Legal

Privacy policy

Last updated 10 October 2026

Unitpick is a service for selling apartments on a picture of the building: developers outline their units, keep availability up to date and put the picker on their website, where buyers browse and send inquiries. This policy explains what personal data that involves, why, where it is kept and what you can ask of us.

Who we are

Unitpick is run by Yanki EOOD (ЯНКИ ЕООД), 58 Lyuben Karavelov St., floor 5, apt. 13, 9002 Varna, Bulgaria, company number (ЕИК) 103873992, VAT number BG103873992 (“we”). For anything about your data, write to hello@unitpick.app.

Two roles

• Our customers' accounts and this website. We decide how this data is used and are its controller.
• Buyers who use a picker on a developer's website (and send an inquiry there). The developer decides why and how that data is used and is its controller; we process it on their behalf, under our Terms. Questions about an inquiry you sent are best put to the developer; we will help them answer.

What we keep and why

If you have an account

• Your email address, to sign you in with a one-time link and to contact you about your account. Sign-ins are logged with time and IP address for security.
• Your projects: building pictures, floor plans, units, prices, statuses, settings such as a notification email or a webhook address. We keep them to run the service you asked for (performance of a contract).
• Usage counts for your projects (see below), shown only to you.

If you use a picker on a developer's website

• Nothing about you is stored while you browse. The picker sets no cookies. It counts anonymous daily totals per project (for example “the picker was shown”, “apartment 12 was opened”, “a floor plan was opened”, “a link was shared”) with no IP address, device id or other way to tell visitors apart.
• Favourites you save stay in your own browser (local storage) and are never sent to us.
• An inquiry you send holds your name, email, phone (optional), message, the unit and the page you sent it from. It is stored for the developer, shown in their dashboard and, if they set it up, emailed to them and sent to their own systems (for example a CRM). To stop abuse we also keep a one-way hash of your IP address combined with the project, never the address itself, and limit how many inquiries can be sent in a short time.

If you visit unitpick.app

No cookies and no advertising trackers. We count visits with Cloudflare Web Analytics, which sets no cookies and does not identify visitors: it records the page, where the visit came from, and the country and type of device, only as totals. Fonts are served from our own site. Our hosting provider processes your IP address briefly to deliver the pages and protect them from attacks.

Who else handles the data

We use a small number of providers, each only for what is listed here:

• Supabase: database, sign-in, file storage and server functions, hosted in the EU (Ireland).
• Cloudflare: hosting of unitpick.app and app.unitpick.app, DNS, visit counts for unitpick.app (Web Analytics) and forwarding of email sent to our address.
• Resend: sending sign-in emails and inquiry notifications.

Depending on what a developer adds to a project, a picker may also load content from OpenStreetMap (the map on the Location tab), or YouTube, Vimeo, Matterport or Kuula (videos and 3D tours). These load only when a visitor opens them and are subject to those providers' own privacy policies. In the app, finding a project's address on the map sends that address to OpenStreetMap's search service, and syncing a Google Sheet fetches the sheet the developer linked.

Where a provider processes data outside the EU, the transfer is covered by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account and project data: for as long as the account exists. Deleting a project deletes its pictures, units, statistics and inquiries.
• Inquiries: until the developer deletes them, or their project or account.
• Anonymous daily counts: for as long as the project exists.
• Backups made by our database provider are kept for a limited period and then overwritten.

Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to how it is used, or to receive it in a portable format. Write to hello@unitpick.app; we answer within a month. For an inquiry you sent through a developer's website, we pass your request to that developer. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the authority where you live.

Security

Data travels encrypted (HTTPS). Each customer can only reach their own projects; access is enforced by the database itself, not just the app. Webhooks are signed so customers can check they came from us.

Changes

If we change this policy in a way that matters, we will tell account holders by email before it takes effect. The date at the top shows the latest version.