1. Data controller
The data controller is Flatmatch.
2. What we collect
Account and profile data
- Email address, authentication identifiers, sign-in provider (e.g., Google, Apple).
- Display name, age, occupation, short bio.
Photographs
- Profile photos and, for room providers, photos of the place. Photos are stored in a private bucket; access is governed by your privacy settings.
Lifestyle and compatibility information
- Optional lifestyle tags (e.g., sleep schedule, cleanliness, smoking, pets) and interests, used to compute compatibility scores.
Listings
- Listing content you publish: intent (looking / offering), budget, move-in dates, neighborhoods, description, photos.
Private messages
- Content of in-app messages between you and other users, delivery timestamps, and read state.
Location preferences
- Neighborhoods and map center / radius you choose while searching. We do not track your device GPS.
Technical data
- Basic operational logs (IP, user agent, error diagnostics) needed to run and secure the Service.
3. Legal basis and purpose
- Contract (Art. 6(1)(b) GDPR): creating your account, showing listings, delivering messages, running compatibility matching.
- Legitimate interests (Art. 6(1)(f)): preventing abuse, moderation, fraud and scam detection, product analytics in aggregate.
- Consent (Art. 6(1)(a)): optional email notifications, optional lifestyle tags, publishing photos.
- Legal obligation (Art. 6(1)(c)): responding to lawful requests from Portuguese authorities.
4. Retention
- Account and profile data: for the life of your account.
- Listings: until you delete them or your account is closed.
- Messages: retained while both participants have active accounts, then purged within a reasonable period after account deletion.
- Moderation reports and safety records: retained up to up to 12 months after the account is closed for abuse-prevention purposes.
- Operational logs: short rolling window, typically 30–90 days.
5. Service providers (sub-processors)
We rely on trusted providers acting under data processing agreements:
- Cloud hosting and database — Supabase (Lovable Cloud).
- Authentication and OAuth (Google, Apple).
- Transactional email delivery for account and notification emails.
- Map tiles and geocoding for the location picker.
Where a provider processes data outside the EEA, we rely on Standard Contractual Clauses or equivalent safeguards.
6. Your rights
Under GDPR you have the right to:
- access your personal data;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to processing;
- data portability;
- withdraw consent at any time;
- lodge a complaint with the Portuguese Data Protection Authority (CNPD).
7. Account deletion
You can request deletion from your Account settings or by emailing us. On deletion, we remove your profile, listings, and photos; message threads are anonymised or purged on a schedule described in section 4. Some records may be retained where required to prevent abuse or comply with law.
8. Contact for privacy requests
Email: hello@flatmatch.pt