1 In short
This section is a summary and does not replace the full text below; each point is set out properly in the section that follows it.
- An email address is all an account needs. We do not ask for your name, ID number, phone number or address.
- No advertising and no tracking. The app carries no analytics, advertising or tracking tool, and the website sets no tracking cookie.
- We do not sell your data and pass it to nobody for advertising or profiling.
- We do not store IP addresses in the sign-in log.
- Your card details never reach us — payments are handled by a licensed payment provider.
- You can delete your account yourself, at any time, from the app or from a browser.
2 Who processes your data
Instalert is a service that watches the searches you save on public marketplaces and tells you when a new listing appears or a price drops. The controller of the personal data involved is the person identified in the contact details at the end of this page.
Any question, request or complaint about personal data can be sent to that same address, and will be answered there.
This policy applies equally to the Instalert mobile app, the website, and the service behind them.
3 What we process, why, and for how long
Every category we process is listed below. “Basis” is the ground for processing under Article 5 of the Law of Georgia on Personal Data Protection.
| Data | Why | Basis | Kept for |
|---|---|---|---|
| Your email address | Identifying the account, signing in, password reset | Performance of a contract | For as long as the account exists |
| Your password — only as a one-way hash | Keeping sign-in secure | Performance of a contract | For as long as the account exists |
| Your saved searches: the site, the category and the parameters you chose | The service's core function — watching that search | Performance of a contract | For as long as the account exists |
| Alert history: which listing matched which of your filters, and when | So the same alert is not sent twice and the history stays available to you | Performance of a contract | For as long as the account exists |
| Your device's notification identifier and platform (Android/iOS) | Delivering a push notification to the phone | Performance of a contract | Until the account is deleted or the app removed |
| Preferences: language, check frequency, quiet hours, sources switched off | Providing the service the way you configured it | Performance of a contract | For as long as the account exists |
| Sign-in log: the date, the time and which surface was used (app or website). No IP address | So you can see a sign-in that was not yours; protecting the account | Legitimate interest — account security | For as long as the account exists |
| Subscription and payment record: the plan, the amount, the status and the provider's transaction reference | Billing, receipts, resolving a dispute | Performance of a contract, and a legal obligation | The period required by tax and accounting law |
| If you sign in with Google or Apple — the identifier and verified email address that provider gives us | Letting you sign in with that account | Performance of a contract | Until you unlink it, or the account is deleted |
| Your correspondence, if you write to us | Answering your question | Legitimate interest — supporting the user | A reasonable period after it is answered |
A search you save can say a good deal on its own — that you are looking for a flat in a particular district, for instance. That is exactly why we use it only to send you the alert, and never for advertising, profiling, or passing to anyone else.
4 What you have to provide
Only an email address and a password are required — without them an account cannot be created or opened. Everything else you create by using the service: a filter is stored because you saved it.
Providing your device's notification identifier is not obligatory, but without it we have nowhere to send a push notification — alerts will only be waiting for you inside the app.
5 What we do not collect
- Your name, ID number, date of birth or home address.
- Your location — neither precise nor approximate.
- Contacts, photos, files, calendar, messages or call history.
- Card numbers or any other payment credentials.
- Special categories of data — health, beliefs, political opinion, biometrics.
- Advertising identifiers, or any other marker meant for an ad network.
The app contains no analytics, advertising or tracking tool of any kind. No cookie on the website is used for advertising or statistics — see “Cookies” below.
6 Who receives your data
We do not sell or trade data. It reaches another party only where the service cannot work otherwise, and only in the volume that particular task needs:
| Who | What they receive | What for |
|---|---|---|
| Google (Firebase Cloud Messaging) | Your device's notification identifier and the text of the alert — the listing's title and price | To get the push notification to your phone. On Android and iOS there is no other route |
| Our server infrastructure provider (European Union, Germany) | Data is stored on its secured infrastructure | Running the service. It has no independent access to the data and may not use it for its own purposes |
| A licensed payment provider | The amount and a transaction reference | Billing a paid plan. Card details are handled by the provider — we can neither see nor store them |
| An email delivery service | Your email address and the text of the message | Sending a password-reset link. It sends no other mail |
| A competent state authority | The volume the law requires | Only on a lawful and reasoned request |
The marketplaces never see you. The public listings on myauto.ge, myhome.ge, mymarket.ge, ss.ge, copart.com, livo.ge, myparts.ge and myjobs.ge are read by our server, not by your phone. Those sites never see your identity, your IP address or your device, and we tell them nothing about you.
