WAYLOT PRIVACY POLICY

Last updated: 1/09/2026

1. About Us and This Policy

This policy explains how CASETONE DEVELOPMENT S.A R.L (“we,” “us,” or “our”), a société à responsabilité limitée, registered in Luxembourg, collects, uses, shares, and protects your personal data when you use the WAYLOT platform.

We are the controller of your personal data under the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This means we decide how and why your data is processed.

WAYLOT is a classifieds platform available as a mobile application (Android and iOS), a responsive web application, and a desktop client (the “platform”). It lets you post, search, and respond to advertisements for goods and services. The platform does not facilitate or process payments between buyers and sellers.

The platform is currently designed for private individuals who are not acting in their trade, business, craft, or profession.

This policy applies to everyone who uses the platform, whether you browse without registering or create an account. It covers all personal data processed through the website, mobile applications, and desktop client. We recommend reading it carefully, so you understand what happens to your data and what rights you have.

Until a Data Protection Officer (DPO) is appointed, you can send any data protection questions to privacy@waylot.com.

2. Personal Data We Collect and How

We collect personal data in three ways: directly from you, automatically when you use the platform, and (in limited cases) from third parties. Not all categories apply to every user.

2.1 Information you provide to us

When you register, build your profile, post ads, communicate with other users, or contact support, you provide us with personal data. This includes:

During registration, we verify your email address or phone number by sending a confirmation code. We store a record of successful verification (status and timestamp) but do not retain the codes themselves.

2.2 Information collected automatically

When you access the platform (whether registered or not), we automatically collect technical and usage data through server logs, cookies and similar tracking technologies, and device sensors (geolocation, if you have granted permission). This includes:

When you visit the platform without an account or without granting geolocation permission, we use a third-party service to determine your country and city based on your IP address, for the purposes of automatically selecting your interface language, displaying region-appropriate content, and support proximity-based search ranking.

Precise geolocation from your device is used only during the active session and is not persistently stored. City-level location may be retained between sessions for use by the recommender system and proximity-based search ranking.

2.3 Information received from third parties

We do not currently receive personal data about you from third parties.

2.4 Special categories and children’s data

We do not intentionally collect special category data such as health, biometric, or political data. If such data appears incidentally in user-generated content, we do not systematically process or categorize it.

The platform is not intended for anyone under 16. We do not knowingly collect personal data from children. If we discover a user is under 16, we will delete their account and data.

2.5. What happens if you do not provide your data

Some personal data is needed to use the platform. If you do not provide a display name, email address (or phone number), or location, we cannot create an account for you. If you do not provide ad listing content (text, photos, category, price, and location), we cannot publish your advertisement. These are contractual requirements – without them, we cannot deliver the service.

Other data is optional. For example, you are not required to provide a profile photo, grant geolocation permission. If you choose not to, the platform will still work – but some features (such as proximity-based search ranking) will not be available to you.

No law requires you to provide personal data to us. The requirements described above are contractual, not statutory.

3. How We Use Your Personal Data

We process your personal data for specific purposes, each with a defined legal basis under the GDPR. Where we rely on legitimate interest, we have documented a legitimate interest assessment (LIA). You can request details of any specific LIA by contacting us at privacy@yourdomain.lu.

Once the relevant retention period expires and no other ground for retention applies under this policy or applicable law, we either permanently delete your data or irreversibly anonymise it so you can no longer be identified

3.1 Providing the platform

We process your data to create and manage your account, publish and display your advertisements, enable in-platform messaging between buyers and sellers, run the AI-powered chat and review translation service, operate the automated support chatbot, operate the pre-publication content moderation system, enable automatic republishing of your listings where you have activated this option, and operate the seller review system.

Our legal basis for using your personal data is contract performance, because processing is necessary to deliver the service you signed up for.

Data usedDisplay name, email, phone, location, languages, profile photo, ad content, chat messages, support queries, notification and display preferences, measurement unit preferences, review content
RetentionFor active accounts/listings: Duration of active account or listing duration.
For requests to close accounts:
After you request account closure, a 15-day grace period applies during which you can cancel the request.
After the grace period, the account is deactivated but enters a 12-month recovery period during which you can restore it by re-registering with the same email address or phone number. After the recovery period expires, your data is permanently deleted or irreversibly anonymised except where a longer retention period applies under this policy or applicable law.
After account closure or listing removal:
Non-commercial profile data (photo, profile description, language preferences): deleted or irreversibly anonymised within 30 days of the end of the recovery period.
Ad text and photos from removed ads: deleted or irreversibly anonymised within 90 days.
Chat data: see Section 3.7.

