Privacy Policy

flatsforfriendz (hereinafter ‘we’, ‘us’ or ‘our’) attaches great importance to the protection of your personal data. This privacy policy informs you about how we collect, process and use your data when you use our platform. This privacy policy applies exclusively to the offers of flatsforfriendz such as the website, webapp and app as well as the Instagram page and not to linked other providers. Please check the data protection information of the sites you visit when you leave our platform.

1. Person responsible

The operator of the flatsforfriendz platform is responsible for the processing of your personal data.

For Friendz GmbH

Rosenthaler Straße 36 c/o Assetbird 10178 Berlin, Deutschland

2. Collection and storage of personal data

flatsforfriendz offers a digital, network-based platform on which living space and rooms in shared flats are advertised. Users can post their own adverts for flats and shared rooms and view adverts from other users. The user uploads pictures to create a profile and an adverts. The platform enables direct contact between those offering and those looking for accommodation. The following data is collected and stored during use:

Data that is automatically collected: e.g. IP address, browser type, operating system, browsing activity, ads clicked, search behaviour (e.g. via search filters), date and time of use, access status, amount of data transferred, and name of the requested file, device information: operating system, device model, unique device identifiers (e.g. UUID). When using premium features, we also process pseudonymized data such as subscription status, product ID, internal user ID, and timestamp in order to enable and manage the booked features.
Data that you provide to us directly: e.g. when registering a user account or uploading an advert: Name, email address, telephone number, address, location, social media accounts, payment information, search preferences, uploaded media. All data fields marked as mandatory are required for the fulfilment of the contract. Failure to provide this data means that the contractual service cannot be performed. The provision of further data is voluntary.
Data you may provide to us: e.g. you can allow flatsforfriendz to access your address book to identify which users you have mutual contacts with or to suggest possible Friendz. Phone numbers are processed exclusively in encrypted form. For voluntary data, you can withdraw your consent at any time in your settings. After withdrawal, no new contact data will be processed, and previously encrypted contact data will be deleted within a reasonable period. Please note that we may still provide you with Friendz suggestions even if you do not share your address book, based on contact data we receive from other users who use our app.
Data in connection with the use of our services: e.g. login data, statistics on page views, error logs and crash reports.

3. Purposes of data processing

We process your personal data for the following purposes:

Provision of our services: We use your data to provide and improve the functionalities of the platform, including ensuring a smooth connection setup and comfortable and safe use of our platform. This also includes the management of premium features activated via in-app purchases.
Marketing and advertising: With your consent, we use your data for personalised advertising measures, e.g. via search engines and social media.
Analysis and improvement: We use cookies and analyse usage data to improve our platform, including tailoring our offers to your individual search preferences. This also includes anonymous analysis of the use of premium features in order to optimize our offering.
Fulfilment of legal obligations: We process your data to fulfil legal requirements, e.g. in the context of tax or retention obligations.

4. Legal bases of data processing

We process your personal data on the basis of the following legal bases of the General Data Protection Regulation (GDPR)

Consent (Art. 6 para. 1 lit. a GDPR)
Contract fulfilment (Art. 6 para. 1 lit. b GDPR).
Fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR).
Legitimate interest (Art. 6 para. 1 lit. f GDPR).

5. Transfer of data to third parties

Your personal data will only be transferred to third parties if this is necessary for the fulfilment of the contract, if we have a legitimate interest in doing so or if you have given your consent. The following categories of recipients may receive your data:

Service providers bound by instructions: These include IT service providers, hosting providers, social media platforms, platform providers, subscription provider and analysis and marketing services. These work strictly in accordance with our instructions, are contractually obliged to comply with data protection regulations and may only use your data for the contractually agreed purposes.
Public authorities: We pass on personal data to authorities (e.g. police, public prosecutor's office) if we are legally obliged to do so or in cases permitted under data protection law. This is done to combat abuse, prosecute criminal offences and enforce claims, unless your rights take precedence.
International data transfer: If personal data is transferred to countries outside the EU or the EEA, we ensure that this is done in compliance with the applicable data protection regulations (e.g. by concluding EU standard contractual clauses).

The legal basis for this results from Art. 6 para. 1 lit. b, c and f GDPR.

