Privacy Policy

§ 1

Who is responsible

Talli operates this site and decides what happens to the personal data described below. In the language of the GDPR (Regulation (EU) 2016/679, known in Poland as RODO) we are the controller of it.

Anything in this document, and any request under it, goes to hello@tallipark.com. A person reads that address.

§ 2

What we record

Only what a given feature needs to work. Most of the site (searching, the map, district prices, the live city-lot counts and the rental-agreement generator) runs without an account and records nothing that identifies you.

Two things change that, and both are things you do on purpose: creating an account, and filling in a form that asks how to reach you. Between them, this is the complete list:

• Your account: name, email address, chosen language, whether the address has been confirmed, and your password stored only as a hash that cannot be turned back into the password. Signing in with Google adds the profile picture Google returns. Signing in with Apple adds only the name and address Apple passes on, and if you use Apple’s “Hide My Email”, the address we hold is the relay address Apple generated for Talli, never your real one.
• Your sessions: a session token, and the IP address and browser user-agent of the device you signed in from. This is what keeps you signed in, and what lets us end a session that is being abused.
• Listings you publish: title, description, address, map location, price, photos, and the contact phone number you give for enquiries.
• Things you write: reviews and ratings, messages to other users, and the names and filters of the alerts you save.
• Spots you save to your favourites.
• Usage events, which pages were opened and which steps were reached, such as running a search, messaging an owner or publishing a listing. There is a section on those below, because how they are built is the part that matters.
• Enquiries you send without an account: the email address you gave, the note if you chose to add one, and the listing you were asking about. We do not write back to it automatically; it is kept so that a person can, and so that we know which spots people are asking about. Creating an account adds your address to the same list, so that everyone who has told us what they are looking for is in one place.

§ 3

What we deliberately do not record

Three of these are worth stating outright, because the obvious assumption about each one is the wrong one.

• The rental-agreement generator runs entirely inside your browser. Names, PESEL numbers, addresses and bank account numbers typed into it are saved on your own device and are never sent to us. That is a design decision, not a promise about our servers.
• We do not take phone numbers or email addresses out of the advertisements we index from other sites, even where one appears in the text.
• There is no advertising network, no tracking pixel, no social plugin and no third-party profile of you on this site.

§ 4

Listings we index from other sites

Part of what you can search here is public advertisements published on Otodom, sprzedajemy.pl and lento.pl. We record the advertisement’s own content (title, description, price, district, photos and a link back to where it was published) so that somebody looking for parking in Warsaw can search all of it at once instead of site by site. We do not record the name of whoever published it.

Otodom listings are shown the way a search engine shows a result: a short excerpt of the description and the first photograph, which loads from Otodom’s own servers, with a link to the full advertisement on Otodom on the same terms as every other indexed listing (below). We keep no copy of their photographs.

Photographs from the other sites are mirrored to our own storage so a listing loads quickly and blurs in rather than sitting on an empty box. Each one is shown credited to the site it came from, and remains that site’s or its author’s. We display it as part of an attributed index that links back to the original advertisement; we do not claim it as ours.

To read facts such as the deposit, the minimum term, the height limit or the street address out of an advertisement’s text, and to spot duplicates and advertisements that are not about parking at all, we send the title and description of advertisements indexed from sprzedajemy.pl and lento.pl to an AI model, currently Google’s Gemini API. Nothing from Otodom is sent, and nothing you type into Talli is: not your account, your searches, your messages or a listing you publish. If an author wrote a name or a phone number into an advertisement, it goes along with the rest of the text; we do not ask the model for it. A model’s answer never reaches the site as it stands: it is checked against the advertisement’s own text or the map, or approved by a person, first.

When you give us an email address on a listing, or are signed in to Talli, we show you the link back to the advertisement, so that you can see it where it was originally published and deal directly with whoever placed it.

If you published one of those advertisements (or the photographs in one) and you want it off Talli, send the link to hello@tallipark.com. We take it down on receipt and keep it suppressed, so a later indexing run does not quietly restore it.