Some of these processing activities involve automated processing that constitutes profiling. For details on what automated processing we use, the logic involved, how it affects you, and your rights, see Section 4.

3.2 Marketing and promotional communications

We do not currently use your data for any marketing or promotional communications.

3.3. Marketing Data Uploads to Advertising Platforms

We do not use your data for finding new users and target relevant businesses through advertising platform.

3.4 Personalisation and recommendations

We analyse your activity on the platform to show you relevant ads and listings. This includes the home page recommender system, analytics-driven ad recommendations, and email notifications about listings that match your search behavior. These activities constitute profiling – we analyse aspects of your behavior to personalise your experience. For details on the logic involved, how this affects you, and your rights, see Section 4.

Our legal basis for using your personal data is our legitimate interest in increasing the relevance of listings shown to you, which improves your experience and helps sellers reach interested buyers more efficiently. You can object to this personalization at any time (see Section 7).

Data usedSearch history, browsing activity, ad interactions, city-level location
RetentionDetailed search and click history are retained for the duration of your account. Within 30 days of the end of the account recovery period (see Section 3.1), all personalisation identifiers are removed.

This personalisation constitutes profiling. For details on the logic involved, how it may affect you, and your rights, see Section 4.

3.5 Proximity-based search ranking

When you grant geolocation permission on your device, we rank search results by distance to your location, showing closer listings first. You can disable this at any time through your device settings and manually override the sort order. Before requesting device-level permission, we display a pre-permission prompt explaining why geolocation is used.

When precise geolocation is not available, we use your city-level location as set in your profile or, for unregistered visitors and users who have not granted geolocation permission, a city-level and country-level location derived from your IP address through a third-party lookup service. During registration, you can accept the location determined from your IP address or enter it manually. The IP-based location is used solely to set the default interface language, display region-appropriate content, and support proximity-based search ranking.

Our legal basis for precise geolocation processing is your consent by granting device-level permission. For city-level location derived from your profile settings, our legal basis is contract performance. For the IP-based country lookup for unregistered visitors and users who have not granted geolocation permission, our legal basis is our legitimate interest in displaying the platform in a language and regional context appropriate to the visitor and providing relevant search results.

Data usedPrecise geolocation from your device
City-level location derived from your profile
Country-level location derived from IP address (unregistered visitors and users without geolocation permission)
RetentionSession duration only.
Duration of active account.
Not stored beyond the active session.

3.6 Analytics and platform improvement

We analyse aggregated and individual usage patterns to improve how the platform works, fix issues, evaluate feature effectiveness, and improve the user experience. We use Google Analytics (web) and Firebase Analytics (mobile application) for this purpose.

Our legal basis is your consent, which you give by accepting Analytics in the cookie consent banner (or the equivalent preference on the mobile application). You can withdraw your consent at any time through Profile → Legal → Cookie Policy.

Data usedUsage patterns, session and device information, IP address (anonymised where possible)
Crash reports and error diagnostics
Retention14 months, then anonymised.
90 days

3.7 Safety, moderation, and fraud prevention

We use a two-tier content moderation system to detect prohibited content and protect users.

Every new listing is screened by an AI system before publication. Listings that the AI system approves are published automatically. Listings that the AI system flags as potentially problematic are withheld from publication and sent for human review. In a limited number of cases involving content that is clearly and unambiguously prohibited by law (such as firearms, controlled substances, child sexual abuse material, or hate symbols) or by Terms of Use (incorrect listing category), the AI system may reject a listing without human review. In all cases, you can contest the decision through the process described in our Terms of Use.

We also retain chat data and monitor platform activity to detect fraud and abuse. For details on how content moderation works and how it may affect sellers, see Section 4.5

Our legal basis is our legitimate interest in maintaining a safe and trustworthy platform, detecting fraudulent activity, and protecting users from prohibited content.

Data usedAd content, chat messages, user reports, flagged content metadata, login patterns, IP addresses, device fingerprints
RetentionChat messages are retained for the duration of both participants' active accounts. When a participant closes their account, their chat data is retained during the 15-day grace period and the 12-month recovery period described in Section 3.1. After both periods expire, that participant's data (including chat messages) is deleted or or irreversibly anonymised. If the other participant's account remains active, the chat remains accessible to them and in our systems until their account also completes the full closure process.
Flagged content records (content moderation decisions, reasons, and associated metadata): 5 years from the date of the moderation decision.