6. Integration of social media plugins and other service providers

Our platform uses social media plugins and other service providers to improve functionality and user-friendliness. You can recognise these by the corresponding logos of the platforms. When you access a page that contains such a plugin, a direct connection is established between your browser and the provider's server. This provides the provider with the information that you have visited our site with your IP address. If you are logged into your account with one of these services, the providers can assign your visit to our platform to your user account. This includes:

Amazon Web Services (AWS): We use Amazon Web Services, Inc (AWS), 410 Terry Avenue North, Seattle, WA 98109, USA, as a hosting provider to store the data of our platform on servers in the EU and in third countries, such as the USA. The transfer takes place on the basis of data protection requirements, which are secured by EU standard contractual clauses. Further information can be found in the Privacy Policy of AWS.
Apple: When booking premium functions via Apple, billing takes place directly via Apple. These providers receive data about the purchase, including device data, user ID and purchase history. When you make in-app purchases, you consent to us sharing information about your use and access of purchased content with Apple, solely for the purpose of processing potential refund requests. This may include technical and usage data necessary for Apple to assess whether a refund is justified (e.g. whether the purchased content was accessed or used). This data sharing is performed in compliance with Apple’s policies and only to the extent necessary to support your refund inquiry. Data processing is subject to Apples Privacy Policy.
Clerk: We use Clerk.dev, Inc., 2261 Market Street, STE 10607, San Francisco, CA 94114 USA, to enable secure user logins, authentication and management. For more information, see the Clerk Privacy Policy.
Customer.io: We use the services of Customer.io, provided by Peaberry Software Inc, 9450 SW Gemini Dr, Suite 43920, Beaverton, Oregon 97008-7105, USA, to send notifications such as e-mails or push messages. Further information can be found in the privacy policy of Customer.io.
GitHub: We use GitHub, Inc, 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA for the management and versioning of our source code. Further information can be found in the Privacy Policy of GitHub.
Google services: We use various services from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, including Google Maps, Google Places API, Google Tag Manager and Google Analytics. These services support us in the integration of maps, the analysis of user behaviour and the management of tags on our website. In addition, our Android app uses Google Play Store services and, where applicable, Google Play Services to provide technical functionalities such as login, location features or app performance analysis. Where Google processes personal data in this context, such processing is governed by Google’s privacy policy. When booking premium functions via Android, billing takes place directly via Google. They receive data about the purchase, including device data, user ID and purchase history. Data processing is subject to Google's privacy policy. We also embed videos from the YouTube platform, which is operated by Google, on our landing page. We use YouTube's privacy-friendly mode for embedding videos, which restricts data collection by YouTube until you play the video. However, as soon as you interact with the video (e.g. press ‘Play’), YouTube may set cookies or use similar tracking technologies. If you are logged into your Google account at the same time, this information can be linked to your profile. The videos will only be integrated with your prior consent, which you can give via our cookie banner. Further information can be found in Google Privacy Policy.
PostHog: We use PostHog Inc, 2261 Market Street #4008, San Francisco, CA 94114, USA, to analyse user behaviour. On our website we use PostHog only with your consent (the "Statistics" category in the cookie banner); until then PostHog is neither loaded nor contacted. After you consent, PostHog records the pages you view (including the page you came from), selected actions (e.g. submitting a form, without what you entered) and errors on the page, together with details of your browser, operating system, device and language, and receives your IP address in the process. For this, PostHog stores a random identifier in a cookie and in your browser's local storage. Only if you also allow the "Behaviour analysis" category (it requires "Statistics") do we additionally use PostHog for session recordings ("session replay") and heatmaps: PostHog then records your clicks, mouse movements and scrolling as well as the page content displayed, and presents them as a replay of your session and as a heatmap. What you enter into forms is not recorded. The data is stored in the EU (Frankfurt); as PostHog is a US company, the safeguards described in section 5 apply to any access from the USA. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you can withdraw it at any time with effect for the future via "Cookie settings" in the footer. Further information can be found in the Privacy Policy of PostHog.
Prelude: We use services from Prelude, provided by Ding SAS, 82 rue Dutot, 75015, Paris, France, to enable user login and verification. Further information can be found in Prelude's privacy policy.
RevenueCat, Inc: We use RevenueCat, Inc, 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, to manage and analyse in-app subscriptions. RevenueCat processes pseudonymised data such as your internal user ID, the purchased product and technical metadata (e.g. time of purchase). Data processing is carried out on behalf of and under conclusion of EU standard contractual clauses. Further information can be found in RevenueCat's privacy policy.
Sentry: We use Functional Software, Inc (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, to monitor bugs and performance issues on our platform. On our website, your browser sends an error report to Sentry only when an error occurs on a page, and sends nothing otherwise. The report contains the error message, the page you were on, details about your browser, operating system, device, language and time zone, and the last actions before the error (such as pages visited and clicks). Our servers also report errors and technical performance data about requests (such as the page requested and the browser identifier) to Sentry. We do not include your IP address or cookies in any of these reports; for technical reasons Sentry sees the IP address when your browser transmits a report. No cookies are set and no data is stored in your browser. The reports are stored in the EU data region of Sentry (Germany); as Sentry is a US company, the safeguards described in section 5 apply to any access from the USA. The legal basis is our legitimate interest in a stable and secure website and in fixing errors (Art. 6 para. 1 lit. f GDPR), so it does not depend on your choice in the cookie banner. You can object to this processing under Art. 21 GDPR (see section 10). Further information can be found in the Sentry Privacy Policy.
Social media plugins: We incorporate plugins from social networks such as Instagram and Facebook. These functions are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland. If you are logged into your Instagram or Facebook account, you can link the content of our pages to your profile by clicking on the corresponding buttons. Instagram and Facebook can then assign the visit to our pages to your user account. Further information can be found in the Meta privacy policy.
Stripe: We use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irland, as our payment processor for subscriptions. When you purchase a subscription, the following data is shared with Stripe: email address, name, IP address, and payment method details. We do not store your full credit card number. Further information is available in Stripe's privacy policy.
TalkJS (chat provider): For the chat function on our platform, we use TalkJS B.V., (Klets B.V.) Bogert 1, 5612 LX Eindhoven, Netherlands. Further information can be found in the Privacy Policy of TalkJS.
Vercel: Vercel Inc., Avenue Huart Hamoir 71, 1030 Brussels, Belgium, provides hosting and development services to ensure the performance and security of our platform. For more information, please refer to the Vercel Privacy Policy.

