Privacy Policy

Vesty ("Vesty", "we", "us", "our") is operated from Israel and is the data controller for personal data processed through the Platform.

You can contact us about privacy matters at legal@joinvesty.com.

We collect the following categories of personal data:

Information you give us directly

• Account information: name, email address, password (hashed), phone number, country of residence, preferred language and currency.
• Listing information (when you put a home on Vesty): the home’s address and details, price, description and photos, whether you are the owner or an agent, and an agency name and phone number if you give them.
• Communications: messages you send through the Platform, support requests, and feedback.
• Payment and billing information: none today. Vesty does not currently take payments.
• Mortgage requests: the “Get mortgage options” form on a listing takes your name, email address, an optional phone number and the amount you want to borrow, and adds the listing and the figures of its calculator (price, down payment, term, monthly payment). You do not need an account. The request is stored and emailed to Vesty’s own team, and Vesty contacts you about it. The stored request is deleted when you delete the account it was sent from or whose email address it carries, or whenever you ask us at legal@joinvesty.com.

Information collected automatically

• Device and technical data: IP address, browser type, operating system, device identifiers, language settings.
• Usage data: pages viewed, listings searched and saved, filters applied, time spent, referral source.
• Location data: approximate location derived from IP address. Your device’s own position is used only as described under “Location, camera and photos” below.
• Cookies and similar technologies: see our Cookie Policy for details.

Location, camera and photos

• Location: we ask for your device’s position only when you tap “Use my location” or the location button on the map, or run a photo search. It is used to show homes around you, to show where you are on the map, and in photo search to look near where the picture was taken. It is read only while you are using Vesty, never in the background. Once you have allowed it, the home screen also uses it to choose which city’s homes to show first.
• What happens to your position: it is sent to our servers as the centre of the search. It is stored in one case: when you save a search made around your position, its coordinates are kept with that saved search until you delete it.
• Camera: used only when you take a picture for photo search or for a listing you are adding.
• Photo search: your device first works out a short code from the picture, and only that code is sent to be compared with the photos of listed homes. If that does not find the home, the picture is sent through our servers to Anthropic to be read (for example a street name or a price on a sign). Vesty does not store the picture. On the iPhone and the website, if a photo you pick carries the place where it was taken, photo search reads that place and looks around it.
• Listing photos and profile picture: stored on our servers and shown with your listing or profile.

Information from third parties

• Sign-in providers: if you sign in with Google or Apple, that provider gives us your name and email address.
• Listing Parties and partners who submit information about properties.

Listings published elsewhere

Most listings on Vesty are not submitted to us. We collect them from property advertisements that other people have already made public — currently Yad2, Madlan and public Facebook groups — and we republish the property details so that someone searching across several sources can find them in one place.

Where such an advertisement includes the advertiser’s name or telephone number, we may store it so that we can recognise the same advertisement when it is posted again, and answer questions about where a listing came from. We do not display advertisers’ telephone numbers on Vesty. We rely on our legitimate interest in running a property search that covers a market fully, balanced against the fact that the advertisement was already public.

If a listing is yours and you want it removed, or you want the contact details attached to it deleted, email legal@joinvesty.com. You do not need a Vesty account and you do not need to give a reason.

We do not knowingly collect special-category data (such as health, religion, or political views) and ask that you do not submit it.

Where we rely on legitimate interest, we have balanced our interest against your rights and concluded the processing does not override them. You can object at any time — see Section 8.

We use cookies and similar technologies. Please see our Cookie Policy for full details and to manage your preferences.

Usage statistics (PostHog): on the website, PostHog is loaded only if you accept analytics cookies, and never before. The iPhone and Android apps use no cookies and do not ask: usage statistics start when the app opens, and the app has no switch to turn them off.

What is sent: the screens or pages you open, taps and clicks on buttons and other controls, when the app is opened and closed, a few named events (for example a sign-in that failed or a place opened on the map), technical details of your device and app, and your IP address. When you are signed in, these records are filed under your Vesty account ID together with your email address, on the website and in the apps. The apps do not record your screen. On the website, PostHog may also record sessions (a replay of how a page was used) once you have accepted analytics cookies.

