Privacy Policy

1. Data Controller

Cross.ge is an online car marketplace operating in Georgia, available at cross.ge. As the data controller, we are responsible for the processing of your personal data in accordance with the Law of Georgia on Personal Data Protection.

2. Data We Collect

• Phone number — for account verification and listing publication (SMS code)
• Email — for authentication, sign-up confirmation, password reset, and transactional notifications
• Name — displayed to other users on your listings
• Listing data — vehicle information, photos, prices you publish
• Messages — communications between users via the built-in chat
• Pseudonymized usage signals — viewed listings and search queries, stored only on your device (localStorage) to personalize recommendations. We do not use third-party analytics trackers.
• IP address hash — a one-way cryptographic hash of your IP address (not the IP itself) used to prevent view count manipulation

3. Purpose of Processing

• Account creation and authentication via OTP
• Publishing and managing car listings
• Enabling communication between buyers and sellers
• Ensuring platform security and preventing fraud
• Improving the service based on aggregated usage patterns

4. Legal Basis

We process your data based on: (a) your consent when creating an account; (b) contract performance — providing the marketplace service; (c) legitimate interest — platform security and fraud prevention.

5. Data Storage

Your data is stored on secure servers within the EU (Supabase infrastructure). Data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days.

5.1. Sub-processors

To deliver the service we use the following data processors, each bound by confidentiality and providing an adequate level of protection:

• Supabase (EU, Ireland) — database, file storage, authentication.
• Vercel (USA, SCC) — frontend hosting and serverless functions. Data transfer to the USA under Standard Contractual Clauses.
• Cloudflare (USA, SCC) — DNS, DDoS protection, Turnstile captcha. Turnstile collects anonymized browser behavioral signals (mouse movements, timing, fingerprint) to distinguish humans from bots; these signals are not linked to your account. Cloudflare also processes IP addresses and request metadata for security purposes.
• Resend (EU, Ireland) — transactional email (sign-up confirmation, password reset).
• Twilio (USA, SCC) — SMS for phone verification on the first listing publication.
• Anthropic (USA, SCC) — AI search query processing. Only the query text is sent, without account binding.
• Telegram — admin-only service notifications about registrations and errors.

6. Cookies & Local Storage

We use strictly necessary cookies for session management and authentication (cross_session). If you accept optional analytics, we store pseudonymized browsing signals locally on your device (localStorage) to personalize recommendations. This data never leaves your browser unless you choose to share it. We do not use third-party tracking or advertising cookies. No data is shared with advertising networks. You can change your cookie preferences at any time via the cookie banner.

7. IP Hash Collection for View Tracking

8. Your Rights

Under the Law of Georgia on Personal Data Protection, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your account and all associated data
• Right to restriction — limit how your data is processed
• Right to portability — receive your data in a structured format
• Right to object — object to data processing
• Right to withdraw consent — at any time without affecting prior processing

9. International Data Transfer

Primary data storage is in the EU (Supabase, Ireland). Part of the processing is performed by third-party providers in the USA (Vercel, Cloudflare, Twilio, Anthropic) — see section 5.1. Transfers to the USA are carried out under Standard Contractual Clauses (SCCs), which provide a level of protection equivalent to EU and Georgian law. No data is transferred to jurisdictions without such guarantees.

10. Children's Privacy

Our service is intended for users aged 18 and older. We do not knowingly collect data from children under 18. If we discover that a child under 18 has created an account, we will promptly delete it.

11. Security Incident Notification

In the event of a security breach that poses a risk to your rights and freedoms, we will notify you and the supervisory authority (the Personal Data Protection Service of Georgia, PDPS) within 72 hours of becoming aware of the incident, as required by the Law of Georgia on Personal Data Protection. The notification will describe the nature of the incident, the categories of data affected, the likely consequences, and the measures being taken.

12. Supervisory Authority

You have the right to lodge a complaint with the Personal Data Protection Service of Georgia (PDPS) at pdps.ge if you believe your data protection rights have been violated.

Contact

For any questions regarding your personal data, contact us at: support@cross.ge