1. Who is responsible

The AVITO marketplace is operated by AVITO, a sole proprietorship registered in the Republic of Maldives and based in Malé (“AVITO”, “we”). AVITO decides how and why your personal data is used on the Platform. Questions and requests about your data: support@avito.mv.

The Maldives is preparing a Personal Data Protection Act. Until it is in force, AVITO follows the principles set out in this policy — collect only what is needed, say what it is for, keep it safe, and let you see and correct it — and will bring this policy into line with the Act when it is enacted.

2. What we collect

• Account: your mobile number, your name, and an email address if you choose to give one. Your number is the key to your account; there is no password.
• Business profile, if you register a business: business name, description, location and service areas, opening hours, contact number, logo, the services and products you list with their prices and photos, your subscription plan, and the bank account you register to receive payments (bank, account name, account number).
• Verification documents, if you apply for verification: the documents you upload, such as your business registration, and the decision made on them.
• What you do on the Platform: requests you post (including title, description, quantity, location and budget), quotes and offers, jobs and orders and their status, payments recorded against them and the transfer confirmations you upload, reviews you write or receive, reports you make, and messages and photos you send through AVITO’s chat.
• Notifications: which SMS and in-app notifications were sent to you and when, and your notification preferences.
• Technical: the cookies described in section 6, the pages you open, and standard server logs (time, address of the request, browser type) kept by our hosting providers to run and secure the service.

We do not collect card details, national ID numbers of customers, precise device location, or biometric data. The location you give a request is the island or area you type or pick.

3. Why we use it

• To sign you in: we send a one-time code to your number by SMS, store only a salted hash of the code, delete it when it expires after five minutes or is used, and pause sign-in after three wrong attempts.
• To run the marketplace: to match your request to businesses offering that service in your area, to show businesses the requests that match them, to carry quotes, jobs, orders, payments, messages and reviews between the two sides, and to keep the record both sides rely on.
• To tell you what happened: in-app notifications, and SMS for the moments that matter — your sign-in code, a new quote, a payment confirmed, a job completed. Businesses on the Business plan also receive SMS when a matching request is posted. You can switch off non-essential notifications in Settings; sign-in codes and transaction messages cannot be switched off while you use the service.
• To verify businesses and confirm payments: AVITO staff review verification documents and transfer confirmations by hand.
• To keep AVITO safe: to detect fraud, duplicate accounts and abuse, to act on reports, and to enforce our Terms of Service.
• To run promotions you take part in, such as AVITO First 100, including deciding eligibility and paying rewards.
• To improve the service: we look at how the Platform is used in aggregate — which searches find nothing, which categories are busy — never to profile individuals for advertising.
• To meet legal obligations, including keeping transaction records and responding to lawful requests from Maldivian authorities.

We do not sell your data, and we do not show third-party advertising.

4. Who sees it

• Other users, as the marketplace needs: businesses matched to your request see your request, your first name and your location; when you accept a quote, the business sees your name and number so it can do the work, and you see the business’s contact details and payment account. A business’s public profile, listings and reviews are visible to everyone. Reviews show the reviewer’s first name.
• Service providers that work for us under contract and only on our instructions: cloud hosting and database providers, file storage for photos and documents, and an SMS delivery provider that carries our messages to your number. They may not use your data for their own purposes.
• Payment reviewers: AVITO staff who confirm transfers see the transfer confirmations you upload and the payment account they were sent to.
• Authorities, when the law requires it or to protect someone from serious harm, and professional advisers under confidentiality.
• A successor, if AVITO is sold or merged, on the same terms as this policy.

5. Where it is kept

AVITO is hosted on cloud infrastructure outside the Maldives, currently in Australia, provided by international hosting companies. By using AVITO you agree that your data is transferred to and stored in those locations. We choose providers that keep data encrypted in transit and at rest and that meet recognised security standards.

Photos of businesses, services and products are stored in a public media store so they can be shown on the Platform. Verification documents and payment transfer confirmations are stored in a private store that only AVITO’s systems and authorised staff can read.

6. Cookies

AVITO sets three cookies, all first-party, none for advertising:

• avito_session: keeps you signed in on this device. It carries a signed reference to your account, never your number or a code, and expires after 30 days or when you sign out.
• avito_seen: set on your first visit so that the welcome screen is shown once and later visits open on the home screen. It holds no information about you and expires after a year.
• avito_sell_intent: set only when you start registering a business and have not finished, so that we can bring you back to the right place. It is removed when the business is created.

If you choose light or dark appearance, the choice is kept in this browser’s local storage, not in a cookie, and never sent to us. We do not use analytics or tracking cookies from other companies.

7. How long we keep it

• Sign-in codes: until they expire (five minutes) or are used.
• Your account and profile: for as long as your account exists.
• Requests, quotes, jobs, orders, payments and reviews: for as long as your account exists and afterwards for the period the law requires for business and tax records, currently up to seven years, because both sides of a transaction rely on the record.
• Messages and photos: for as long as the conversation exists on the Platform.
• Verification documents: for as long as the business is registered on AVITO and for two years afterwards, then deleted.
• Notification logs: 12 months.

When you close your account we remove your name, number and email from your profile, and keep only what the retention periods above require, in a form that no longer identifies you where that is possible.

8. How we protect it

Sign-in codes are never stored in plain text. Data travels over HTTPS only. Access to the database and file stores is limited to AVITO’s systems and to staff who need it for their role, and administrator actions are recorded. Secrets and provider keys are held on the server side and never in the app you download. No system is perfectly secure; if a breach affects your data we will tell you and, where required, the relevant authority, without undue delay.

9. Your choices and rights

• See and correct: your profile and business details are editable in the app. You may ask us for a copy of the personal data we hold about you.
• Notifications: manage non-essential notifications in Settings. Reply STOP to a marketing SMS, if we ever send one, to opt out.
• Delete: you may close your account in the app or by writing to us. See section 7 for what we must keep.
• Object or complain: write to support@avito.mv. We answer within 30 days. You may also complain to the Information Commissioner’s Office of the Maldives, which is expected to oversee personal data protection when the Act is in force.

We may ask you to confirm your identity — usually by a code to your registered number — before acting on a request.

10. Children

AVITO is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you believe we have, tell us and we will delete it.

11. Changes to this policy

We may update this policy as the service or the law changes. For material changes we will give notice in the app or by SMS at least 14 days before they take effect. The date at the top is the date the current version took effect.