Privacy Policy

Messadine Portal is a local online service for Messadine, in the governorate of Sousse, Tunisia. It offers real estate listings, a local marketplace, job offers, information about the city and private messaging between users. In this policy, “we” means the team that runs the service.

For any question about this policy or your personal data, write to us at contact@messadine.tn or use our contact page.

We only collect the data we need to run the service:

• Your account: your first and last name, your email address and your password, which we only store in hashed form, never in plain text. If you add them, your phone number and your city. We also record your preferred language, the date you accepted the terms of use, whether you agreed to receive news about the platform, and how you sign in (with your email address or with Google).
• Your posts: the real estate listings, Marketplace items and job offers you publish: title, description, price, category, address or city, the map location if you add one, photos and videos, and the contact details you choose to show (name, phone number, email address).
• Your messages: your conversations with other users about a post: the text of the messages, the post concerned, the date and time, and whether a message has been read.
• Reports, blocks and moderation: the reports you send (the content concerned, the reason and any details you add), the users you have blocked and, if our team suspends your account, the date and the reason for the suspension.
• Notifications: if you turn them on, the identifier your device or browser gives us to deliver them.
• Location: only if you ask a publishing form to use your current position to fill in an address. Your device asks for your permission first, and the position is only kept if you save it in your listing.
• Technical data: like any website, our servers receive your IP address, the type of browser or device you use and the pages you request. We use them to protect the service, for example to limit repeated attempts and block abuse. To count the views of posts and the views and clicks of advertisements, we record a code calculated from your IP address and your browser (a hash) instead of the address itself. For a click on an advertisement, we also record the page where it was clicked.

We use your data to:

• create your account, keep it secure and let you sign in;
• publish your posts and show them, with the contact details you chose, on the website and in the apps;
• deliver your messages and let you know when you receive a new one;
• moderate content and handle reports, so that the service stays free of scams, abuse and illegal content;
• protect the service and its users against fraud, spam and attacks;
• count the views of posts and advertisements, to show view counts and give advertisers overall figures;
• send you the emails the service needs, such as a password reset link;
• comply with the law and respond to lawful requests from the authorities.

We process your data to provide the service you asked for, with your consent where the law requires it (for example for notifications or your location), and to keep the service safe.

We do not sell your personal data, and we do not use it to build advertising profiles.

Published posts are public: anyone can see them on the website and in the apps, including their photos, their address or map location and the contact details you entered. Search engines may index them and people may share them. Only add information you are happy to make public.

The people you exchange messages with see your first and last name and the messages you send them.

Members of our team in charge of moderation and support can access the data they need for that work.

Posts are checked automatically when they are published or edited, for example for banned words or for nudity in photos and videos, and content that fails these checks is refused. Our moderation team can also review any post at any time, whether or not it has been reported, and hide or remove it.

When you report a post, a user, a message or a conversation, our moderators see your report and the content concerned. A short copy of the reported content (for example the text of the message, the title of the post or the name of the user) is kept with the report, so that it can still be reviewed if the content is deleted. Moderators use this information only to handle reports and apply our terms of use, and the person concerned is not told who reported them.

Your messages are private between you and the person you are talking to, but they are not end-to-end encrypted: they are stored on our servers. We do not read them, except when a message or a conversation is reported to us, or when it is necessary to protect the service or to comply with the law.

We share data only with the providers we need to run the service, each for a specific task:

• Hosting: our servers and our database are run by a hosting provider, which stores the data on our behalf, including the photos and videos you upload.
• Email delivery: an email provider sends the messages the service needs, such as password reset links.
• Cloudflare Turnstile: a security check that protects the publishing forms against automated abuse. Cloudflare receives technical data from your browser or device, such as your IP address.
• Google and WorkOS: if you choose “Continue with Google” on the website, Google confirms your identity, then WorkOS, the sign-in service we use, sends us your name and email address. We never receive your Google password.
• Notification services: notifications are delivered by Google’s Firebase Cloud Messaging for the apps (which relies on Apple’s notification service on iPhone and iPad), and by your browser’s push service on the website. App notifications only say that you have a new message, never its content; on the website, a notification may show the sender’s name, the post concerned and the beginning of the message.
• Maps: the maps are loaded from OpenStreetMap’s servers, and the address search in the publishing forms uses its Nominatim service. Your browser or device contacts OpenStreetMap directly, so it receives your IP address and, when you search for an address, place the marker on the map or use your position, the text you typed or the coordinates. The markers shown on the maps come from our own servers.
• Google AdSense, on the website only: the website may show ads from Google, which may use cookies to display and measure them and, depending on your choices with Google, to personalise them. Find out how Google uses information from sites that use its services. The apps never show Google ads.
• Embedded videos: some city pages contain YouTube or Vimeo videos. These services receive your IP address when the video loads and may use their own cookies.

