What Hausi collects about you, why, who sees it, how long we keep it — and how you stay in control of it.
The hausi.mn marketplace ("Hausi", "we") is owned and operated by [Company name] LLC (registry [Регистрийн дугаар / Registry no.], [Address], Ulaanbaatar, Mongolia), registered under the laws of Mongolia. For the purposes of the Law on Personal Data Protection we are the party responsible for collecting, processing and using your personal data.
This policy is prepared in accordance with the Law on Personal Data Protection, the Law on Consumer Protection and other applicable Mongolian legislation.
All requests and complaints about personal data go to privacy@hausi.mn.
| Category | Examples | Source |
|---|---|---|
| Account | Phone number, name, email, password hash, language | You |
| Verification | DAN subject identifier and name; ID-card images for manual checks; agency licence details | You, the DAN system |
| Listings | Address, unit number, location, photos, price, description, contact settings | You |
| Messages | Inquiries, messages, attached images, phone-reveal log | You and the other party |
| Financing | Loan amount, down payment, term, monthly income, employment type | You |
| Payments | Orders, amounts, payment status, VAT receipts (e-barimt). We never see card details. | You, the payment provider |
| Communities | Residency verification, posts, poll answers | You |
| Usage | Saved listings and searches, viewing history (can be switched off) | Your activity |
| Technical | IP address, device and browser type, cookies, error logs | Your device |
GPS coordinates and other EXIF metadata are stripped from every photo you upload before it is shown to anyone.
If you enter someone else’s personal data (a co-owner or a tenant, for example) you must have their permission first.
We process your data for these purposes, on these grounds:
Our AI assistant (search, listing descriptions, fraud signals) works on text that has personal data scrubbed out, and runs on Hausi’s own servers in Mongolia. AI never makes a decision with legal effect on you by itself — a person decides every listing rejection and every account ban.
You can withdraw consent at any time under Account → Notifications and Account → Privacy. Withdrawing does not affect processing that already took place.
A published listing’s title, description, price, photos, district/khoroo and approximate location are visible to everyone. If you chose an approximate location, the map pin is coarsened on our servers before it is sent. Unit numbers are never shown publicly.
A private lister’s phone number is never printed on the page. If you turn on click-to-reveal, signed-in users can reveal it; each reveal is logged (who and when) and one user can reveal at most 10 numbers a day.
Messages are private correspondence between the two parties. Hausi staff read a message only when it has been reported or automatically flagged, for moderation, and every such access is logged.
You can hide your profile page under Account → Privacy.
Our databases, photos, files and AI processing are hosted on servers in Mongolia.
Data can leave Mongolia in these cases:
Whenever data crosses the border we meet the requirements of the Law on Personal Data Protection and keep what is sent to the minimum.
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account |
| Phone-reveal log | 12 months |
| One-time codes and step-up checks | 30 days after they expire |
| ID-card images | Marked for deletion when the check ends or the account is deleted, erased for good within 30 days |
| Payment records and receipts | As long as accounting and tax law require; payment-provider callbacks 13 months |
| Messages | Kept, as they are also the other person’s correspondence; your name becomes “Deleted user” |
| Fraud evidence | Until the case is closed or the legal hold ends |
When you delete your account we immediately erase your name, phone, email, photo, DAN identifier, sign-in credentials, saved searches and favourites, and archive your listings. The non-identifying skeleton of a listing may remain for statistics and audit.
Under the Law on Personal Data Protection you have the right to:
Send anything you cannot do from settings to privacy@hausi.mn. We will confirm it is you and respond within 30 days.
We may hold back from deleting data the law requires us to keep (payment receipts, accounting records) or data tied to an open fraud case until that duty ends, and we will tell you why.
All connections are encrypted with HTTPS. Passwords are stored only as hashes. ID-card images and message attachments sit in private storage and are shown only through short-lived signed links.
Staff access data only as their job requires, behind two-factor authentication, and every access to personal data is written to an audit log.
If a personal-data breach occurs we notify the competent authority and the affected users within the time the law sets, and act to contain the harm.
We do not knowingly collect data from anyone under 18. If we learn a child has registered we delete the account; parents and guardians can tell us.
We may update this policy. For significant changes — such as what we collect or who receives it — we notify you by email and in the app 14 days before they take effect. Where processing relies on consent, we ask for it again under the new version.
This policy is published in Mongolian and English; if the two differ, the Mongolian text prevails.