Privacy Policy
Last updated: June 2026
Behind Lokalo there’s a person, not a corporation. That’s why, for us, data protection isn’t annoying fine print. It’s something we genuinely care about. Your data belongs to you; we only borrow it so that Lokalo works for you, and we treat it as carefully as we would our own. We collect as little as possible, pass nothing on to advertisers, and sell nothing at all. In the lines below we explain, in plain English, what data we need, what for, and how you stay in control of what happens to it at any time.
Plain words for people, not for lawyers. Tap a card for the details.
Technical things like your IP address are only generated automatically and protect against abuse.
1.Who’s responsible
The controller for your data on Lokalo.lu is Boumans Jimi, 26, Im Dahl, L-9759 Knaphoscheid (Luxembourg). Questions? Write to us directly: hello@lokalo.lu.
2.What data and what for
We only take what Lokalo needs to work:
- Account: your name, email and password (stored encrypted only, we never see it in plain text). If you sign in with Google/Microsoft, only their access token, not your password with them.
- Listings: title, description, price, category, location and photos.
- Location: the region you choose to filter by. For a listing we only show the location approximately (rounded to about 2 km), never your exact address.
- Messages: we don’t read along. We only store your chats so they get delivered and you can find your history again. We only take a look if you or someone else reports something.
- Technical: IP address, device and time. These are generated automatically while browsing and protect us from abuse.
- Statistics (anonymous): so we can see where Lokalo helps and where it struggles, we internally tally what happens, for example how many listings are added or what people search for. These are plain totals, not profiles about you. From your login we also roughly remember the city (from the IP address, never your exact address). Everything stays with us, is never sold and never used for advertising.
3.On what legal basis
We need your account, listings and chat so that Lokalo works for you (Art. 6(1)(b) GDPR). Security and spam protection are our legitimate interest (Art. 6(1)(f)). The anonymous statistics and the rough login location also rely on this basis, so we can improve Lokalo for the region. Some things are required by law (Art. 6(1)(c)). The email that notifies you of new messages can be switched off anytime (Profile → Security).
4.Who helps behind the scenes
We pass nothing on for advertising and sell nothing. A few technical service providers help us run things:
- Neon: database (in the EU).
- Vercel: website and photo storage.
- Brevo: our emails.
- OpenStreetMap: turns places into coordinates (via our server).
- CARTO: the map tiles; your browser loads them directly, which sends your IP address to CARTO (see point 9).
- echo.lu: Luxembourg’s official events platform provides us with the events and their photos. We copy the photos to our own storage (Vercel) and serve them ourselves. Your browser loads nothing from echo.lu or Google.
- Sentry: reports technical errors to us, without personal data.
5.Cookies
Only the essential ones: your language, your chosen location and your login. No advertising, no tracking. That is why we don’t bother you with a cookie banner either.
6.How long
Only as long as needed. As long as your account exists, your account and listings stay. If you delete your account, your data is anonymised and your listings disappear. Chat images are deleted automatically after 30 days.
7.Your rights
You can access, correct, delete or take your data with you, or object to its use (Art. 15 to 21 GDPR). Most of it you can do yourself right awayunder Profile → Security: download your data, pause your account or delete it. Otherwise: hello@lokalo.lu.
8.Complaints
If something isn’t right, you can lodge a complaint with the Luxembourg data protection authority: Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu. Better still, have a quick word with us first. Most things sort out directly.
9.Data outside the EU
Via the map (CARTO), your IP address may leave the EU. This is covered by the EU Standard Contractual Clauses.
10.Security
Passwords are stored encrypted only. Before saving, we strip the hidden location and camera data (EXIF) from your photos. Your exact address is never shown publicly.
11.Push notifications
If you turn on push notifications (Profile → Notifications), we store a technical subscription address from your browser for your device, two keys used to encrypt the message, and roughly your device type. For the notification to pop up on your phone, it travels through your browser’s push service — Google for Chrome/Android, Apple for Safari/iPhone, Mozilla for Firefox. Some of these providers are located outside the EU (covered by the EU Standard Contractual Clauses, see point 9). It’s optional, you can switch it off at any time, and the subscription address is removed as soon as you sign out or delete your account.