1. Scope and roles
This notice applies to the BauHunt website, purchase requests, team workspace, supplier offer form, accounts, and related support. 24EE OÜ is the controller. A supplier acts as a separate controller when it uses buyer data for its own quotation, sale, or contract.
2. Data we process
- Request content, materials, quantities, links, notes, purchase timing, and preferred suppliers.
- Unfinished-form content, its current step, and any contact or delivery details already entered. An unsent form is not shared with suppliers and does not trigger automated reminders.
- Delivery address or pickup area and radius, delivery method, and unloading preference. For an official location, we also retain its label, area codes, reference-point coordinates and source date.
- Name, verified email, phone, company information, account identity, chosen Google identity or secure password hash, workspace roles and activity. We never store the password itself. Account setup/reset links expire in 30 minutes; keyed address hashes used for abuse limits expire within one hour.
- Supplier contacts, line or total prices, VAT status, delivery time and cost, availability, PDF offer, and offer link.
- Session, security, IP and technical log data, and support communications where necessary.
Sources and required information
Data comes from you, a workspace member inviting you, a responding supplier and your chosen sign-in provider. Professional supplier contacts, roles and business details may also come from public company websites and the business register to find suitable sellers and handle relevant requests. A public contact is not consent to general marketing. For indirectly obtained personal data, we provide information by first contact or within one month, unless a statutory exception applies.
Marked material, delivery and contact details are needed to perform the relevant action. Accounts, external AI connections and analytics are optional.
3. Purposes and legal bases
GDPR Article 6(1)(b) applies where you are the individual party requesting or receiving our service; professional representatives’ contact data is handled under legitimate interests, Article 6(1)(f). Legal duties use Article 6(1)(c), and optional analytics uses Article 6(1)(a). You can object to legitimate-interest processing.
We use data to take steps at your request and perform the service, comply with legal duties, and pursue legitimate interests in security, support, service reliability, temporarily retaining unfinished forms to understand input-flow failures, aggregated improvement, and legal claims. Optional analytics and masked recordings use separately requested consent, which you can withdraw without affecting the service.
Optional PostHog EU analytics
If optional analytics is activated for the service, we request separate permission to analyse journey steps, sanitized error codes and aggregated AI workflow measures. Masked recordings require an additional choice and cover up to 5% of permitted sessions. Capture stays off before permission. Refusal and withdrawal do not prevent service use.
No entered text, contacts, prices, addresses, private URLs, AI prompts or answers are sent to PostHog. Recordings contain masked page structure and interactions, without original styling, images, console or network content. Private offer, tracking, account and admin pages are never recorded. After consent, PostHog creates a profile under a random technical identifier so erasure of its events and recordings can be requested; it is not linked to your account.
The processor is PostHog, Inc.; we use its EU project. EU storage does not mean that all subprocessors or support process only within the EU. See the subprocessors and DPA terms. On the free plan, events can be queried for one year; the end of that period does not guarantee deletion. Recordings have a configured 30-day retention; unsent queue data expires after 24 hours. Withdrawal removes unsent data. To request erasure of already transmitted data, keep every data reference shown in preferences and email hunt@bauhunt.ee.
4. Sharing a request
Selected suppliers receive the materials, quantities, timing, delivery or pickup preference, and other information needed to quote. The pickup area and kilometre radius are included in the request sent to suppliers. Contact sharing is on by default so a supplier can deal with you directly; you can turn it off before sending.
A copy already delivered to a supplier cannot be recalled. Contact hunt@bauhunt.ee promptly if you want to withdraw a request.
Visibility of supplier offers
The buyer and authorized workspace members receive the offer with supplier contacts and permitted attachments. Under the supplier’s accepted contractual comparison clause, other suppliers who have submitted an offer for the same request may see its total price, currency, VAT treatment, coverage, availability and lead time. Names, contacts, free text, PDFs, links and individual line prices are excluded. This is not a public price list.
Contractual price-sharing permission is not blanket consent to personal-data processing. The legal bases and rights described here still apply. Hiding names cannot always prevent indirect identification. The acceptance method, time and terms version are retained with the offer as evidence of its conditions. Submitting an emailed offer accepts the clause when the invitation explained it beforehand; we retain the association between that notice and the specific reply.
5. Voice input
Voice input is currently disabled. You can type or paste materials. The following describes how voice input previously worked.
Voice input uses your browser’s speech-recognition capability. BauHunt’s server does not receive or store raw audio. Your browser, operating system, or their speech provider may process the audio under its own terms. BauHunt receives the recognised transcript when you add it to the request, and you can review, correct, or delete it before sending.
6. Automated structuring
BauHunt may use rules and, when configured, the OpenAI API to extract products, quantities, units, and clarification questions from request text. The necessary text—not raw voice audio—is shared.
BauHunt may calculate an indicative VAT-inclusive material-price range from its editorial market-price model. Supplier offers from other requests are not used for this estimate. The estimate and its coverage may be visible to an authorised administrator and a supplier that receives the request. Test-mode offers are not used for market-price learning.