We have concluded contracts with all service providers to ensure that your data is processed in accordance with the strict requirements of the GDPR.

7. Use of cookies and app-specific tracking technologies

We use cookies and app-specific tracking technologies on our platform to improve the user experience and to enable certain functions. There are the following types of cookies:

Essential cookies: These cookies are necessary for the operation of the website and cannot be deactivated.
Statistical cookies: These cookies collect pseudonymised data to analyse the use of our website (Google Analytics, PostHog).
Behaviour analysis: These technologies record how you use our website (PostHog) so that we can make it easier to use.
Marketing cookies: These cookies are used to show you personalised advertising.

If you play a YouTube video on our website, cookies may be set by YouTube that collect personal data. These cookies are subject to Google's privacy policy. You can prevent the storage of cookies in your browser settings or manage your consent via our cookie banner.

Regardless of your choice in the cookie banner, we record errors on our website with Sentry. No cookies are set and no data is stored in your browser; see section 6 for details.

In our app, we use similar technologies such as app analytics and tracking services to analyze and improve the use of our app.

8. Duration of data storage

We only store your personal data for as long as is necessary to fulfil the purposes stated in this privacy policy. As soon as the purpose no longer applies or a statutory retention obligation expires, the data is routinely deleted or anonymised, unless it is still required to fulfil the contract or to comply with legal obligations. Payment data processed via Stripe is retained by Stripe in accordance with applicable statutory retention requirements. In Germany, tax-relevant data is subject to a statutory retention period of 10 years. flatsforfriendz itself does not store full payment data.

If you revoke your consent to the storage of personal data or ask us to delete your account, we will delete your data immediately, unless there are legal obligations to retain it. Your account will remain active until you expressly request us to delete it.

9. Data security

We use appropriate technical and organisational security measures to protect your data from loss, misuse, unauthorised access, alteration or destruction. These measures include Encryption technologies (e.g. SSL encryption), firewalls and access controls to ensure that only authorised personnel have access to your data.

10. Rights of the data subjects

As a data subject, you have the right at any time to obtain from us

in accordance with Art. 15 GDPR, to request information about your personal data processed by us,
in accordance with Art. 16 GDPR, to demand the immediate rectification of inaccurate or completion of your personal data stored by us
to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR
to demand the restriction of the processing of your personal data in accordance with Art. 18 GDPR
in accordance with Art. 20 GDPR, to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller
in accordance with Art. 21 GDPR, to object to the processing of your personal data if this is based on legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR,
to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

To exercise these rights, please contact help@forfriendz.com.

11. Changes to the provisions

We reserve the right to amend this privacy policy as necessary to reflect changes in legislation or business practice or to cover new features on our platform. We recommend that you check this statement regularly to keep yourself informed of any changes.

Changes will take effect when they are published on our platform. If material changes are made, we will notify you by placing a prominent notice on our platform or by sending you a notification directly.

12. Contact for questions about data protection

If you have any questions about the collection, processing or use of your personal data or would like to exercise your rights under the GDPR (e.g. information, correction, deletion), you can contact us at any time at: help@forfriendz.com.

flatsforfriendz attaches great importance to security and data protection. We are always available to deal with your data protection concerns quickly and transparently.

Last updated: August 07, 2025