Our content moderation system includes automated processing. For details on how it works, how decisions are made, and your rights, see Section 4.

Chat data and the “Remove” function: When you use the "Remove Chat" function, the conversation is hidden from your view but remains stored on our servers. The other party continues to see the chat, and we retain the data for fraud prevention and moderation. This is a display preference, not a legal deletion. If you want to exercise your right to erasure, please submit a separate request to privacy@waylot.com. We will assess your request against applicable exceptions (including our legitimate interest in fraud prevention and any legal retention obligations).

3.8. Legal and regulatory compliance

We process and retain certain data to comply with applicable law, including Luxembourg commercial and tax law, and applicable court orders or regulatory requirements. This includes records of your cookie consent choices (categories selected, consent version, date and time, and account or session identifier), which we retain to demonstrate compliance with our obligations under the GDPR and applicable ePrivacy rules. Our legal basis is our legal obligation when required by law.

Data usedAny data required by law (data responsive to court orders, regulatory requests, or other legal obligations)
Cookie consent records (consent choices, version, timestamp, account or session identifier)
RetentionAs required by applicable law.
Duration of your account plus 5 years.

3.9. Support and Communications

We process your data to provide technical support, diagnose issues, and respond to your enquiries and feedback. When you contact support, you initially interact with an automated support chatbot that provides scripted responses to common questions. You can request to be transferred to a human support agent at any time. Our legal basis is our legitimate interest in resolving user issues, maintaining service quality, and ensuring the platform security.

We also send you notifications that are necessary for delivering the service, such as account confirmation messages, listing publication and expiration notices, listing verification status updates, security alerts, and service disruption notices. These are sent by email and push notification. Our legal basis is contract performance – these communications are necessary to deliver the service we provide under our Terms of Use.

Data usedDisplay name, email, communication content and metadata
RetentionSupport records: 3 years from resolution. In all cases, data classified as commercial correspondence under Art. 16 of the Luxembourg Commercial Code is archived for 10 years from the end of the relevant financial year, where such records exist.

3.10. Social login authentication

We do not currently offer social login (such as Google, Apple, or Facebook sign-in).

3.11 Inactive accounts

If your account remains inactive (no login, no activity) for 5 years, we will send you an email notification 30 days before taking any action. After the 30-day notice period, your account will be closed and will enter the same deletion lifecycle described in Section 3.1 (15-day grace period followed by a 12-month recovery period, after which your data is deleted or irreversibly anonymised).

Where we rely on legitimate interest as the legal basis for processing, we have conducted a legitimate interest assessment to evaluate whether our interests are overridden by your rights and freedoms. You may request information about the relevant assessment by contacting us at privacy@waylot.com.

4. Automated Processing and How It Affects You

We use automated processing that involves profiling – meaning we analyse aspects of your behaviour on the platform to personalise your experience. We also use AI systems for content moderation and translation. This section explains what we do, the logic behind it, how it affects you, and your right to object.

4.1 What automated processing we use

Home page recommender system. The system analyses which categories and price ranges you search for most often and most recently, then prioritises similar listings on your home page. It also factors in your city-level location to show geographically relevant ads. The system uses frequency-recency weighting and content-based matching. It does not use artificial intelligence. It does not compare your behaviour to other users' behaviour (no collaborative filtering) and does not build a profile of you as a person – it matches listings to your recent search patterns.

Analytics-driven recommendations. The system categorises your recent activity by topic and increases visibility of matching listings in your feed and in notifications. This categorisation is rule-based (keyword and category matching), and does not use artificial intelligence.

Proximity-based search ranking. When you have granted geolocation permission, search results are ranked by distance. When precise geolocation is unavailable, the system uses your city-level profile location or an approximation based on your IP address.

Content moderation (AI filter). Every new listing is analysed by an AI system before publication. The AI system assesses the text and images in your listing to determine whether they comply with the platform's rules and applicable law. Depending on the outcome, a listing may be published automatically, withheld for human review, or – in a strictly limited set of cases involving content whose illegality is unambiguous under EU or Luxembourg law or Terms of Use – rejected automatically. Where the AI system restricts or rejects your listing, you are notified with the reasons and can contest the decision. The full content moderation procedures, including timeframes, complaint handling, and your rights, are set out in Sections 6.1 to 6.5 of the Terms of Use.

