Privacy policy

Last updated: 2026-10-25. This policy explains how Nixelion Ltd (“WeGet”, “we”) handles personal data on https://weget.online and in the leads we deliver. We are a company registered in Malta, so the EU General Data Protection Regulation (GDPR) applies to everything we do, wherever you live.

Who is responsible

The controller is Nixelion Ltd, Triq Sir Joseph Carbone 16, STJ 1323 Saint Julian's, Malta, Commercial register no. pending registration. For anything in this policy, write to contact@weget.online. We answer within one month.

If your property appears in a permit record

What we hold: the property address, ZIP code, area and map position; the permit number, type, issue date, work description and reported project value; and the business name, license number and business phone of the contractor named on the permit. We do not collect the names, phone numbers or email addresses of property owners. If a city publishes them, we discard them before anything is stored, so we do not know who owns or lives at an address.
Where it comes from: building-permit records that city governments publish as open data. The sources are listed on our data sources page.
Why we use it: to tell local businesses about new building projects so they can offer related services by mail, in person where that is allowed, or through the contractor.
Legal basis: our and our customers' legitimate interests in this kind of marketing (Article 6(1)(f) GDPR). We have weighed these against the interests of property owners and limited what we collect, how long we keep it and who receives it. You can ask us for a summary of that assessment.
Who receives it: businesses that subscribe to WeGet or buy a lead pack, most of them in the United States. They agree to use leads only for lawful marketing, not to resell them and to delete an address when it is removed. Our public pages show only statistics and examples with the house number hidden.
How long: a lead is deleted 90 days after the permit was issued.
Your right to object: you can have your address removed at any time, without giving a reason, on the remove my property page. We delete it immediately, never collect it again, and email everyone who already received it to delete it and not to contact you again. We keep the address itself on a blocklist so that it stays removed.

If you are a contractor named on a permit

What we hold: the business name, license number and business phone that the city publishes with each permit, and from those the number, dates, areas and reported values of your permitted jobs.
Why: to tell local businesses who is building, and to show people who want to hire a contractor which companies did the kind of work they need (our contractor lists). Most contractors are companies; where you trade under your own name this is personal data, and we rely on legitimate interests (Article 6(1)(f)).
Who receives it: subscribers, and buyers of a contractor list for your city and type of work. Our public pages show only the names of the most active companies and their number of jobs.
Your right to object: use the remove my company page (we verify the request by calling the business phone on your permits, so nobody can remove a competitor), or write to contact@weget.online. We then leave you out of all future lists and statistics, remove you from lists already delivered that are kept in customers' accounts, and take down any listing of your company.
If you add your company yourself: we show the details and prices you give, to the public and to list buyers, for the period you paid for (contract, Article 6(1)(b)), and delete them 12 months after the listing ends.

If your business appears in a license record

New business licenses and restaurant inspections that cities publish as open data name the business and its address. We hold the business name, address, license type and date, and treat them like permit records above: the same purpose, legal basis, recipients, retention and right to object (use the remove page or write to us).

If you get email from a business that uses WeGet

Who is responsible: the business that sent the email (its name and address are in every email). It is the controller; we process your data on its behalf as its email provider.
What we hold for it: your email address and what you gave the business (such as your first name and birthday), how and when you agreed (time, form or import, IP address), and whether emails were delivered, opened or clicked, bounced or reported as spam.
Unsubscribing: one click on the link in any email. It applies to that business at once. If you report an email as spam, that business can't email you again through us. If an address bounces permanently, no business can email it through us.
Abuse: got email you never asked for? Use “Report abuse” in the email, or write to contact@weget.online. We act on every report.

If you use Connections

Your business profile (what you choose to show), your quote requests and the messages you exchange are stored to run the directory and the conversations (contract, Article 6(1)(b)); messages are encrypted at rest. We never show your email address to the other business. Abuse reports are kept with a keyed hash of the reporter to count one report per person (legitimate interest, Article 6(1)(f)). Requests, messages and reports are deleted 12 months after the conversation ends.

If you use our website or are a customer

Your account: email address, lead settings, the profile fields you fill in and the statuses you give to leads. We need these to provide the service (performance of a contract, Article 6(1)(b)). Kept while you are a customer and up to 12 months after your last subscription or lead pack ended or your last contractor list was bought.
Payments: handled by Stripe. We never see full card numbers; we receive your email address, your subscription status and a customer number. Invoices and payment records are kept as long as tax and accounting law requires (Article 6(1)(c)).
Emails about the service: the daily digest, login links and billing notices are part of the service. You can turn the digest off in one click.
Free sample: the email address, city and trade you enter, to send what you asked for (Article 6(1)(b)). We send tips and offers only if you ticked the box (consent, Article 6(1)(a)); you can withdraw it at any time. Deleted after 12 months.
Contact form: your name, email address, company and message, to answer you (legitimate interest, Article 6(1)(f)). Deleted after 12 months.
Security: a keyed, daily-rotating hash of your IP address for rate limiting, kept for at most 48 hours, and server logs that record the page requested with a shortened IP address (a failed request can be logged with the full address; these error logs are deleted after 14 days). We need these to keep the service secure (Article 6(1)(f)).

You are not required to give us any data, but without an email address we cannot provide an account or a sample. We make no automated decisions that have a legal or similarly significant effect on anyone.

Cookies

We use only necessary cookies: a session cookie when you are logged in, a security cookie that protects forms, and a cookie that remembers for 12 months that you accepted our terms, this policy and these cookies. Leads are shown only after you accept; subscribers' acceptance is also saved with their account, with the date. No analytics cookies and no advertising cookies. You can change or withdraw your choice at any time under Cookies and consent.

Who we share it with

Service providers that process data on our instructions: our hosting provider (servers in Germany), Amazon Web Services (Amazon SES, which sends Marketing email, in the United States), Google Cloud Firestore (database that stores the permit records, in a data centre region in the EU), Stripe (payments), our email delivery provider, and an AI provider that classifies permit descriptions (permit text only, never customer data). The map in the customer dashboard loads its tiles from the map provider named on the map, which sees the IP address of the browser. Leads go to subscribers and lead pack buyers as described above. We do not sell the personal data of customers or visitors.

Transfers outside the EU

Some of these providers are in the United States, and so are most customers. For those transfers we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, which are part of our contracts with providers and of our terms with customers. You can ask us for a copy.

Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict its use, or to hand it over in a portable format; you can object to any use that we base on legitimate interests, and withdraw a consent at any time. Write to contact@weget.online; property owners can simply remove their address. Because we hold permit records by address and not by name, we may ask for the address to find them. You also have the right to complain to a data protection authority, in particular the one in your country or ours: Information and Data Protection Commissioner (IDPC), https://idpc.org.mt.

Residents of the United States

Building-permit records are information that governments make publicly available, which US state privacy laws generally do not treat as personal information. You can still remove your address as described above, and we act on every request. Leads are never to be used for decisions about credit, insurance, employment or housing.

Changes and contact

We will post changes here and tell customers by email when they are significant. Nixelion Ltd, Triq Sir Joseph Carbone 16, STJ 1323 Saint Julian's, Malta · contact@weget.online