Privacy Policy

Last updated October 17, 2026

adalist is a classifieds website where people post and browse listings for second-hand products, services and vehicles. This policy explains what personal data we collect when you use adalist, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

1. Who we are

adalist is run by Zeroeffort OÜ, a company registered in Estonia (registry code 17225683) (“we” or “us”). We are the controller of your personal data, responsible for it under the EU General Data Protection Regulation (“GDPR”) and, where it applies, the Turkish Republic of Northern Cyprus Personal Data Protection Law No. 89/2007.

For any question or request about your data, email us at zeroeffortestonia@gmail.com.

2. What we collect

When you create an account

Your name and email address.
Your password. We only store a scrambled form of it (an Argon2id hash) that can't be turned back into the password, so nobody at adalist can see it.
The language you signed up in, so our emails reach you in it.
Whether you've confirmed your email address, and when you accepted our Terms of Service.

When you post a listing

What you write and choose: the title, description, category, price and currency, condition, city and district, and details for its category, like a vehicle's make, model, year and mileage.
Photos you add.
A phone number for buyers to reach you. We save it to your account so it's filled in for your next listing.

When you report a listing

The reason you choose and any details you write. If you're logged in, the report is linked to your account. If you're not, it isn't linked to you, and we only count your IP address to limit how many reports can be sent.

When you contact us

The name, email address and message you send with the contact form, and the language the site was in, so we can reply in it. If you're logged in, the message is linked to your account. We count your IP address or account to limit how many messages can be sent. Only our team sees your messages.

When you use the site

Your IP address and your browser and device type, saved with each session while you're logged in.
Your IP address or account, and the part of the site you used, counted to limit how often things like logging in or uploading photos can be tried.
How many sellers' phone numbers you've looked at recently, so numbers can't be collected in bulk.

From our team

Our moderators' decisions about your listings, such as why one was rejected, and if your account is ever suspended, the reason and for how long.

What we don't collect

adalist doesn't take payments, so we never see card or bank details. We don't track your precise location, and we don't use analytics or advertising trackers.

3. What other people can see

Once our team approves a listing, anyone can see it: its details and photos, its city and district, your name as the seller, and the month and year you joined adalist (shown as “On adalist since …”). Until then, only you and our moderators can see it.
When you sign up, you agree to your name and joining date being shown on your listings this way. If you no longer want them shown, close your listings or ask us to delete your account.
Your listing's phone number is only shown to logged-in users who choose to reveal it, and we limit how many numbers one account can reveal.
Your email address is never shown to other users.
Only our team sees reports. The seller isn't told who reported their listing.

4. Why we use your data

To provide adalist to you. Signing you in, showing and managing your listings, and letting buyers contact you are the service you signed up for, and they need this data.
To send emails you need. Such as the link that activates your account. We don't send marketing emails.
To answer you. When you contact us, we use what you send to reply to you.
To keep adalist safe. Reviewing listings before they go live, and stopping spam, scams, fraud, scraping and attempts to break into accounts. We have a legitimate interest in a marketplace people can trust.
To follow the law. Such as answering lawful requests from the authorities.

If we ever want to use your data in a way that needs your consent, we will ask you first, and you can change your mind at any time.

We don't sell your personal data. We only share it with:

Providers that run parts of adalist for us. Vercel hosts the site and stores listing photos, Neon hosts our database, and Resend sends our emails, which means it receives your name, email address and the email itself. Cloudflare checks that our sign-up, login, contact and report forms are used by people rather than bots (Cloudflare Turnstile), so when you open one of those forms it receives your IP address and details about your browser and device. They may only use your data to provide their service to us.
Other users, as described in section 3.
The authorities, when the law requires it, or when it's needed to protect people from fraud or harm.
A new owner of adalist, if the business is sold or merged. Your data would stay protected by this policy.

6. Data stored outside Northern Cyprus

All of adalist's data is stored and processed outside Northern Cyprus. Our database is stored in Germany, in the EU. Vercel, Neon, Resend and Cloudflare (see section 5) are based in the United States, and may also process data there and in other countries where they operate. We only use providers that commit to protecting the data they handle for us. When data leaves the European Economic Area, it's protected by the safeguards the GDPR requires, such as the European Commission's standard contractual clauses in our providers' data processing agreements.

When you sign up, you consent to your data being transferred to these providers in this way.

7. How long we keep it

Your account and listings: for as long as you have an account. If you ask us to delete your account, we delete it and your listings within 30 days, apart from what we must keep for the reasons below. Copies can stay in our providers' backups for a limited time after that, until the backups are replaced.
Reports: until the listing they're about is deleted. If you delete your account, reports you sent stay but are no longer linked to you.
Contact messages: as long as we need them to answer you and deal with any follow-up. If you delete your account, messages you sent stay but are no longer linked to it.
Login sessions: until you log out or the session expires.
Account activation links: they expire after 24 hours.
Counts used to limit attempts, such as how often an IP address or account has tried to log in or sent a report: deleted within two days.
Moderation records, our team's record of what it did to accounts and listings, including suspensions and deleted accounts, with the user's name and email address: as long as we need them to protect adalist and enforce our Terms of Service. This can be after an account is deleted, so that a suspended user can't simply sign up again.
Anything the law requires us to keep, or that we need to make or defend a legal claim, for as long as that applies.

8. Cookies and browser storage

adalist stores a few things in your browser. Each one is either needed for the site to work or remembers a choice you made. We don't use analytics, advertising or tracking cookies, and we serve our fonts ourselves. Apart from Cloudflare's check on some of our forms (see section 5), loading a page doesn't send your data to anyone else.

Login cookie (__Secure-better-auth.session_token): keeps you logged in. It lasts until you log out, or 7 days after you last used adalist.
Sidebar cookie (sidebar_state): remembers whether you left the filters sidebar open, for 7 days.
Saved listings (browser storage): the listings you save. The list stays in your browser, separately for each account that uses it. We don't keep it on our servers, so it won't follow you to another device.
Theme (browser storage): whether you chose the light or dark look.

You can clear these in your browser's settings at any time. If you block cookies, you won't be able to log in. If we ever add cookies that aren't needed for the site to work, we'll ask for your consent before setting them.

9. Your rights

Under the GDPR and Law No. 89/2007, you can ask us to:

tell you whether we hold data about you, and give you a copy;
correct data that's wrong or incomplete;
delete your data or your account, or stop using your data, when it's no longer needed or isn't being used lawfully;
limit how we use your data, for example while we look into a complaint about it;
give you the data you gave us in a format a computer can read, or send it to another service;
stop using your data for our legitimate interests;
stop using your data on the basis of consent you gave us.

To make a request, email zeroeffortestonia@gmail.com from the address on your account. We may need to confirm that a request really comes from you. We'll answer in writing within 15 business days. If you live outside Northern Cyprus, the law where you live may give you further rights, and we'll respect them.

If you think we've mishandled your data, please contact us first so we can put it right. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), to the data protection authority where you live or work if that's in the EU, or to the Personal Data Protection Board set up under Law No. 89/2007.

10. How we protect it

We store passwords only as Argon2id hashes, limit login attempts, show sellers' phone numbers only to logged-in users, and only let staff who need your data see it. No system is perfectly secure, but if a breach affects your data, we'll tell you as the law requires.

11. Children

adalist is only for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think a child has an account, email us at zeroeffortestonia@gmail.com and we'll delete it.

12. Changes to this policy

When we change this policy, we'll update the date at the top. If a change is significant, we'll tell you by email or on the site before it takes effect.

13. Contact us

Zeroeffort OÜ (registry code 17225683)
zeroeffortestonia@gmail.com