We share personal data only as needed and only with:

• Cloudflare — our website and app run on Cloudflare’s network, so every request passes through it and it processes your IP address and technical request data on our behalf.
• Supabase — our database and sign-in provider, which holds your account and the content you create. Hosted on AWS infrastructure.
• Resend — our email delivery provider, which processes your email address and the contents of the emails we send you.
• Inngest — runs our scheduled background tasks, such as preparing emails, which may process account identifiers.
• PostHog — usage statistics, processed in the United States; on the website also session recording. Section 4 says what is sent, and what applies on the website and in the apps.
• Mapbox, our map provider — when you use the map, your device requests map imagery directly from Mapbox, which receives your IP address and the map area you view.
• Anthropic — the AI provider behind the assistant, photo search, translations, neighbourhood summaries and the writing helpers. Through our servers it receives what the feature needs and returns an answer: your questions to the assistant or about a neighbourhood; a photo-search picture; the text and photos of a listing (to translate it, to check it before it is published, and for the listing form’s helpers that write the description, sort the photos or read an advert you paste); private messages, when they are translated for the reader; and, for the helper that drafts a first message, the questions you ticked and your note. Vesty does not add your name or email address to what it sends.
• Apple and Google notification services — if you allow notifications in our iPhone or Android app, Apple Push Notification service (iPhone) or Google Firebase Cloud Messaging (Android) receives a device token and delivers the notification text to your device. We keep that token with your account and remove it when you sign out or delete your account.
• Sign-in providers — if you choose to sign in with Google or Apple, that provider confirms your identity to us and receives sign-in metadata under its own privacy policy.
• Email delivery and customer-support services, which process your email address and message content to reach you.
• Other Users, where you choose to share data — for example, when you contact a Listing Party, your name and message are visible to them.
• Translation and currency services, which process Listing content and price data.
• Professional advisors — lawyers, auditors, accountants — bound by confidentiality.
• Authorities and law enforcement, where required by law, court order, or to protect rights and safety.
• Successors, in the event of a merger, acquisition, or sale of assets, with appropriate safeguards.

Vesty does not currently take payments or send WhatsApp messages. If we enable either, we will name the provider here before we do.

We do not sell your personal data.

Vesty operates across multiple countries, and some of our service providers are located outside the European Economic Area. Our providers process personal data in the United States (Cloudflare, Supabase, Resend, Anthropic, Apple and Google for app notifications, and PostHog (on the website only with your consent; for the apps see Section 4)) and in Israel. Where we transfer personal data outside the EEA, we rely on lawful transfer mechanisms — typically the European Commission's Standard Contractual Clauses, an adequacy decision, or another approved safeguard. You can request a copy of the safeguards in place by contacting legal@joinvesty.com.

We keep personal data only as long as necessary for the purposes described in this Policy, or as required by law. In general:

• Account data: for as long as your account exists. When you delete your account, it is deleted at once (see below).
• Listings you put on Vesty: until you delete the listing or your account. The listing and its photos are then deleted at once.
• Listings collected from other sites: when the advert is taken down there, we stop showing it and keep its record. Section 2 says how to have it removed.
• Transaction and tax records: for the period required by applicable tax and accounting law (typically 7–10 years).
• Marketing data: until you withdraw consent or object.
• Logs and technical data: typically up to 12 months.

After these periods, we delete or anonymise the data.

You can delete your account yourself at any time: on the website under Settings → Privacy & security → Delete account, and in the iPhone and Android apps under Settings → Delete account. Deletion takes effect at once: your profile and profile picture, saved properties and searches, conversations, notifications, your listings with their photos, support requests, and the mortgage requests and newsletter subscription made from your account or with its email address are permanently removed, together with the device token used for app notifications. Vesty holds no payment details today.

Not removed with the account: usage statistics already recorded at PostHog, which stay there for PostHog’s storage period unless you ask us at legal@joinvesty.com to delete them; and the record of the email that confirms the deletion. Some limited records may also be retained where the law requires it (for example tax or anti-fraud records) or to honour your communication preferences (for example, do-not-email suppression lists).

How to delete your account

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), in certain circumstances.
• Restrict processing, in certain circumstances.
• Object to processing based on legitimate interest, including profiling, and to object at any time to processing for direct marketing.
• Data portability: receive your data in a structured, machine-readable format and transmit it to another controller.
• Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before withdrawal.
• Lodge a complaint with a supervisory authority. The lead authority for EU users is typically the one in your country of residence; a list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise any of these rights, email legal@joinvesty.com. We will respond within one month (extendable by two further months for complex requests). We may need to verify your identity before acting on a request.

We do not currently make decisions that produce legal or similarly significant effects about you based solely on automated processing. If this changes, we will update this Policy and inform you of your rights under Article 22 GDPR.

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, and regular security reviews. No system is completely secure, and we cannot guarantee absolute security. If a personal data breach affects you and is likely to result in a high risk to your rights, we will notify you in line with applicable law.

The Platform is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact legal@joinvesty.com and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-product notice. The "Last updated" date at the top reflects the latest version.

Privacy questions, requests, or complaints: legal@joinvesty.com

We answer privacy requests by email. If you need a postal address for a formal notice, ask at legal@joinvesty.com and we will provide one.