Privacy Policy
Last updated: 5 October 2026
1. Who is responsible for your data
ListWatcher (listwatcher.org and the Telegram bot @listwatcherbot) is run by Dmitriy Shirochenko, a private individual based in Spain, who is the data controller for the personal data described here.
Contact for anything about your data: support@listwatcher.org
ListWatcher is free. It is not affiliated with or endorsed by Idealista.
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Account: email address, password (stored only as a secure hash), name (if you sign in with Google or type one), preferred language | To create and run your account and sign you in | Performing our contract with you (Art. 6(1)(b)) | Until you delete your account |
| Your search: the Idealista search link you paste, check frequency, and whether alerts are on or paused | To check that search for new listings | Contract (Art. 6(1)(b)) | Until you delete your account |
| Telegram: the chat ID(s) you connect (up to 5). When you connect with the Telegram button, Telegram also sends your name, username and profile photo link; we use them only to confirm the connection and show who is connected, and do not store them | To send you alerts | Contract (Art. 6(1)(b)) | Until you disconnect the chat or delete your account |
| Alert history: the listings we sent you (public listing details: title, price, size, rooms, area and link) | To avoid sending the same listing twice and to show your recent alerts | Contract (Art. 6(1)(b)) | Until you delete your account |
| Bot sign-up codes: email, Telegram chat ID and a one-time code (stored only as a hash) when you set up through the Telegram bot | To link the bot to your account | Contract (Art. 6(1)(b)) | The code works for 15 minutes; the record is deleted after 30 days |
| "Ask AI": the listing text you ask about and your language are sent to an AI provider; we log your chat ID and the time | To answer your question, apply the daily limit, prevent abuse and see how the feature is used | Contract (Art. 6(1)(b)) and our legitimate interest in preventing abuse and improving the service (Art. 6(1)(f)) | Logs: 1 year |
| Technical data: IP address, browser and device information in our providers' server logs, and page views and page speed measured by our hosting provider | To keep the service secure and working | Legitimate interest (Art. 6(1)(f)) | According to each provider's log retention, normally a few weeks |
| Analytics and advertising cookies | To understand how the site is used and to measure our ads | Your consent (Art. 6(1)(a)) | See section 4 |
You need an email address to have an account and a Telegram chat to receive alerts; without them we can't provide the service. We do not make decisions about you based solely on automated processing.
3. Who receives your data
We use the following service providers. They process data only on our instructions, except Telegram, Google sign-in and Meta, which act under their own privacy policies for their part.
| Provider | What for | Data involved | Where |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, account emails | Account, search, Telegram chat IDs, alert history | Stored in London (UK) |
| Amazon Web Services EMEA SARL | Servers that check searches and run the bots; sending verification emails | Search links, chat IDs, alert history, email (for codes) | EU |
| Oxylabs (UAB "Teso LT") | Fetching Idealista search pages | Your search link (no name or email) | Lithuania (EU) |
| Telegram | Delivering alerts and running the bots | Chat ID, alert content | Outside the EU |
| OpenRouter Inc. and xAI | Answering "Ask AI" questions | Listing text and language (no name, email or chat ID) | United States |
| Google (Google Ireland Ltd / Google LLC) | Sign in with Google (if you choose it); Google Tag Manager; Google Analytics and Google Ads (only with consent) | Sign-in identity; usage data, cookie IDs, IP address | EU / United States |
| Meta Platforms Ireland Ltd | Meta Pixel to measure our ads on Facebook and Instagram (only with consent) | Cookie ID, pages visited, IP address | EU / United States |
| Lovable (Lovable Labs Incorporated AB) and Cloudflare | Hosting and delivering the website; basic visit statistics; forwarding email sent to support@listwatcher.org | IP address, technical data, your emails to us | EU / United States |
Transfers outside the EEA. The UK has an EU adequacy decision. For US providers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. Sending alerts through Telegram, which you choose to use, is necessary to provide the service you asked for.
We never sell your data.
4. Cookies and similar technologies
Always on (strictly necessary, no consent needed):
| Name | Where stored | Purpose | Duration |
|---|---|---|---|
| sb-…-auth-token | Browser local storage | Keeps you signed in | Until you sign out |
| i18nextLng | Local storage | Remembers your language | Until you clear it |
| cookieConsent | Local storage | Remembers your cookie choice | Until you clear it |
| lw_google_sign_in_pending | Session storage | Completes Google sign-in | Until you close the tab |
| __cf_bm | Cookie (Cloudflare) | Protects the site against bots | 30 minutes |
| __dpl | Cookie (Lovable) | Sends you to the current version of the site | 7 days |
Only if you click "Accept":
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Counting visits and how the site is used | Up to 2 years |
| _gcl_au | Google Ads | Measuring which ads bring visitors | 90 days |
| _fbp | Meta Pixel | Measuring our ads on Facebook and Instagram | 90 days |
Set by our hosting provider on every visit: Lovable, which hosts the website, keeps basic visit statistics. It counts page views and measures how fast pages load, using the cookie below. It is set whether or not you accept, and Cookie settings don't change it.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| session-id | Lovable | Counting page views and page speed for the hosting statistics | 30 minutes |
Before you choose, or if you decline, no Google or Meta cookies are set. Google may still receive basic signals without cookies or identifiers, which it uses for aggregate statistics.
You can change your choice at any time with Cookie settings at the bottom of every page.
5. Your rights
You have the right to:
- access your data and get a copy;
- correct inaccurate data;
- delete your data;
- restrict how we use it;
- receive your data in a portable format;
- object to processing based on our legitimate interest;
- withdraw consent at any time (this doesn't affect processing done before).
To use any of these rights, email support@listwatcher.org from the address linked to your account. We reply within one month.
Deleting your account: email us and we will delete your account, search, Telegram connections and alert history within 30 days. To stop alerts right away, pause them in Filter settings.
If you think we handle your data unlawfully, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority in your EU country.
6. Security
Passwords are stored only as secure hashes. Connections are encrypted (HTTPS/TLS), and access to the database is restricted so that each user can only reach their own data.
7. Age
ListWatcher is meant for adults. You must be at least 18 to create an account.
8. Changes to this policy
When we change this policy, we update the date at the top. If a change materially affects how we use your data, we will tell you by email before it applies.
This text is available in English, Spanish, German, French and Russian. If the versions differ, the English version applies, as far as the law allows.