Privacy Policy

This Privacy Policy explains how personal data is processed when you use the HouseMate website (housemateapp.it) and the HouseMate web app (app.housemateapp.it). HouseMate helps people find compatible housemates: you create a profile, discover other people looking for a shared home, match with them and chat. Room listings are not available yet; this policy will be updated before they are.

1. Controller and contact

The controller of your personal data is [CONTROLLER: full name or company name, address, VAT number if any]. For privacy requests, support, legal notices or safety reports, write to info@housemateapp.it.

No Data Protection Officer has been appointed. If one is appointed, their contact details will be published here.

2. Data we process

• Account: email address, password (stored only in encrypted, hashed form by our authentication provider), user ID and sign-in method. If you sign in with Google, the name, email address and account identifier that Google shares with us.
• Legal records: the versions of the Terms and of this Privacy Policy you accepted and when, and your choice about news and offers by email with the time you last changed it.
• Profile: name, profile photo, gender, date of birth (to confirm you are an adult and to show your age), bio, hometown, work or studies (and university if you are a student), spoken languages, move-in month, length of stay and budget.
• Lifestyle and compatibility answers: daily rhythm, time at home, kitchen use, guests, social style, partners, smoking and substances, cleaning, sharing, noise, pets and interests.
• Search area: a point you choose on the map and a search radius. HouseMate never uses GPS or locates you from your IP address.
• Discovery and matches: the profiles you skip or favourite and your matches.
• Messages and groups: direct and group conversations, messages, participants, read status, chat settings (mute, clear) and group names and images.
• Safety: reports you send (reason, details and the reported conversation) and the people you block.
• Contact form on the website: name, email, company (optional) and message.
• Technical data: IP address, browser and device information, timestamps and error logs, processed by our hosting and database providers to deliver and secure the service.

3. Sensitive information

HouseMate does not ask for special categories of data under the GDPR, such as health, religious beliefs, political opinions or biometric data. Free-text fields, chats, reports and some lifestyle answers may nevertheless reveal personal aspects: please share only what you are comfortable with, and never share other people's personal data without their permission.

4. Purposes and legal bases

• Providing HouseMate (account, profile, discovery, matching, chat, groups, blocking and reporting): performance of the contract you enter into when you sign up (Art. 6(1)(b) GDPR).
• Confirming you are an adult, keeping users safe, handling reports, preventing abuse and fraud, and securing our systems: our legitimate interest in a safe and secure service (Art. 6(1)(f)) and, where applicable, legal obligations (Art. 6(1)(c)).
• Keeping records of your acceptance of the Terms and this policy and of your consents: legal obligations and our legitimate interest in being able to demonstrate them (Art. 6(1)(c) and (f), Art. 7(1)).
• Service emails (email confirmation, password reset, security notices such as a password change): performance of the contract and our legitimate interest in account security.
• News and offers by email: only with your consent (Art. 6(1)(a)), which you can give at sign-up or in Settings and withdraw at any time in Settings, without affecting the lawfulness of earlier sending.
• Answering contact-form messages: steps taken at your request and our legitimate interest in replying (Art. 6(1)(b) and (f)).

Your email address, a password (unless you sign in with Google), your date of birth and the profile information marked as required are needed to use HouseMate: without them we cannot create your account or show your profile to others. Everything else is optional.

5. Matching and ranking

HouseMate suggests and orders profiles automatically, using distance, budget, move-in month, length of stay, lifestyle answers and interests. This only decides the order of suggestions: it has no legal or similarly significant effect on you, and you alone decide whom to skip, favourite, match or message. People you block, and people who block you, are never suggested.

6. What other users can see

Other signed-in users see a reduced version of your profile: name, photo, age (not your date of birth), bio, the compatibility details above and your approximate distance. Your email address, date of birth and the exact point of your search area are never shown. Your matches can message you, and people in a group chat with you see your name and photo.

When you block someone, they can no longer find you, match with you or message you, and any direct chat between you is hidden for both of you. They are not told. Group chats you share are not affected. You can unblock people in Settings.

7. Providers and recipients

We use the following providers, bound by data processing agreements:

• Supabase, Inc. (database, authentication, file storage and real-time messaging). Your data is stored in the European Union (Frankfurt, Germany).
• Netlify, Inc. (hosting of the website and the web app, and the website contact form). It processes IP addresses and request logs.
• Aruba S.p.A. (Italy) (sending service emails and, if you agree, news and offers).
• OpenStreetMap Foundation (United Kingdom), for the map and place search: when you use the map or search for a place, your browser contacts OpenStreetMap's servers, which receive your IP address and the text you search for.
• Google Ireland Limited, only if you choose to sign in with Google: Google handles the sign-in as an independent controller under its own privacy policy.

The app's fonts and other resources are served from our own host. We do not use analytics, advertising or social-media trackers. We may also disclose data to public authorities, advisers or other parties where the law requires it or where it is necessary to establish, exercise or defend legal claims.

8. International transfers

Supabase and Netlify are based in the United States. Where they process personal data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, and on Standard Contractual Clauses approved by the European Commission. The United Kingdom is covered by an adequacy decision of the European Commission.

9. How long we keep data

• Account and profile: as long as your account exists.
• Skipped profiles: 90 days, then deleted automatically.
• Messages: as long as the conversation exists for its participants. If you delete your account, messages you sent may stay visible to the other participants, shown as from a "Deleted user".
• Blocks: until you unblock the person or either account is deleted.
• Reports: as long as needed to handle them and to protect users and our legal position.
• Records of acceptance and consent: for the life of the account and afterwards for as long as needed to demonstrate compliance (statutory limitation periods).
• Contact-form messages: as long as needed to answer and follow up, and no longer than 24 months.
• Technical logs: days to a few weeks, at our providers.

An automatic job runs every day to delete data whose retention period has ended.

10. Account deletion

You can delete your account at any time in Settings. This permanently deletes your account, profile, photos, discovery activity and blocks. Messages may remain visible to other participants and reports may be kept, as described above.

11. Your rights

Under the GDPR you can ask for access to your data, rectification, erasure, restriction, portability and object to processing based on our legitimate interests; you can withdraw consent at any time. You can do much of this directly in the app (edit your profile, change your email choice in Settings, delete your account); for everything else write to info@housemateapp.it. We reply within one month.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of the EU country where you live or work.

12. Security

We apply proportionate technical and organisational measures: encrypted connections, row-level access rules so each user reaches only the data they are entitled to, private file storage, minimised views of other users' profiles, and automatic deletion of expired data. No system is free of risk: please use a strong, unique password and share only what you need to.

13. Minors

HouseMate is for adults only: you must be 18 or older. The app checks your date of birth and does not let you continue if you are under 18. If you believe a minor is using HouseMate, contact us and we will delete the account.

14. Browser storage

The web app keeps you signed in by storing your session in your browser's local storage. This is strictly necessary for the service you request and is removed when you sign out. Neither the website nor the web app uses tracking cookies. See also the Cookie Policy.

15. Changes

When we change this policy we publish the new version here with its date. For material changes we will tell you in the app or by email and, where needed, ask you to accept the new version.