Settlia Global Legal & Compliance

Privacy & Cookie Policy

How Settlia collects, protects, and handles your personal data across the United Kingdom, Spain, Germany, and the European Union.

Effective Date: October 2026Legal Framework: EU GDPR / UK GDPR / DPA 2018Applies to: settlia.com & country networks

1. Data Controller & Scope

Settlia ("We", "Platform", or "Settlia Network") is committed to safeguarding the privacy and personal data of our users across our international multi-tenant platform, including settlia.com and its regional hubs in the United Kingdom, Spain, Germany, and broader Europe.

The designated data controller for personal data processed through Settlia is the platform operations entity. If you have any inquiries regarding data protection, you may reach our compliance desk at [email protected].

2. Information We Collect

We process only the personal information strictly necessary to provide our cross-border community, housing, and expat guidance services:

Account Credentials: Full name, verified email address, authentication tokens, and hashed passwords managed securely via Supabase Auth.
Profile & Expat Persona: Optional public profile elements such as display avatar, short bio, social handles, or preferred regional community.
Community & Marketplace Content: Information you voluntarily publish in discussion forums, room listings, housing inquiries, or local business listings.
Transactional Telemetry: Log records generated during premium feature purchases or verified listings. Note: Credit card numbers and sensitive banking credentials are never processed or stored on our servers; payments are handled directly by PCI-DSS certified payment processors (e.g. Stripe).
Technical & Security Metadata: Anonymized device telemetry, browser headers, and IP logs used exclusively for fraud detection, rate limiting, and session security.

3. Purposes & Legal Grounds for Processing (GDPR)

Under Article 6 of the General Data Protection Regulation (GDPR), we process your data under the following legal bases:

Contractual Necessity: To facilitate user authentication, establish communication channels in room inquiries, and display your community contributions.
Legitimate Interests: To maintain platform stability, prevent abuse (spam, counterfeit advertisements, abusive interactions), and optimize page performance.
Statutory Compliance: To adhere to European Union and United Kingdom accounting, tax, and law enforcement statutory duties when legally mandated.
Consent: For optional non-essential preferences, local notifications, or voluntary newsletter subscriptions.

4. Data Security & Storage Architecture

Settlia employs industry-leading infrastructure standards to protect your data. All database operations are hosted on secure, isolated cloud clusters powered by Supabase (PostgreSQL).

Security Guarantee: All database queries adhere to Row Level Security (RLS) policies, ensuring that private conversations and confidential account states can only be accessed by authenticated owners. All data in transit is encrypted using modern TLS protocols.

5. Cookie Policy & Local Storage

Our platform uses privacy-respecting cookies and client-side storage for operational performance:

Strictly Essential Cookies: Authentication session tokens and multi-tenant routing cookies (e.g., settlia_country, settlia_community, settlia_lang) required to show the accurate country content.
Preference Storage: Local storage flags for theme mode (Dark/Light) and localized interface preferences.
No Invasive Advertising Trackers: Settlia does not sell your browsing behaviors, personal data, or session cookies to third-party ad networks or brokers.

6. Data Retention & Account Deletion (Right to Erasure)

We retain your personal information only as long as your account remains active or as required by law.

In compliance with the GDPR Right to Erasure:

Self-Service In-App Deletion: You can permanently delete your account and profile directly from your Settlia account settings at any time.
Assisted Deletion Requests: You may submit an account or content wipe request by emailing [email protected]. Upon verification, all non-statutory records will be permanently expunged from production databases within 30 days.

7. Your Statutory Rights Under EU / UK Law

As a data subject, you hold comprehensive rights under European and UK data protection frameworks:

Right of Access: Request a transparent summary and copy of all personal records we hold about you.
Right to Rectification: Rectify inaccurate, outdated, or incomplete details in your user profile.
Right to Data Portability: Obtain your user-generated content in a structured, commonly used digital format.
Right to Object & Restrict: Object to processing carried out under legitimate interests or request restricted handling.

Have questions about your privacy?

Our dedicated data compliance team is available to assist you.

[email protected]