CHECK]
6. Sub-processors
Sub-processor · Purpose · Location
DigitalOcean, LLC · Cloud hosting, database, backups · Frankfurt, Germany (EU)
[PSP NAME] · Payment processing (independent controller for card data) · [Azerbaijan]
[SMS PROVIDER] · SMS sign-in codes and notices · [LOCATION]
Apple (APNs), Google (Firebase Cloud Messaging), Expo · Push notifications · [USA / EU]
[EMAIL PROVIDER] · Transactional email (partner invites, password reset, receipts) · [LOCATION]
[MAPS PROVIDER] · Maps and address search · [LOCATION]
[ERROR MONITORING / ANALYTICS, if any] · Crash reports and product analytics · [LOCATION]
[SUPPORT TOOL, if any] · Customer support · [LOCATION]
[CHECK: this list must be final before launch; the current build uses fake SMS, push and payment providers. Partners get 30 days' notice of changes]
7. International transfers
Our main servers are in Frankfurt, Germany (EU). If you are in Azerbaijan or another non-EU country, your data is transferred to the EU. Some sub-processors (for example push notification services) may process data in the USA or elsewhere.
• From Azerbaijan: we transfer data abroad only as Law 998-IIIQ allows, for example to countries that provide adequate protection, or on another legal ground such as your consent or the performance of your contract. [CHECK: (a) whether the EU/Germany is treated as adequate under AZ rules; (b) whether separate written consent is needed at signup; (c) whether any category (e.g. payment data) must stay in AZ; (d) info-system registration]
• From the EU (Estonian company): for transfers outside the EEA, we use adequacy decisions (for example the EU–US Data Privacy Framework, where the recipient is certified) or the European Commission's Standard Contractual Clauses.
• Kazakhstan: data of Kazakhstan residents will be stored on servers in Kazakhstan before we launch there.
8. How long we keep data
Data · Retention
Account and profile · While your account is active. After you delete it, there is a 30-day grace period, then deletion or anonymisation
Payment, receipt, invoice, commission and settlement records · As required by accounting and tax law: [5] years for the AZ company and 7 years for the Estonian company, after the end of the financial year. [CHECK: AZ Tax Code / Law on Accounting retention periods; Estonian Accounting Act §12 (7 years)]
Service orders and disputes · [3] years after the order ends (limitation period for claims), or longer where they form part of accounting records [CHECK: AZ civil limitation period]
Proof-of-visit photos · [90] days after the order is completed, or until any dispute is closed
Lost and found photos and posts · [90] days after the item is closed, or earlier if you delete them
Forum posts, listings and comments · Until you or a moderator delete them, or your account is deleted (then removed or anonymised)
Support tickets · [2] years after closure
Membership history with a Residency · While the Residency's subscription is active, then as the Residency instructs (see the Partner Terms)
Security and audit logs · [12] months. Admin audit logs: [3] years
SMS code logs · [90] days
Push tokens · Until you sign out, uninstall or the token expires
Leads (website) · [24] months after last contact, unless they become a customer
Moderation sanctions and fraud records · [2] years, so that repeat abuse can be prevented
The Residency decides how long its resident register and fee records are kept, within the limits of the law.
9. Your rights
Depending on the law that applies, you have the right to:
• access your data and get a copy;
• correct inaccurate data;
• delete your data (subject to records we must keep);
• restrict or object to processing based on legitimate interests;
• data portability;
• withdraw consent at any time, for example for location or marketing, without affecting earlier processing;
• complain to a supervisory authority:
• Azerbaijan: [COMPETENT AUTHORITY – CHECK];
• Estonia: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), www.aki.ee;
• your local authority in the EU.
To use your rights, use the app (Settings, Delete account, Saved cards, Notifications) or write to [PRIVACY CONTACT EMAIL]. We reply within one month [CHECK: the AZ response period may be shorter, so confirm it] and may need to verify your identity. Requests about data your Residency controls (section 3) are passed to the Residency.
Deleting your account: go to Settings › Delete account. You have 30 days to restore it by signing in. After that, we delete or anonymise your personal data, except for what we must keep (section 8). Content you posted in community areas is removed or shown as "Deleted user". Your Residency may keep its own records of your apartment and fee payments as its controller. If you have unpaid residency debt or an active booking, the app warns you first.
10. Age
Domie is not intended for children under 16, and we don't knowingly collect their data. Payments and bookings require you to be 18 or over. If you believe a child under 16 has an account, contact us and we'll delete it. [CHECK: age thresholds, as in the Resident Terms §3.1]
11. Security
We use:
• encryption in transit and [at rest];
• per-organisation data isolation and role-based access, so each staff role sees only what it needs;
• hashed passwords for partner accounts and SMS one-time codes for residents;
• two-factor authentication for Domie administrators;
• audit logs, backups and regular updates.
No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the authorities as the law requires. [CHECK: AZ breach notification duty and its timeline; GDPR requires 72 hours to the authority]
12. Cookies and similar technologies (web app and website)
Type · Used for · Can you refuse?
Strictly necessary · Keeping you signed in (a secure session cookie for the partner and admin panels; secure storage of the sign-in token for the resident web app), security, load balancing and remembering your language and theme · No. The service doesn't work without them, so no consent is needed
Analytics · [None at present.] If added, these help us understand usage · Yes, only with your consent through a cookie banner
Marketing (website only) · [Ad pixels, e.g. Meta / Google, for measuring lead campaigns] · Yes, only with your consent through a cookie banner
Mobile apps use device storage for the same strictly necessary purposes. You can clear cookies in your browser settings. [CHECK: Estonian ePrivacy rules (cookie-consent provision of the Electronic Communications Act) and AZ requirements; whether local storage of the token needs to be disclosed this way]
13. Marketing messages
We send service messages (orders, payments, security, account changes) as part of the service. We send news and promotions only if you opt in, and you can opt out at any time in Settings or by using the unsubscribe link. [CHECK: AZ rules on SMS and e-marketing consent]
14. Changes to this policy
We'll post updates here and tell you in the app before significant changes take effect.
15. Contact
[COMPANY LEGAL NAME – AZ / EE] · [ADDRESS] · [PRIVACY CONTACT EMAIL]