Privacy policy

Last updated 29 October 2026

1. Who is responsible

Bazavo (bazavo.com) is run by Bufufu OÜ, an Estonian company (details at the end of this page). Bufufu OÜ is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Questions and requests go to hello@bazavo.com.

2. What we handle, and why

• Your account. Your email address, the first name and town you give us, your currency and language, and whether you sell as a private person or a business. Some older accounts have a phone number instead of an email. We use this to sign you in, show ads near you and run the marketplace. Legal basis: our contract with you.
• Your ads. What you write and upload: title, description, photos, price, condition, details such as make or year, and the town. To work out distances we store the place as a point blurred to about 1 km. Contract.
• Messages and offers. What you write to other people, the offers you make and answer, and the rules you set, such as accepting offers above a price automatically (the other side never sees those amounts). Contract.
• Safety checks. Messages are checked automatically for phone numbers, email addresses and links, which stay blocked until an offer is accepted (things and rentals) or both of you have written (jobs and services). Ads get automatic notes, for example when a price is far below similar ads or a job ad mentions a fee. These checks only block or label: no decision about you is made by a machine alone. Our legitimate interest in protecting people from scams.
• Saved searches and news. What you asked to be told about, and the news we keep for you: new offers, messages and matches. Contract.
• Signing in. Each 6-digit code we email you is stored scrambled (hashed), together with the IP address it was requested from, so we can limit how many codes one network asks for. Both are deleted after a day. Legitimate interest in security.
• Phone alerts. If you turn them on, the address your browser gives us for push notifications. Consent: turn them off in your inbox at any time.
• Email alerts and replies. We email you about new messages and offers. When you answer one of those emails, we take the text of your reply, without the quoted history, and post it in the conversation. Contract. Every alert has a link to switch them off.
• Your location for a search. "Near me" uses your browser's location, rounded to about 1 km, for that search only; we don't store it. When you sign up, we suggest a town based on your connection (Cloudflare's estimate). It's saved only if you keep it.
• Technical logs. Our hosting provider keeps short-lived records of requests, such as IP address, time and page, to keep Bazavo secure and fix errors. They're deleted after a few days. Legitimate interest.

3. What other people can see

• Your ads are public. Anyone can see them, including search engines and AI assistants, together with your first name, your town, whether you're a private person or a business, and whether your phone number is verified. When a new ad goes up, we tell search engines about it so it's found sooner.
• The people you write to see your first name and what you write. If they use an AI assistant, it reads the conversation for them.
• Your email address and phone number are never shown to other people. You decide whether to share contact details in a conversation once that's allowed.

4. AI assistants

When you connect an assistant such as ChatGPT, Claude or Grok, you sign in on Bazavo's connect page and the assistant can use your account to do what you ask: search, draft ads and publish them after you confirm, send messages and offers, and tell you what's new. Messages and offers it writes are labelled as written by an assistant.

Whatever Bazavo sends back to your assistant (ads, your conversations, offers and news) is then processed by the company that makes it, under the privacy policy and terms you agreed to with them. We don't control what they do with it. The connection ends after 90 days without use; to end it sooner, remove Bazavo from your assistant's connectors, or ask us to cut it off.

5. Cookies and your browser

Bazavo only uses cookies it needs to work, so it doesn't ask for consent:

• __Host-bazavo-session keeps you signed in on the website, for 90 days.
• __Host-bazavo-user remembers you on the connect page so you can continue without a new code, for 30 days.
• __Host-bazavo-signin and __Host-bazavo-csrf hold a sign-in or a connection in progress, for 15 minutes.

Ads you save with the heart are kept in your browser's storage, not on our servers.

6. Who else is involved

• Cloudflare, Inc. (USA) hosts Bazavo: the website, the database, photos, sending and receiving email, and protection against attacks.
• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) delivers the typefaces, so your browser connects to Google, which sees your IP address and browser details. See Google's privacy policy.
• OpenStreetMap Foundation (UK): when someone enters a town Bazavo doesn't know yet, our servers look the name up in OpenStreetMap's Nominatim service. Only the town name is sent, never who entered it.
• Push services run by Google, Apple, Mozilla or Microsoft, depending on your browser, deliver phone alerts. The content is encrypted so that only your browser can read it.
• Your AI assistant's maker, when you connect one (section 4).
• Authorities, when the law requires us to share data.

7. Data outside the EU

Cloudflare is a US company and may process data in its data centres around the world. For transfers outside the European Economic Area we rely on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. The UK has an EU adequacy decision.

8. How long we keep it

• Your account, ads, messages and offers: while your account is open. Closed ads stay in your account and in your conversations. When you mark something as sold, its final price is used, without your name, to estimate prices for similar ads.
• Sign-in codes and the IP address kept with them: one day. Website sessions: 90 days. Sign-in links: 15 minutes. Photo upload links: one day.
• When you ask us to delete your account, we delete it within 30 days, with your ads, messages, offers, saved searches and phone alerts.

9. Children

Bazavo is for people aged 18 and over. If you think a child has an account, tell us and we'll delete it.

10. Your rights

You can ask to see your data, correct it, delete it, limit how we use it, object to how we use it, or get a copy to take elsewhere. You can withdraw consent, for example for phone alerts, at any time. Write to hello@bazavo.com from the email address on your account; we answer within one month. You can change your town, name and alert settings, and edit or remove your ads, by asking your assistant.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority where you live.

11. Security

Bazavo only works over HTTPS. Sign-in codes, sign-in links and session keys are stored hashed, links that sign you in expire quickly, and assistants never get other people's contact details.

12. Changes to this policy

If we change how we handle data, we'll update this page and the date at the top. If a change matters for you, we'll also tell you by email before it takes effect.