1.1 This Privacy Policy explains how [LEGAL ENTITY NAME] (“4walls”, “we”, “us”, “our”) collects, uses, discloses, retains and protects personal data in connection with the 4walls website currently at https://4walls.gocheck.dev (and any successor domain, including the planned domain 4faaru.app), the associated web application, Alerts and the Telegram bot @Aptseekbot (together, the “Service”).
1.2 This Privacy Policy applies to: (a) visitors to the Service; (b) Users who sign in with an Account; and (c) individuals whose details appear in Listings aggregated from Source Sites (“Listing Advertisers”).
1.3 Capitalised terms not defined in this Privacy Policy have the meanings given in the 4walls Terms of Service. This Privacy Policy should be read together with our Cookie Notice and Advertising Policy.
3.1 The party responsible for Processing Personal Data through the Service (the “controller”) is:
[LEGAL ENTITY NAME] (trading as Banana Works / 4walls)
[REGISTERED ADDRESS]
[Republic of Maldives — confirm]
Email: [email protected]
3.2 We have not appointed a data protection officer. Privacy enquiries and requests should be sent to [email protected].
| Category | Details | Source |
|---|---|---|
| Identity / contact | Email address and Google “email verified” status | Google Sign-In |
| Saved Listings | Listings you save or “watch” | You |
| Preferences | Search filters, feed preferences, setup choices, interface preferences | You |
| Alert settings | Alert criteria; Telegram chat identifier (if you connect the Telegram bot); Web Push subscription endpoint and device label (if you enable push) | You / your browser / Telegram |
| Activity within the Service | Listing views, in-app inbox notifications, fact flags you submit, photo interactions, shared saved-list links | Generated by your use |
| Contact taps | Record that a contact button on a Listing was tapped (WhatsApp, Viber, Call or the link to the ad's own site), with your email where you are signed in. Deleting your account clears the email and leaves the count. | Generated by your use |
| Correspondence | Emails you send us (for example support, takedown, data requests), including your email address and the content | You |
4.1.1 We do not receive your Google password. We do not collect your telephone number, postal address, payment card details or government identifiers from Users. We do not collect your device's precise (GPS) location.
4.2.1 We operate our own first-party usage analytics. We do not use Google Analytics or any third-party analytics product. For each recorded event we may Process:
4.2.2 We do not store your IP address in our analytics records. Your IP address is used transiently to compute the visitor identifier and is not persisted for analytics purposes. The analytics does not set a cookie. Our hosting and network providers may process IP addresses in server and security logs as described in Section 7.
4.2.3 Short-lived rate-limiting records may be created to protect the Service against abuse.
4.3.1 Listings are aggregated from publicly accessible pages on Source Sites (currently ibay, Koba Pages, Hiyaa, property.mv and pre.mv). Listings may contain Personal Data of Listing Advertisers, such as names and telephone numbers, which we reproduce from the public source advertisement. Photographs are generally loaded directly from the Source Site's servers, so those servers see your device's address as they would if you visited them. Listing contact details are displayed to signed-in Users.
Listings are copied from public ads on ibay, Hiyaa, Koba Pages, property.mv and pre.mv. Open the original to contact the advertiser. 4walls isn't affiliated with these sites.
4.3.2 Listing Advertisers may request correction or removal under Section 11.5 and our Notice and Takedown Procedure. Report opens a message in your own mail app. 4walls stores nothing about the reporter of a Listing.
4.4.1 When you report a Sponsored Advertisement, we record the advertisement, the reason selected and the date. We do not record the reporter's email address or IP address with an advertisement report. Businesses that want to advertise can read how advertising works.
