Your data
Privacy policy
This Privacy Policy describes how MEROVA LLC, in its capacity as data controller, collects, uses, retains and protects the personal data of the Users of the Lokalfinds platform. It specifies the categories of data processed, the purposes pursued, the legal bases, the retention periods and the rights available to you, pursuant to the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the Indonesian Personal Data Protection Law (UU PDP No. 27/2022). MEROVA LLC undertakes to process your data in compliance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation and security.
Last updated : 27 June 2026
1. Data controller
The data controller is MEROVA LLC, publisher and operator of the Lokalfinds platform, a company of the State of Wyoming (United States), whose registered office is located at 30 N Gould St, Sheridan, WY 82801, United States. The Data Protection Officer (DPO) may be contacted at contact@lokalfinds.com; their formal designation is in progress. For any question relating to the processing of your data or the exercise of your rights, you may write to contact@lokalfinds.com.
2. Data we collect
We collect the following categories of data: (a) Account data: email address (mandatory), name or pseudonym, telephone number (optional), profile photograph (optional); (b) Listing data: title, description, price, photographs, category and geographic area. Precise GPS coordinates (latitude/longitude) are stored encrypted server-side and are NEVER exposed client-side: only an approximate position (obfuscation of approximately ±200 to 400 m) and an indicative area (a circle of approximately 750 m) are displayed, in order to protect the Seller's privacy; (c) Browsing and technical data: connection logs (IP address, browser and device type, pages viewed, timestamp) as well as the cookies and trackers described in the Cookie Policy; (d) Communications: the content of messages exchanged via the messaging system, the contact form and reports. We do not knowingly collect so-called “sensitive” data within the meaning of article 9 of the GDPR.
3. Processing purposes
Your data is processed for the following purposes: (a) to provide and operate the classified-ads service (account creation and management, publication, browsing and introduction); (b) to ensure content moderation, the security of the Platform and the prevention of fraud and abuse; (c) to manage billing, subscriptions and payments for Pro accounts; (d) to produce anonymised audience statistics and improve the service; (e) to respond to requests submitted via the contact forms and to handle reports; (f) to comply with our legal and regulatory obligations (log retention, accounting obligations, responses to requisitions from authorised authorities).
4. Legal bases (GDPR art. 6)
Each processing operation relies on a legal basis within the meaning of article 6 of the GDPR: (a) the performance of the contract to which the User is a party (account creation, listing publication, Pro subscriptions — art. 6(1)(b)); (b) the Publisher's legitimate interest in ensuring security, preventing fraud, defending its rights and improving the service, after balancing against your rights and freedoms (art. 6(1)(f)); (c) your prior consent, freely given and revocable at any time, for non-essential trackers and audience measurement that is not strictly necessary (art. 6(1)(a)), collected via the /cookies page; (d) compliance with a legal obligation to which the Publisher is subject (art. 6(1)(c)). The withdrawal of consent does not affect the lawfulness of the processing carried out before such withdrawal.
5. Data recipients
Your data is accessible only to the following authorised persons and recipients: (a) the members of the Lokalfinds team (administration, moderation, support), bound by a strict confidentiality obligation and limited to what is strictly necessary; (b) our technical subcontractors, acting on instruction and bound by Data Processing Agreements compliant with article 28 of the GDPR: Vercel Inc. (frontend hosting and CDN, United States), Supabase Inc. (database, authentication and storage, EU servers), Resend (delivery of transactional and notification emails), Stripe (payment processing for Pro accounts, an international payment provider); (c) where applicable, the authorised administrative or judicial authorities, upon a duly issued requisition. Your data is in no case sold, rented or transferred to third parties for commercial prospecting purposes.
6. Transfers outside the EU
The main database (Supabase) is hosted within the European Union (eu-central-1 region, Frankfurt, Germany): the primary storage of your personal data involves no transfer outside the European Union. Certain technical services may nonetheless entail processing in the United States (Vercel for frontend hosting and CDN distribution, Stripe for payments, OpenAI for the generation of illustration images that contain no Users' personal data). The delivery network mainly serves non-identifying resources (HTML, CSS, JavaScript and public images). Where a transfer outside the European Union takes place, it is governed by appropriate safeguards within the meaning of Chapter V of the GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–United States Data Privacy Framework (DPF).
