Privacy Policy

GDPR-oriented notice · Ireland · Effective: 8 October 2026 · Version 1.0

1. Who is the controller?

The data controller for personal data processed via ItsForSale is:

• Name: Keith Patrick McCann
• Role: Operator of ItsForSale
• Address:
• Email (privacy):
• Phone:

If a company is later set up to operate the Service, this notice will be updated with the registered company name, number and registered office.

2. What this notice covers

This Privacy Policy explains how we process personal data when you use ItsForSale websites and apps, contact us or report content. We list ads; we do not run on-platform checkout for goods.

Related documents: Terms of Use, Cookie Policy, Contact / Imprint.

3. What personal data we collect

Depending on how you use the Service, we may process:

We ask you not to put special-category data (health, religion, politics, sexual life, etc.) or other people's sensitive data in public ads. We may remove such content.

4. Purposes and lawful bases (GDPR Art. 6)

Where we rely on legitimate interests, you may object (see your rights below). Where we rely on consent, you may withdraw it without affecting earlier lawful processing.

5. Public listings, local ads and sample data

• Photos: photos you upload are stored and are publicly viewable through your ad's link. Remove or crop anything you do not want shown (for example house numbers, number plates or faces).
• Location: use county or town. Exact street addresses are discouraged for safety.
• Contact: phone numbers in public ads are optional and visible if you choose to show them.
• Sample data: while the Service is new, the homepage may show example listings for demonstration. Sample ads are illustrations, not real offers from real sellers, and their contact details are not real people. We will remove them as live user content grows.
• Location filters help local meet-ups; they do not make us a party to your deal.

6. Who we share data with

We do not sell your personal data. We share it only as needed with:

• Hosting and infrastructure processors, who store and serve the Service;
• Authentication, email and messaging providers, to send login links, confirmations and support mail;
• Analytics providers, only if you consent to analytics cookies (we do not currently use any);
• Professional advisers, such as solicitors and accountants, under confidentiality;
• Authorities, such as An Garda Síochána, Coimisiún na Meán, the CCPC, the DPC or courts, when legally required or necessary to protect vital interests or prevent serious crime.

Processors act on our instructions under data processing terms. Our current providers are:

• Vercel: website hosting;
• Supabase: database, user accounts (authentication) and photo storage;
• Blacknight: domain name registration and DNS.

We will update this list if our providers change.

7. International transfers

Some processors may store or access data outside the EEA/UK. Where that happens, we use appropriate safeguards such as an adequacy decision or Standard Contractual Clauses (SCCs), plus supplementary measures where needed. Details on request: .

8. How long we keep data

Exact periods may be refined as the Service matures; we will update this notice.

9. Security

We use HTTPS, access controls, and reasonable technical and organisational measures. No online service is 100% secure. If a personal data breach risks your rights and freedoms, we will notify the Data Protection Commission as required (generally within 72 hours of becoming aware) and affected individuals when the law requires.

10. Your rights under GDPR

Subject to legal limits, you have the right to:

• Access: get a copy of the personal data we hold about you;
• Rectification: correct inaccurate data;
• Erasure: ask us to delete data ("right to be forgotten") in certain cases;
• Restriction: ask us to limit processing in certain cases;
• Portability: receive data you provided in a structured, common format where processing is based on consent or contract and is automated;
• Object: object to processing based on legitimate interests;
• Withdraw consent: where we rely on consent, at any time;
• Not be subject to solely automated decisions with legal or similarly significant effects (we do not do this).

To exercise your rights, email from your account email and describe your request. We may need to verify your identity. We aim to respond within one month (extendable by two months for complex requests, with notice).

11. Children

The Service is for users aged 18+. We do not knowingly collect personal data from children. If you believe a minor has created an account, contact us and we will delete it.

12. Automated decision-making and profiling

We do not use solely automated decision-making that produces legal or similarly significant effects about you. Ranking of listings (for example by recency or distance) is a product feature, not a credit or eligibility decision. If that changes, we will update this notice.

13. Cookies and similar technologies

See our Cookie Policy for what we store on your device and why.

14. Changes to this Privacy Policy

We may update this notice. The effective date at the top will change. Significant changes will be highlighted in-app or by email where appropriate.

15. Complaints to the Data Protection Commission

You can complain to the Irish supervisory authority:

• Data Protection Commission (DPC), website: www.dataprotection.ie
• You may also contact your local EU supervisory authority if you live elsewhere in the EEA.

We would appreciate the chance to resolve concerns first: .

Back to top · Home