Privacy Policy

1. Scope

This Privacy Policy explains what personal data michati.com (“michati”, “we”, “us”) collects when you use the michati.com website and the market-data pages it serves (the “Service”), why we collect it, and what you can do about it. It forms part of our Terms of Service.

The market data itself describes properties and geographic areas, not people. This policy is about the data we hold on you as a user of the Service.

2. Information You Give Us

When you create an account we collect your name, your email address, and a password. We never store the password itself — only a one-way cryptographic hash of it, from which the password cannot be recovered.

We also record that you accepted the Terms of Service and when, and whether and when you confirmed your email address. If you write to us, we keep that correspondence.

3. Information Collected Automatically

When you sign in we create a session and store a hash of the session token together with its expiry date. The token itself lives only in a cookie in your browser.

As with any website, our servers and hosting infrastructure process the technical details that come with each request — including your IP address, browser user-agent, the pages requested, and the time of the request — in order to serve the Service, keep it secure, and diagnose faults.

We do not use analytics, advertising, or third-party tracking on the Service, and we do not build behavioural profiles of you.

4. Cookies

We use one cookie: a session cookie that keeps you signed in. It is set when you sign in, it is marked HttpOnly and SameSite so that it is not readable by scripts and is not sent from other sites, and it is transmitted only over HTTPS in production. It lasts for the duration of your browser session, or for 30 days if you choose “remember me”. Signing out deletes it.

This cookie is strictly necessary to provide the Service — without it you cannot stay signed in. We set no analytics or advertising cookies. Our bot-protection provider may set its own cookie on the registration and password-reset forms, as described in the next section.

5. How We Use Your Information

We use your data to create and administer your account, to authenticate you and keep you signed in, to send the emails the Service depends on (email verification and password reset), to keep the Service secure and prevent abuse, to comply with our legal obligations, and to reach you about material changes to the Service or to our terms.

We do not use your data for advertising, and we do not sell it.

6. Legal Bases

Where data-protection law requires a legal basis, we rely on: performance of our contract with you, for account creation, authentication, and service emails; our legitimate interests, for keeping the Service secure and preventing abuse; and compliance with legal obligations, where applicable.

7. Service Providers

We share personal data only with the providers we need in order to run the Service, and only to the extent they need it: our hosting and database infrastructure, which stores the data described above; our email provider, which delivers verification and password-reset messages and therefore processes your email address and name; and Cloudflare Turnstile, which protects the registration and password-reset forms against automated abuse and receives your IP address and a challenge token for that purpose.

These providers act on our instructions and may not use your data for their own purposes. We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims.

Some of these providers operate outside your country. Where personal data is transferred internationally, we rely on the safeguards those providers offer, such as standard contractual clauses.

8. Retention

We keep your account data for as long as your account exists. If you ask us to delete your account, we delete the account record and the data attached to it, except where we are required to keep something longer by law.

Session records are deleted when you sign out and expire automatically after their lifetime; expired ones are cleared as they are encountered. Email verification codes expire within minutes and password-reset tokens within half an hour; both are stored hashed and are consumed on first use. Server and infrastructure logs are kept only for as long as they are useful for security and diagnostics.

9. Security

Passwords are stored only as modern one-way hashes. Session tokens, verification codes, and reset tokens are stored hashed as well, so a copy of our database does not yield anything that can be used to sign in as you. Access to production data is limited to those who need it.

No system is perfectly secure, and we cannot guarantee absolute security. Use a strong, unique password, and tell us promptly if you believe your account has been accessed without your permission.

10. Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to complain to your local data-protection authority.

You can view and update your name and email address, and change your password, from your account settings at any time. For deletion or any other request, contact us and we will respond within the period the applicable law allows.

11. Children

The Service is not directed at children. You must be at least 18 years old to hold an account, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. If a change is material, we will give notice through the Service or by email to the address on your account before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.