We Process Personal Data for the following purposes:
| Purpose | Data used | Basis (where applicable law requires one) |
|---|---|---|
| Authenticate you and maintain your session | Email, session cookie | Performance of our agreement with you (Terms) |
| Control access during invitation or allowlist periods | Email, invitation records | Performance of agreement; legitimate interests |
| Provide saves, filters, Watching and preferences | Saved Listings, preferences | Performance of agreement |
| Send Alerts via Web Push and/or Telegram | Alert settings, push endpoint, Telegram chat ID | Your request / consent (opt-in) |
| Display Listings and enable you to contact Listing Advertisers | Listing data | Legitimate interests (providing a rental aggregation service); public availability of the data |
| Measure and improve the Service | First-party analytics events | Legitimate interests |
| Count Sponsored Advertisement impressions and clicks for aggregate reporting | Analytics events | Legitimate interests |
| Handle reports, takedown and support requests | Correspondence, report records | Legitimate interests; legal obligations |
| Security, fraud and abuse prevention | Rate-limit records, logs, session version | Legitimate interests |
| Comply with law and enforce our Terms | Any relevant data | Legal obligation; legitimate interests |
5.2 We do not use Personal Data for automated decision-making that produces legal or similarly significant effects on you.
5.3 We do not sell Personal Data. We do not rent, trade or otherwise make Personal Data available to third parties for their own marketing purposes.
6.1 The Service displays Sponsored Advertisements limited to housing-related categories, such as movers, furniture and home shops, banks offering home loans, and similar housing-related services. No other ad categories. The rules are set out in our Advertising Policy.
6.2 No behavioural targeting. Sponsored Advertisements are selected at random from the active advertisements eligible for a given placement. Selection is not based on your profile, searches, browsing history, saved Listings or location. Any site-wide sponsor placement is the same for all Users.
6.3 No ad network and no ad tracking cookies. We do not use any third-party advertising network, and we do not set advertising or tracking cookies. The ads and the “powered by” sponsor are stored and shown by 4walls.
6.4 No sharing with Advertisers. We do not provide your email address, Account data or any other Personal Data to Advertisers. Outbound links to Advertiser websites are not tagged with your email or other identifiers. We may provide Advertisers with aggregate, non-identifying statistics (such as total impressions and clicks).
6.5 When you click a Sponsored Advertisement, you leave the Service; the Advertiser's website is governed by its own privacy policy.
7.1 We share Personal Data only as described in this Section.
7.2 Service providers. We use the following categories of providers, which may Process Personal Data on our behalf or as independent parties in providing their services:
| Provider | Function | Data involved |
|---|---|---|
| Sign-In (OAuth) | Email, authentication data (governed also by Google's privacy policy) | |
| Cloudflare | Content delivery, security, country header | IP address, request metadata |
| [HOSTING PROVIDER — confirm] | Virtual private server hosting our application and database | All data stored by the Service |
| Telegram | Delivery of Alerts via @Aptseekbot (if you opt in) | Telegram chat identifier, Alert content |
| Browser push services (for example Apple, Google, Mozilla) | Delivery of Web Push notifications (if you opt in) | Push endpoint; encrypted notification payload |
| OpenFreeMap / OpenStreetMap (via MapLibre) | Map tiles | Your IP address and the map area being viewed, as with any map-tile service. The map on Explore and on each listing only ever shows an approximate area, never a building. 4walls does not send them your email. |
| Source Site image servers | Display of hotlinked Listing photographs | Your IP address and standard browser request data |
7.3 No email service provider. We do not currently use a transactional email or SMS provider. The Service does not send SMS messages. Contact, report and advertising enquiries are made by your own email client to our mailbox.
7.4 Legal and safety disclosures. We may disclose Personal Data where we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process or a lawful request from a competent authority; to enforce our Terms; or to protect the rights, property or safety of 4walls, our Users or others.
7.5 Business transfers. In connection with any merger, acquisition, reorganisation or sale of all or part of our business or assets, Personal Data may be transferred to the successor, subject to this Privacy Policy or protections no less protective.
8.1 We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, as follows:
| Record | Retention period |
|---|---|
Session cookie (4w_session) | 30 days, or until you sign out |
| Account data (email, saves, preferences, Alert settings, push subscriptions, Telegram link, inbox, views) | Until you delete your Account or we remove it |
| In-app inbox notifications | Cap of approximately 100 newest items per Account; older notifications are deleted automatically |
| First-party analytics events (including Sponsored Advertisement impressions and clicks) | Approximately 90 days, then deleted |
| Contact-tap records (Listing contact-button taps) | Approximately 30 days, then deleted |
| Pending (unconfirmed) Alert set-ups | Approximately 24 hours, then discarded |
| Sponsored Advertisement reports (no reporter identity) | Approximately 90 days |
| Rate-limiting records | Approximately 1 day |
Revocation record of a deleted Account's email (allowlist_sessions) | Retained to keep prior sessions and invitations revoked — see Section 10.3 |
| Listing data (including Listing Advertiser contact details) | While the Listing is active in our catalogue; [PURGE PERIOD — confirm] after it is no longer available |
| Correspondence (support, takedown, data requests) | [PERIOD — confirm, e.g. 12 months after resolution] |
| Database backups | Approximately 7 days on a rolling basis [confirm installed] |
8.2 Periods marked “approximately” reflect automated clean-up jobs and may vary slightly. Data may persist in backups until those backups are overwritten in the ordinary course.