7. Retention period
Your data is retained for the period strictly necessary for the purposes pursued, then deleted or anonymised. Account data: for the entire lifetime of the account; in the event of prolonged inactivity (3 years), the account is anonymised after prior notification. Listing data: up to 12 months after the removal of the listing, then permanently erased. Server logs (IP address, user-agent, URL): 12 months (security and anti-fraud obligation). Billing data and accounting records: 10 years (accounting obligation). Contact messages and reports: 24 months after they are handled. Cookies and trackers: according to the durations indicated on the /cookies page, up to a maximum of 13 months for trackers subject to consent.
8. Your rights
In accordance with articles 15 to 22 of the GDPR and the equivalent provisions of the UU PDP Law, you have the following rights over your data: (a) right of access; (b) right of rectification; (c) right to erasure (“right to be forgotten”); (d) right to portability, in a structured, commonly used and machine-readable format; (e) right to object, in particular to processing based on legitimate interest; (f) right to restriction of processing; (g) right to withdraw your consent at any time for the processing that depends on it; (h) right to give directives regarding the fate of your data after your death. You also have the right not to be subject to a fully automated decision producing legal effects concerning you: any significant moderation measure is subject to human intervention.
9. How to exercise your rights
Most of your rights can be exercised directly from your personal area: updating your information in /compte/parametres and deleting your account from your settings. For any other request, you may write to contact@lokalfinds.com specifying the purpose of your request; proof of identity may be requested in the event of reasonable doubt as to your identity. We undertake to respond within one (1) month of receipt of the request, a period that may be extended by two (2) months in the event of a complex or numerous request, in accordance with article 12 of the GDPR. The exercise of these rights is free of charge, save for a manifestly unfounded or excessive request.
10. Cookies
The Platform uses cookies strictly necessary for its operation (Supabase authentication session, storage of language and theme preferences), which do not require consent, as well as, subject to your acceptance, anonymised audience measurement trackers. When you are logged in to your account and have consented to this audience measurement, the corresponding navigation events may be linked to your account identifier — in particular to exclude your own visits from the statistics and to analyse your journey; they are then no longer strictly anonymous as regards you, and this linkage ceases as soon as you withdraw your consent or log out. No advertising cookies or third-party trackers for marketing purposes are used to date. The details of the trackers, their retention period and how to manage your consent are described on the /cookies page, which we recommend you consult.
11. Minors
The Platform is exclusively reserved for adults, aged at least eighteen (18) years. The creation of an account by a minor is prohibited. The Publisher does not knowingly collect data relating to minors. Any account that appears to belong to a minor will be suspended without delay and the associated data erased as soon as possible. If you believe that a minor has provided us with data, you may inform us at contact@lokalfinds.com.
12. Security
We implement appropriate technical and organisational measures, in line with the state of the art, in order to protect your data against any destruction, loss, alteration or unauthorised access: encryption of exchanges via TLS 1.3, hashing of passwords (bcrypt algorithm managed by Supabase Auth), data partitioning through the PostgreSQL Row Level Security (RLS) mechanism, server-side encryption of precise geographic coordinates, the principle of least privilege for internal access, logging, regular security audits and daily encrypted backups. As no system can guarantee absolute security, in the event of a data breach liable to result in a high risk to your rights and freedoms, you will be informed and the supervisory authority notified, in accordance with articles 33 and 34 of the GDPR.
13. Complaints
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data constitutes a breach of the applicable regulations: the CNIL (Commission Nationale de l'Informatique et des Libertés) for French residents, the data protection authority of your country of residence for other European Union residents, or the Indonesian Ministry of Communication and Information Technology (KOMINFO) for Indonesia. We nonetheless invite you to contact us beforehand at contact@lokalfinds.com in order to seek an amicable solution.
14. Policy updates
This Privacy Policy may be updated to take account of legal, regulatory, technical or functional developments. The date of last update appears at the top of this page. Any material change will be notified to you by email or by an information banner within the Platform at least thirty (30) days before it takes effect, in order to allow you, where applicable, to withdraw your consent or close your account.
15. DPO contact
For any question, request to exercise your rights or complaint relating to the protection of your personal data, you may contact the Data Protection Officer (DPO) at contact@lokalfinds.com. We undertake to examine your request diligently, to respond within the legal time limits and to cooperate fully with the competent supervisory authorities.