Privacy policy
Last updated 21 August 2026
What we collect, why, who else sees it and how long we keep it. Two things are worth knowing up front: we set no tracking cookies at all, and we never receive the owner identification numbers the register withholds.
Who is responsible
The controller is Nova Sidera D.O.O., Bar, Montenegro — full details on the imprint page. For any question about your data, or to exercise the rights described below, write to support@listar.info. Montenegro is outside the European Economic Area, but we offer this service to people in the EU, so we apply the GDPR standard to everything described here.
What we collect about you
Your email address, so that we can deliver the report and write to you about the order. The property identifier you enter, because it is the order. The technical data any web server records — IP address, browser identification, timestamps — kept in server logs. And, if you subscribe to monitoring, the list of properties you asked us to watch.
We do not receive your card details. Payment is handled by an external provider acting as merchant of record; we see only whether the order was paid, and the invoice data that provider passes back to us.
Personal data in the public register
A property sheet names the people registered on it: owners, holders of rights, applicants in a pending case. Processing those names is unavoidable — a report that hid who owns the property would be useless — but we minimise hard. The register view we read does not issue the owner’s national identification number or home address, so we never receive them and have nothing to store. We do not build owner profiles, we do not offer search by person, and a report is retrievable only from the property identifier it was ordered for.
If you are named in a property sheet we have processed and want to know what we hold or ask us to erase it, write to support@listar.info. Note that we cannot change the register itself: corrections to the record are made by the cadastre authority.
Why we process it, and on what basis
Your email address and order details are processed to perform the contract you entered into. Server logs and abuse prevention rest on our legitimate interest in keeping the service running and unabused. Invoice data is kept because tax and accounting law requires it. The names in the public register are processed on the basis of our legitimate interest in providing property due diligence — a purpose that only works because the data is already public, is used solely to describe the property it is attached to, and is never enriched, resold or used to contact anyone.
Automated text generation
Part of the explanatory prose in a report is produced by a language model, and the computation may run on infrastructure outside the European Economic Area. Personal data is removed before anything leaves us: identification numbers, addresses, and the names of natural persons are stripped from the data sent for generation, and the stripping happens inside the code path itself rather than being a step someone can forget. The model receives shares, dates, encumbrance wordings and the property identifier, and refers to people only by role — "the owner", "the applicant". Company names stay, because the register publishes them and a buyer needs them to look the seller up.
No decision about you is made automatically. The score in a report describes the property, not a person, and it has no legal effect on anyone.
Who else processes the data
Hosting is with OVH Srl in Milan, Italy — inside the EEA. The documents you send us and the finished reports are stored with Cloudflare R2 in a bucket located in the European Union. Transactional email — order confirmations, delivery notices — goes through Resend. Our own mailboxes are with Zoho in the EU. Payment is handled by an external provider acting as merchant of record, which processes your payment data as its own controller. Language model computation is described in the section above. We do not sell data, and we do not share it with advertisers, because we have no advertising.
How long we keep it
The document you send us is deleted 30 days after the order — long enough to redo the report or answer a question about it, short enough that a scan naming an owner is not sitting in storage indefinitely. The finished report stays openable from the link in your email for 12 months, so that you can return to what you paid for; after that it is deleted too. Server logs are kept for 90 days. Invoice and payment records are kept for as long as tax law requires, which we cannot shorten on request. Monitoring history is kept while the subscription is active and for 30 days after it ends.
Your rights
You can ask for a copy of the data we hold about you, have it corrected, have it erased, have processing restricted, object to processing based on legitimate interest, and receive your data in a portable form. Write to support@listar.info; we answer within 30 days and do not charge for it. If you are unhappy with how we handled the request, you can complain to the data protection authority where you live, or to the Agency for Personal Data Protection in Montenegro.
Security
Traffic to the site is encrypted in transit, access to the production systems is limited to the people who operate them, and reports are readable only from the account that ordered them. No system is beyond compromise; if one that affects your data occurs, we will tell you and the competent authority without hiding behind silence.
Changes to this policy
We keep the date of the last change at the top of this page. When a change is substantive — a new processor, a new purpose, a longer retention period — we will say so by email to account holders rather than quietly editing the text.