AI-powered translation. When you enable automatic translation in your settings, messages you send through the in-platform chat and reviews you post are processed by an AI system to generate a translation. The AI system processes the text content only. It does not analyse, profile, or categorise you or the other participant.

4.2 How this affects you

For buyers: personalisation determines which ads you see first on your home page, in search results, and in notifications. You can always override automated rankings by sorting manually (by price, date, or other criteria). None of these processes restrict your access to the platform or produce legal effects on you.

For sellers: The recommender system and analytics-driven recommendations determine which listings are shown more prominently to potential buyers at any given time. Listings that match current buyer demand in a given category and location receive greater visibility. This ranking is based entirely on content relevance and buyer interest signals – it does not assess, score, or profile you as a seller, and does not penalise or deprioritise individual sellers. A listing that receives less visibility does so because it does not currently match buyer search patterns, not because of any characteristic of your account.

Content moderation may affect your listings. As described in Section 4.1, the AI system may withhold a listing from publication pending human review, or in limited cases reject a listing automatically. These outcomes affect the visibility and availability of individual listings. The full content moderation procedures and your rights to contest any decision are set out in Sections 6.1 to 6.5 of the Terms of Use.

4.3 Your rights

The profiling described above (recommender system, analytics-driven recommendations) is based on our legitimate interest in providing a relevant experience (see Section 3). You have the right to object to this profiling at any time. If you object, we will stop the personalisation unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. To object, contact us at privacy@waylot.com.

Personalisation does not produce legal effects or similarly significant effects on you. It affects which listings you see first, not your access to the platform or your ability to post. You can always override automated rankings.

Content moderation involves automated processing that may result in a listing being withheld or rejected. Where the AI system restricts or rejects your content, you have the right to receive a statement of reasons and to contest the decision. If you contest an automated decision, it will be reviewed by a human moderator. These rights apply regardless of whether the original decision was made by the AI system alone or with human involvement. For details on how to contest a content moderation decision, see Sections 6.4 and 6.5 of the Terms of Use.

5. How We Share Your Personal Data

5.1 Service providers (processors)

We share your personal data with the third-party service providers who process data on our behalf for:

Analytics and diagnostic services

Security and monitoring services

These service providers are contractually obligated to process your data only on our instructions and to protect it in accordance with GDPR requirements. For a complete list of our current service providers, including their names and locations, please contact us at privacy@waylot.com.

5.2. Legal Requirements

We may disclose your personal data where required or permitted by applicable law, including to comply with legal obligations, respond to lawful requests from public authorities, or protect our rights, safety, or property.

5.3. Business Transfers

We may disclose or transfer personal data to an acquirer, investor, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of insolvency or bankruptcy, or receivership where information is transferred as one of our business assets.

5.4. With Your Consent

We may also share your personal data with your specific consent for purposes not otherwise described in this Policy.

5.5. Other users

When you post an advertisement, the information you include in the listing (text, photos, location, and optionally your phone number) is visible to other users as described in Section 2.1. Your seller profile and reviews are visible to registered users.

6. International Data Transfers

Your personal data is stored and processed within the European Economic Area (EEA). Some of our service providers are based in, or may transfer data to, the United States. We ensure all such transfers are protected by appropriate safeguards under the GDPR.

United States.

Where a US-based service provider is certified under the EU-US Data Privacy Framework (adequacy decision adopted by the European Commission on 10 July 2023, Commission Implementing Decision (EU) 2023/1795), the transfer is made on the basis of that adequacy decision. Where a US-based service provider is not certified under the Data Privacy Framework, we rely on Standard Contractual Clauses approved by the European Commission (2021 version), supplemented by a transfer impact assessment where appropriate. For information about the specific service providers involved in international transfers and the applicable safeguards, please contact us at privacy@waylot.com. You may also request copies of the relevant transfer instruments, including Standard Contractual Clauses where applicable.

7. Your Rights

The GDPR gives you rights over your personal data. Here is what you can do and how.

Access: You can request a copy of all personal data we hold about you, including what data we process, why, who we share it with, how long we keep it, and where it came from (if not collected directly from you).

Rectification: You can request correction of inaccurate or incomplete personal data. You can also update most profile information directly in your account settings.

Erasure: You can request deletion of your personal data when it is no longer necessary, you withdraw consent (where consent is the legal basis), you successfully object to processing, or we processed it unlawfully. We may refuse deletion where we need the data to comply with legal obligations, to establish, exercise, or defend legal claims, or where we have compelling legitimate grounds. If we erase your account data, your account will be permanently closed and will enter the deletion lifecycle described in Section 3.1.