§ 5

How we measure use of the site

We count business events (a search run, a listing opened, a listing published) in a table we own, and separately, Vercel counts page visits, referrers and page-loading speed for the site as a whole. Neither is built to identify you, and neither stores anything on your device for the purpose of doing so, see Cookies below.

• A business event carries a district, a spot type or a price band alongside what happened. It never carries a phone number, an email address, a street address, an exact price or a listing title.
• If you are signed in when it happens, the event is linked to your account. If you are not, nothing about it can be traced back to you, and we have no way to change that afterwards, including, deliberately, tying one anonymous visit's events to another. That costs us a little precision in what we can measure, and it is the trade we made.
• If you arrive through a link we tagged for a campaign (one ending in something like ?utm_source=facebook), the page view you land on records that tag, so we know which post or group sent visitors. The tag is a campaign name we wrote, never anything about you; nothing is stored on your device, and later events do not carry it.
• Vercel’s figures are aggregate and cookieless; see the entry for Vercel under Who else sees it.

§ 6

Why we are allowed to hold it

Every category above rests on one of the grounds in Article 6(1) of the GDPR.

• Performing our contract with you. Article 6(1)(b). Your account, your listings, your messages, and the emails those generate.
• Our legitimate interests. Article 6(1)(f). Keeping the site secure, enforcing rate limits, preventing abuse, understanding in aggregate which parts of the site get used, answering an enquiry you sent us, and making the advertisements we index searchable, which includes the address lookup and AI reading described above. We have weighed each against your interests and use the least identifying data that answers the question.
• Your consent. Article 6(1)(a). Two separate things: the listing alerts you choose to receive, and permission to email you matching spots, news and the newsletter. Each is a box you tick yourself and never one we tick for you. You can withdraw either at any moment, the second one from the “Email from us” section of your account, or from the link at the bottom of any message we send, which works without signing in.

§ 7

Who else sees it

We do not sell personal data and we do not hand it to anybody for their own marketing. It reaches the following companies because the site cannot function without them, and each one processes it on our instructions except where noted.

• Supabase, the managed Postgres database everything is stored in, hosted in Frankfurt.
• Vercel, hosting, and an aggregate, cookieless count of page visits and page-loading speed for the site as a whole.
• Cloudflare, storage and delivery of the photos on submitted listings, and storage of the encrypted database backups described under How long we keep it.
• GitHub, runs the nightly job that makes those backups. The database passes through its servers while a backup is made and is encrypted before it leaves them; GitHub keeps no copy.
• Resend, sending email: password resets, address verification, message notifications and alert digests.
• Google, through its Gemini API, reads the text of indexed advertisements described under Listings we index from other sites. Under Google’s terms for services used from Europe, it may not use that text to improve its own products.
• The OpenStreetMap Foundation’s Nominatim service turns an address into a point on the map: the address you type when placing a listing, and street addresses read out of indexed advertisements. Our server sends the request, so Nominatim sees the address but not your IP address or anything about your account. It is an independent service under its own privacy policy, not one acting on our instructions.
• OpenFreeMap, map tiles. Your browser fetches those directly, so OpenFreeMap sees your IP address whenever a map is on screen.
• Google, or Apple, and only the one you actually choose to sign in with. Neither is told anything about what you do on Talli afterwards.

§ 8

Data leaving Europe

Some of the companies above are established outside the European Economic Area or use infrastructure that is. Where data reaches them, the transfer rests on the European Commission’s standard contractual clauses or on an adequacy decision covering that country.

Write to hello@tallipark.com if you want to know which mechanism covers a particular one, and we will tell you.

§ 9

How long we keep it

Nothing is kept indefinitely by default.

