Privacy Policy

1. Data Controller

CROSS.GE (cross.ge) is an online car marketplace operating in Georgia. As the data controller, we are responsible for the processing of your personal data in accordance with the Law of Georgia on Personal Data Protection (No. 3144/2023).

2. Data We Collect

• Phone number — for account registration and verification
• Name — displayed to other users on your listings
• Listing data — vehicle information, photos, prices you publish
• Messages — communications between users via the built-in chat
• Usage data — pages visited, search queries (anonymized, no third-party tracking)
• IP address hash — a one-way cryptographic hash of your IP address (not the IP itself) used to prevent view count manipulation

3. Purpose of Processing

• Account creation and authentication via OTP
• Publishing and managing car listings
• Enabling communication between buyers and sellers
• Ensuring platform security and preventing fraud
• Improving the service based on anonymized usage patterns

4. Legal Basis

We process your data based on: (a) your consent when creating an account; (b) contract performance — providing the marketplace service; (c) legitimate interest — platform security and fraud prevention.

5. Data Storage

Your data is stored on secure servers within the EU (Supabase infrastructure). Data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days.

6. Cookies & Local Storage

We use strictly necessary cookies for session management and authentication (cross_session). If you accept optional analytics, we store anonymized browsing signals locally on your device (localStorage) to personalize recommendations. This data never leaves your browser unless you choose to share it. We do not use third-party tracking or advertising cookies. No data is shared with advertising networks. You can change your cookie preferences at any time via the cookie banner.

7. IP Hash Collection for View Tracking

8. Your Rights

Under Georgian data protection law, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your account and all associated data
• Right to restriction — limit how your data is processed
• Right to portability — receive your data in a structured format
• Right to object — object to data processing
• Right to withdraw consent — at any time without affecting prior processing

9. International Data Transfer

Your data may be stored on servers located in the EU. The EU is recognized as providing adequate data protection. No data is transferred to countries without adequate protection guarantees.

10. Children's Privacy

Our service is intended for users aged 16 and older. We do not knowingly collect data from children under 16. If we discover that a child under 16 has created an account, we will promptly delete it.

11. Supervisory Authority

You have the right to lodge a complaint with the Personal Data Protection Service of Georgia (PDPS) at pdps.ge if you believe your data protection rights have been violated.

Contact

For any questions regarding your personal data, contact us at: support@cross.ge