7 Data leaving Georgia
The service's infrastructure is in the European Union (Germany). Your data is therefore stored in a country where appropriate data-protection safeguards apply.
Delivering a push notification passes your device identifier and the alert text to Google, which processes it on infrastructure in the European Union and the United States under standard contractual clauses and its own data-protection commitments.
We send your data to no other country and for no other purpose.
8 How long we keep it
- Account data is kept for as long as the account exists. Deleting the account removes the account, its filters, its alert history, its registered devices and its sign-in log at once.
- Payment records remain for the period Georgian tax and accounting legislation requires — even after the account is deleted. That is a requirement of law, and neither we nor you can waive it.
- Public listing data — title, price, link — is not personal data and belongs to the marketplaces. It is deleted automatically once it has been absent everywhere for 90 days.
- Technical records kept for security are held briefly and used only to investigate a fault or an attack.
9 Your rights
The Law of Georgia on Personal Data Protection gives you the following rights, and we honour every one of them:
- To be informed — to learn whether your data is being processed, which data, for what purpose, and who receives it.
- To a copy — to receive a copy of your data.
- To correction and updating — where data is wrong or has gone out of date.
- To erasure — to have your data deleted. You can delete the account yourself, immediately, without asking us at all.
- To blocking — to have processing suspended while a request of yours is considered.
- To portability — to receive the data you provided in a structured, machine-readable form.
- To withdraw consent — where processing rests on consent, you may withdraw it at any time, as easily as you gave it.
- To object to an automated decision — see “Automated decisions” below.
To use a right, write to the address at the end of this page. You will have an answer within the period the law sets. If we cannot meet a request, we will say why.
Deleting your account needs no permission from us. In the app, Account → Delete account; in a browser, /account/delete. Deletion is final and cannot be undone.
10 Your right to complain
If you believe your data has been processed unlawfully, write to us first — most matters end there. Regardless, you may at any time apply to the supervisory authority or to a court.
In Georgia, supervision of personal data protection has since 2 March 2026 been carried out by the State Audit Office of Georgia, which took the function over from the Personal Data Protection Service.
11 Security
- All traffic between the app and the server is encrypted (HTTPS).
- Passwords are stored only as a one-way hash. The original is never stored and we cannot read it — which is exactly why nobody can “remind” you of your password, only help you set a new one.
- The database is not directly reachable from the internet.
- Access to data is limited to those who need it to run the service or to answer a message you sent.
No system is perfectly secure and we will not claim otherwise. If an incident occurs that genuinely puts your data at risk, we will notify you within the period the law sets, and notify the supervisory authority as well.
12 Cookies
The website uses only the cookies without which it cannot work. There is no advertising or analytics cookie, which is precisely why no banner appears asking you to accept any.
- A session cookie — to remember that you are signed in. It is cleared when you sign out.
- A language cookie — to remember whether you chose Georgian or English.
- A short-lived cookie during a Google or Apple sign-in — it exists only for the seconds that sign-in takes, and exists for security.
The mobile app uses no cookies at all.
13 Automated decisions
We take no decision about you — automated or otherwise — that produces a legal or similarly significant effect. We do not profile you.
The service does automatically compare listings against the search you saved, and sends you an alert on that basis. That is the carrying out of your own instruction, not a decision taken about you.
14 Age
The service is not directed at anyone under 16, and an account may be created from the age of 16. We do not knowingly collect the data of anyone younger. If we learn that such an account exists, we will delete it.
If you are a parent or guardian and believe a child has created an account, write to us and we will remove it.
15 Marketing and messages
We send no marketing email. The only message we send by email is a password-reset link, and only when you ask for one.
Push notifications are about your filters and nothing else, and you create them yourself: deleting or pausing a filter stops the notifications from it. You may still receive a rare non-promotional message about the service itself — a significant change to these documents, for example.
If we ever decide to send a promotional message, it will happen only with your prior consent, and withdrawing that consent will be as easy as giving it.
16 Changes to this policy
This policy may be updated — because a new feature appears, or because the law changes. The date of the last revision and the version are always at the top of this page.
We will tell you about a significant change in the app or by email before it takes effect. If you do not accept a change, you are free to delete your account at any time.
See also the terms of service.
17 Contact details
- Website
- instalert.ge