1. Data controller
The data controller is FlatMatch.
Full operator identification will be published here. Until then, contact us at hello@flatmatch.pt.
2. What we collect
Account and profile data
- Email address, authentication identifiers, sign-in provider (e.g., Google, Apple).
- Display name, age, occupation, short bio.
- An optional gender value (Man, Woman, or Non-binary). Providing it is not required, and it is used so members can filter flatmate search results themselves.
Photographs
- Profile photos and, for room providers, photos of the place. Profile and listing photos are stored privately and are only made available to signed-in FlatMatch members through controlled, temporary access URLs. Signed-out visitors see a placeholder instead of a photo.
Lifestyle and compatibility information
- Optional lifestyle tags (e.g., sleep schedule, cleanliness, smoking, pets) and interests, used to compute compatibility scores.
Listings
- Listing content you publish: intent (looking / offering), budget, move-in dates, neighborhoods, description, photos.
Visible to anyone, including signed-out visitors: on public profiles your display name, age, bio, occupation, preferred neighbourhoods, lifestyle and interest tags, intention, budget range and gender (if you chose one); on listings the name, age, price or budget, neighbourhood, move-in date, description, tags, flatmate age range, team preferences and gender (if set). Real profile and listing photos are never shown to signed-out visitors, who see a placeholder instead. Your email address is never shown publicly.
Private messages
- Content of in-app messages between you and other users, delivery timestamps, and read state.
Location preferences
- Neighborhoods and map center / radius you choose while searching. We do not track your device GPS.
Technical data
- Basic operational logs (IP, user agent, error diagnostics) needed to run and secure the Service.
3. Legal basis and purpose
- Contract (Art. 6(1)(b) GDPR): creating your account, showing listings, delivering messages, running compatibility matching.
- Legitimate interests (Art. 6(1)(f)): preventing abuse, moderation, fraud and scam detection, and keeping the Service secure.
- Consent (Art. 6(1)(a)): optional email notifications, optional lifestyle tags, publishing photos.
- Legal obligation (Art. 6(1)(c)): responding to lawful requests from Portuguese authorities.
4. Retention
- Account and profile data: for the life of your account.
- Listings: until you delete them or your account is closed.
- Messages and conversations: kept while both participants have active accounts. When either participant deletes their account, the whole conversation, including the other person's copy, is deleted immediately.
- Moderation reports and safety records: retained up to up to 12 months after the account is closed for abuse-prevention purposes.
- Operational logs: short rolling window, typically 30–90 days.
5. Service providers (sub-processors)
We rely on trusted providers acting under data processing agreements:
- Cloud hosting and database — Supabase (Lovable Cloud).
- Authentication and OAuth (Google, Apple).
- Transactional email delivery for account and notification emails.
- Map tiles and geocoding for the location picker.
Where a provider processes data outside the EEA, we rely on Standard Contractual Clauses or equivalent safeguards.
6. Your rights
Under GDPR you have the right to:
- access your personal data;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to processing;
- data portability;
- withdraw consent at any time;
- lodge a complaint with the Portuguese Data Protection Authority (CNPD).
7. Account deletion
You can request deletion from your Account settings or by emailing us. On deletion, we remove your profile, listings, and photos; your conversations and messages are deleted for both participants. Some records may be retained where required to prevent abuse or comply with law.
8. Contact for privacy requests
Email: hello@flatmatch.pt