Restriction: You can request that we temporarily stop processing your data (but not delete it) when: you contest data accuracy, processing is unlawful but you prefer restriction over deletion, we no longer need the data but you need it for legal claims, or you have objected to processing pending the balancing test.

Portability: You can receive your personal data in a portable format and transmit it to another service. Applies only to data you provided to us and processed based on consent or contract performance.

Object: You can object to processing of your personal data that is based on our legitimate interest at any time. We will stop unless we demonstrate legitimate compelling grounds. For direct marketing (including profiling related to direct marketing), your right to object is absolute. If you object, we will stop immediately — no balancing test applies.

Withdraw consent: where processing is based on your consent (marketing, geolocation, non-essential cookies), you can withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Rights related to Automated Decision: See Section 4 for detailed information about automated processing, including content moderation, and your right to contest automated decisions. Where the AI system restricts or rejects your content, you have the right to receive a statement of reasons, to express your point of view, and to have the decision reviewed by a human.

Complain: If you believe we are not processing your data in accordance with the GDPR, you have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), cnpd.public.lu. You may also complain to the DPA in your country of residence or workplace. We would appreciate the opportunity to address your concerns first, so please consider contacting us at privacy@waylot.com.

7.1 How to exercise your rights

You can send us an email at privacy@waylot.com, use the in-app settings (to download your data, delete your account, or adjust preferences), or write to our registered office at 21, rue du Puits Romain, L-8070, Bertrange, Luxembourg. For security reasons, we may need to verify your identity before processing your request. If a third party exercises a right on your behalf, we may ask for proof of authorisation.

7.2 Response timeframe

We will respond within one month of receiving your request. If your request is complex or we receive a high volume of requests, we may extend this by up to two additional months (three months total). If an extension is needed, we will let you know within the first month and explain why. We will not usually charge a fee, but we are permitted by law to charge a reasonable fee or refuse to act if a request is manifestly unfounded or excessive.

8. AI Transparency

This section explains how we use artificial intelligence on our platform.

8.1. Customer support chatbot

Our customer support service includes a chatbot that provides scripted responses to common questions about the platform. The chatbot is not powered by artificial intelligence — it operates using pre-defined answers. When you interact with the chatbot, it is clearly identified as "WAYLOT Bot." If the chatbot cannot resolve your issue, you can use the "Write to Support" button to be transferred to a human support agent, who is identified as "WAYLOT Support."

The chatbot processes the text you enter in order to match it to a relevant pre-defined response. No automated decisions with legal or similarly significant effects are made by the chatbot.

8.2. Chat translation

Messages exchanged between users in the in-platform chat and reviews posted on seller profiles may be translated automatically using AI models, if you chose this option. The translation is performed in real time to facilitate communication between users who speak different languages. When translation is active, both the original text and the translation are available to the recipient. Translated outputs are not stored separately from the original messages.

Translation processing is carried out on infrastructure provided by third-party AI service providers based in the United States, acting as a sub-processor under our data processing agreement. Our agreement with these providers contractually prohibits the use of your data for training or improving their AI models.

We do not use your messages or reviews to train, fine-tune, or improve our own AI models or any third-party AI models.

8.3. Content moderation filter

We use an AI system to screen ad listings and chat messages for content that may violate our platform rules or applicable law. The AI system analyses the text and images in your listing or message to assess compliance. This is not a keyword-based filter – the system uses an AI model capable of understanding context and meaning.

Content moderation processing is carried out by the same third-party AI service provider described in Section 8.2, under the same data processing agreement and transfer safeguards.

We do not use data processed through the content moderation system to train, fine-tune, or improve any AI models.

9. Data Security

We protect your personal data with appropriate technical and organisational measures, we regularly review and update these measures as the platform develops.

However, no system is completely secure. We encourage you to use strong, unique passwords and to contact us immediately at privacy@waylot.com if you suspect unauthorised access to your account.

10. Changes to This Policy

We may update this policy to reflect changes in how we process data, legal requirements, or platform features. When we make material changes, we will notify you at least 30 days in advance by email and by a notice within the platform.

11. Contact Us

Controller: CASETONE DEVELOPMENT S.A R.L

Registered office: 21, rue du Puits Romain, L-8070, Bertrange, Luxembourg

Legal representative (gérant): Irina KHAREVINA

Data protection email: privacy@waylot.com