8.3 In plain terms. Contact-button taps on Listings are kept for about 30 days. Incomplete Alert set-ups that are never confirmed are discarded after about 24 hours. Your in-app inbox keeps only the newest 100 notifications; older ones are removed. Sponsored Advertisement impression and click counts used for aggregate reporting are kept with other analytics events for about 90 days (separate from Listing contact taps).
9.1 The Service uses a small number of strictly necessary cookies and browser local-storage entries for sign-in, security and interface preferences. We do not use advertising or analytics cookies. Full details, including names and durations, are set out in our Cookie Notice.
10.1 Self-service deletion. You may delete your Account at any time from the Account area of the Service (Account, including confirm deletion). Deletion is effective immediately upon confirmation.
10.2 Effect of deletion. On deletion we:
Deleting your account:
One record of your email stays so your old sign-in stops working. Listings, uploaded images and anonymous visit counts are not affected. You can join again later with an invite as a new member.
10.3 Revocation record. To ensure that previously issued sessions and invitations remain revoked, we retain a minimal record of the deleted Account's email address in an access-revocation table. This record is not used for any other purpose.
10.4 Administrative accounts. Accounts holding an administrative ownership role cannot be self-deleted through the Service and must be closed by contacting us.
10.5 Backups. Deleted data may remain in rolling backups until they expire (see Section 8).
Subject to applicable law, you may request:
11.2 Data export on request. The Service does not currently offer a self-service download of your data. To receive a copy of the Personal Data we hold in connection with your Account, email [email protected] from the email address associated with your Account and ask for an export. We will provide the data in a commonly used electronic format. We aim to respond within 30 days.
11.3 Alert controls. You may stop Alerts at any time by changing your settings, revoking browser notification permission, sending /alerts to @Aptseekbot and tapping Stop, or deleting your Account.
11.4 Verification. We may take reasonable steps to verify your identity before acting on a request, and may decline requests that are manifestly unfounded or excessive, or where permitted by law.
11.5 Listing Advertisers. If you are a Listing Advertiser and wish your details or Listing to be corrected or removed, please use our Notice and Takedown Procedure or email [email protected].
12.1 The Service is intended only for persons aged 18 years or older. We do not knowingly collect Personal Data from persons under 18. If you believe a person under 18 has created an Account, please contact [email protected] and we will take steps to delete the Account.
13.1 We implement reasonable technical and organisational measures appropriate to the nature of the data, including encrypted connections (HTTPS), HttpOnly and Secure session cookies, signed session tokens with server-side revocation, access controls on administrative functions, and rate limiting.
13.2 No method of transmission or storage is completely secure. We cannot guarantee absolute security of Personal Data.
14.1 Our service providers (including Google, Cloudflare, Telegram, browser push services, map-tile providers and our hosting provider) may Process Personal Data in countries outside the Republic of Maldives, including countries whose data protection laws may differ from those of your country. By using the Service, you acknowledge such transfers. Where required by applicable law, we will take appropriate steps to ensure such transfers are subject to adequate safeguards.
14.2 Our application server is located in [SERVER LOCATION — confirm].
15.1 We may update this Privacy Policy from time to time. The “Last updated” date indicates the latest revision. Where changes are material, we will take reasonable steps to notify signed-in Users through the Service before the changes take effect, where practicable.
Questions, requests or complaints about this Privacy Policy or our Processing of Personal Data should be addressed to:
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
Email: [email protected]
16.2 If you are not satisfied with our response, you may have the right to complain to a competent data protection or consumer authority in your jurisdiction, where one exists.
Terms · Cookies · Advertise · Help · Back to 4walls