We only share data with providers that protect it at a level at least equivalent to this policy. Those that process data on our behalf may use it only to carry out the task we give them. Services that your browser or device contacts directly, such as maps, embedded videos and Google AdSense on the website, also apply their own privacy policies to the data they receive.

Advertisements from local businesses are served by our own servers: we only give advertisers overall figures (numbers of views and clicks), never your identity.

We may also disclose data when the law requires it, for example at the request of a judicial authority, or to protect the rights and safety of our users.

The servers that host the service, and with them the data described in this policy, are located outside Tunisia. Some of the other providers above, such as Google, Cloudflare, WorkOS or OpenStreetMap, may also process data in other countries. In every case, they only receive the data needed for their task.

We only use the cookies and storage the service needs to work and to remember your choices. We use no analytics or advertising cookies of our own.

• Sign-in: the refreshToken and csrfToken cookies keep you securely signed in. They are renewed each time you use the service and stored for up to 30 days, but your session ends after 7 days without use, and you then need to sign in again. They are deleted when you sign out.
• Google sign-in, on the website: two temporary cookies are used during sign-in, one to protect it and one to remember your language. They expire after 10 minutes.
• Language: the NEXT_LOCALE cookie remembers your language for one year. It is also updated when you open a page in another language.
• Local storage: the website and the apps store on your device your theme (light or dark), whether you have seen the welcome screens or dismissed a suggestion (notifications, installing the app), your notification choice in the app and drafts of the posts you are writing. Drafts are kept for up to 7 days and are erased when you sign out.

The third-party services described above, such as Google AdSense on the website, Cloudflare Turnstile and embedded videos, may use their own cookies or similar technologies, under their own policies.

You can delete cookies and stored data in your browser or device settings. You will then be signed out and your preferences will be reset.

• Account: as long as your account exists. When you delete it, your data is deleted immediately, as described in the next section.
• Posts: until you delete them. Posts that receive no views within a certain time after they are published (30 days by default) may be removed automatically. A deleted post disappears from the service immediately and is permanently erased from our database after 90 days.
• Messages: as long as the conversation exists. A conversation and all its messages are deleted when either participant deletes their account.
• Reports: kept, with the copy of the reported content, as moderation history that helps us deal with repeated abuse and protect users. They are not deleted automatically. If you delete your account, the reports you sent are kept without your name or any link to your account.
• Notification identifiers: until you turn notifications off or sign out on that device, until the identifier stops working, or until you delete your account.
• View and click statistics: the codes used to count views and clicks (see “The data we collect”) are kept for our statistics and are not deleted automatically, except those of an advertisement, which are deleted with it.
• Security data: the counters and temporary restrictions we use against abuse expire automatically after a few minutes or hours. Technical logs are kept only as long as needed to secure the service and fix problems.

You can delete your account at any time, in the app or on the website: open Account, then “Delete my account”. Deletion is immediate and cannot be undone.

We then immediately delete:

• your profile and sign-in details, such as your name, email address and phone number;
• your real estate listings, Marketplace items and job offers;
• your conversations and their messages, which also disappear for the people you talked to;
• your notification subscriptions and registered devices;
• the blocks you set, and those other users set on you.

We keep the reports you sent, without your name or any link to your account, and the reports made about your content or your account, with the copy of the reported content they contain, so that our moderation history stays complete. These reports are not deleted automatically.

Some accounts, for example those linked to advertising campaigns, can only be deleted by an administrator. If you can no longer sign in, or if the app tells you that an administrator must delete your account, write to us at contact@messadine.tn from the email address of the account and we will delete it.

Tunisian law on the protection of personal data, in particular Organic Law no. 2004-63 of 27 July 2004, gives you rights over your data, including the right to access it, to have it corrected or deleted, and to object to its processing on legitimate grounds.

You can exercise many of these rights yourself:

• correct your name, phone number and city in Account;
• edit or delete your posts in My posts;
• turn notifications off in the app or in your device or browser settings;
• refuse or withdraw access to your location in your device settings;
• withdraw your agreement to receive news about the platform by writing to us.

For any other request, for example to get a copy of your data or to object to a particular use of it, write to us at contact@messadine.tn. To protect your account, we may ask you to write from its email address or to confirm your identity.

If you believe your rights have not been respected, you can also contact the national authority responsible for the protection of personal data.

Connections to the service are encrypted (HTTPS). Passwords are only stored in hashed form, sessions rely on secure cookies, and repeated sign-in attempts are limited. No system is perfectly secure, however: keep your password to yourself, and tell us if you notice anything unusual on your account.

The service is not directed at children. If you are a parent or guardian and believe that a child has given us personal data, contact us so that we can delete it.

We may update this policy, for example when we add a feature or a provider. The date of the current version is shown at the top of this page. If a change significantly affects how we use your data, we will let you know in the service.

For any question, request or complaint about your personal data, write to us at contact@messadine.tn or use our contact page.