You review the structured request. We do not make a solely automated decision with legal or similarly significant effects.
Location lookup
To find official choices and clarify the place entered, we send the location text to the Estonian Land and Spatial Development Board’s In-AKS service. We do not add your name, email, phone number or shopping list. An area reference point is not an exact house location. If no official place is found, your text is retained.
7. Recipients and international transfers
Necessary recipients may include selected suppliers, hosting and email providers, Google for sign-in, the browser speech provider, OpenAI for text structuring, IT advisers, and public authorities where legally required. For processing outside the EEA, we rely on an applicable safeguard such as an adequacy decision or Standard Contractual Clauses. Ask us for current details.
Short-lived material input history
We automatically retain meaningful intermediate versions of material text, recognised product rows and clarifications, plus the form stage and submission outcome. The purpose is to identify and fix product-recognition and input-flow errors. For this limited first-party diagnostic processing, we rely on our legitimate interest in service reliability; we do not show a separate consent prompt.
Contact and delivery fields, the general project description, files and raw audio are excluded. Before storage, we mask recognisable contact details, secrets and links in material text. The automatic filter can miss information, and a random session identifier does not make the content anonymous. Do not enter personal details or secrets in the materials field.
Only authorised administrators have access, and opening examples is logged. History is not sent to suppliers or automatically sent to a model provider for training. An administrator can flag an example for later human review; the flag does not verify the product or extend retention. Storage has volume and frequency limits: we do not retain every keystroke or every rapid intermediate version.
History is available for up to 14 days, without extending the maximum through new activity or a review flag. Expired content is no longer accessible and is removed during the next daily guarded cleanup, normally within 24 hours. Encrypted backups expire within 35 days. After a restore, deletion records are applied before data is used again. A minimal suppression or deletion marker may be kept longer to honour your choice and prevent deleted content from returning.
Open “History and privacy” beside the form and choose “Stop and delete this session’s history”. Your request and ordinary draft saving are kept, and you can continue using the service. To object or ask about older or account-linked data, email hunt@bauhunt.ee.
Service providers and connected assistants
Zone.ee provides hosting/email; Backblaze B2 stores encrypted backups. Google provides chosen sign-in, OpenAI handles configured text structuring, and optional PostHog processing is described above. Necessary access is limited to authorized providers and advisers. A connected MCP AI assistant receives the request/offer information allowed by your approved permissions; revoke the connection in account settings. EU storage alone does not guarantee all support and subprocessing stays in the EEA. Ask us for the applicable transfer safeguard and a copy.
8. Retention and security
Retention depends on the data category. Explicit closure starts the request’s retention period; meaningful new activity may reopen it. Any legal hold is documented, limited to relevant records and reviewed.
- Requests, offers, versions, related correspondence and PDFs: 365 days after explicit closure; active requests and specific lawful holds remain until their purpose ends.
- Unsent forms and saved drafts: 30 days after the last user edit; the temporary public-form copy is removed after successful submission.
- Terminal mail-delivery records: 90 days. Routine access-log target: 30 days; security/error logs: 90 days. Provider copies require the provider’s separate process.
- Shared projects: while active, then 365 days after closure, respecting other members’ rights. Inactive accounts are reviewed after 24 months, with 30 days’ notice before deletion where possible.
- Public professional contacts: checked at least every 180 days; obsolete personal contacts are replaced or removed. Use is restricted while a relevant objection is resolved.
- Actual BauHunt accounting records: 7 years from the financial year’s end where required by law, not every purchase request.
- Encrypted backups: normally 35 days, plus up to one day for hidden cloud versions. Minimal deletion markers remain until restoration cannot reintroduce data, then are removed within 7 days.
Shared workspaces, supplier personal correspondence and external providers may require manual review and erasure. Automatic daily cleanup does not cover every copy. You can request earlier erasure, and retention does not extend our response deadline.
We keep requests, offers, workspace data, and communications only while needed for the service, active relationship, legal duties, or claims, then delete or anonymise them. An unfinished unsent form is deleted 30 days after the last activity or immediately after successful submission. During that period it is visible to authorised administrators for evaluating the input flow, but it is not shared with suppliers or used for automated follow-up. Login sessions normally expire after 30 days of inactivity and at the latest after 90 days. You may request deletion, subject to lawful retention needs.
We use access controls, encrypted connections, secure session cookies, private random links, input validation, backups, and risk-based logging. Keep account, tracking, and offer links private.
9. Your rights
We respond without undue delay, normally within one month. Complex or numerous requests may require up to two additional months; we explain the extension within the first month. Requests are normally free, and any identity check must be proportionate.
Depending on the circumstances, you may request access, correction, erasure, restriction, or portability, object to legitimate-interest processing, and withdraw consent. Email hunt@bauhunt.ee. You can complain to the Estonian Data Protection Inspectorate or your local EU supervisory authority.
10. Children and changes
The service is not directed to anyone under 18. We may update this notice when the service or law changes and will provide reasonable notice of material changes.