• Site feedback: type, message, optional email, originating pathname without query strings or fragments, language and submission date. We store no account association, raw IP address or user agent with feedback and send no automatic emails. We review bugs and ideas on the basis of our legitimate interest in improving the service. Feedback is deleted twelve months after submission. Account deletion also removes feedback matching the account email.
• Account data: until you delete the account, or ask us to.
• Sessions: until they expire or you sign out.
• Messages and reviews: for as long as the account exists. A review stays visible after a listing is taken down, under the reviewer’s name.
• Usage events: kept as counts. Deleting an account cuts the link to it and leaves the event behind as an anonymous number, so historical figures do not silently rewrite themselves.
• Photos on a listing: deleted with the listing. Photos uploaded and never attached to a published listing are swept automatically.
• Enquiries sent without an account: twelve months from the last time we were in contact about one, then deleted. Tell us sooner and we delete it sooner.
• Backups: an encrypted copy of the whole database is made every night. Daily copies are kept for seven days and weekly copies for eight weeks, so anything deleted from the site is gone from every backup within eight weeks. A backup is only ever read to restore the site after a failure.

§ 10

What you can ask us to do

The GDPR gives you all of the following, and exercising any of them is free. Write to hello@tallipark.com, from the address on your account where you can, since that is the fastest way for us to be satisfied it is really you.

• Get a copy of the personal data we hold about you and an explanation of what we do with it (Article 15).
• Have anything wrong corrected (Article 16). Your name, email address and language are editable in your account without asking us.
• Have your account and the data attached to it deleted (Article 17). There is a button for it in your account and it takes effect immediately, no request to write and nobody to ask. Your name, address and everything you saved are erased on the spot.
• Have us pause processing while a dispute about accuracy or legitimacy is open (Article 18).
• Receive the data you gave us in a machine-readable file, or have it sent to another service (Article 20).
• Object to anything we do on the basis of legitimate interests (Article 21), including the usage counting described above.
• Withdraw consent at any moment. That stops the processing going forward and does not make what happened before it unlawful.

§ 11

If you think we have got this wrong

Tell us first, at hello@tallipark.com: most of it is fixable the same week. That is not a precondition for anything: you can complain to the Polish supervisory authority whatever we say, and at any point.

Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl

We answer requests and complaints within one month. If a request is genuinely complicated we may take up to two further months, and we will tell you inside the first month if that happens.

§ 12

Cookies, and what is stored on your device

There are no advertising cookies and no tracking cookies on this site. Everything stored on your device is below, and there is nothing else.

• Two session cookies, once you sign in: the session itself, which lasts up to 30 days and renews while you use the site, and a five-minute copy of it that saves looking the session up on every page. Signing in has no effect without them. Both are removed when you sign out.
• A language cookie recording which of the two languages you picked, kept for a year so the site does not keep guessing.
• A cookie recording which language a sign-up with Google or Apple was started on, so the confirmation email comes back in the right one. It is set only for the few minutes that takes, and expires on its own whether or not the sign-up finishes.
• In your browser’s local storage: your light-or-dark preference, which view of the search results you chose, a message you started writing and have not sent, and any unfinished rental agreement. None of it is sent to us, and it stays until you change it or clear your browser’s data.
• In your browser’s session storage: your last search and how far down the results you had scrolled, so that Back returns you to the same place. It disappears when you close the tab.
• A note that you have already given us an email address on a listing, so that we stop asking while you are still browsing. It lasts until you close the browser. Its entire content is the digit 1, it holds no address, no name and no identifier of any kind, and it cannot be used to recognise you anywhere else.

§ 13

Keeping it safe

Passwords are stored as hashes and cannot be recovered by anybody, us included. Traffic to and from the site is encrypted in transit.

An owner’s phone number is deliberately absent from the listing page itself: it is not in the HTML, not in the data the page ships, and not reachable by reading the page. It is served only to a signed-in account, at most twenty times an hour, with every request recorded. That does not make bulk collection impossible; it makes it slow, expensive and attributable, which is the achievable goal.

No system is perfect. If you find a weakness, write to hello@tallipark.com. We will treat it seriously, and credit you if you want to be credited.

§ 14

Age

Talli is not for children. You need to be at least 16 to hold an account and at least 18 to publish a listing, because renting a space out means entering into contracts, which takes full legal capacity.

We do not knowingly collect data from anybody younger. If you believe we have, write to hello@tallipark.com and we will remove it.

§ 15

Changes to this policy

When this document changes, the date at the top changes with it. If a change materially alters what we do with data we already hold, account holders are emailed before it takes effect rather than after.