Privacy Policy

Last updated: 28 September 2026

Room8 ("we", "our", or "us") operates the Room8 mobile application (the "App") and the Room8 owner portal at host.room8app.gr (the "Portal"; together, the "Service"). This Privacy Policy explains how we collect, use, share, and protect your personal data, and describes your rights under applicable law, including the General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data We Collect

When you use Room8 we may collect:

• Account information: name, email address, date of birth, and profile photos you upload.
• Profile preferences: lifestyle habits, budget, location preferences, and other details you add to help with roommate matching.
• Facebook Login data: if you sign in with Facebook we receive your public profile (name, email, profile picture) as permitted by Facebook's platform policies.
• Identity verification selfie: a selfie image you submit for identity verification. It is checked for liveness and against your profile photos to confirm they show the same person. We do not estimate your age from it. This image is processed by Google Gemini AI and is not stored after the check completes.
• Location data: approximate location to surface relevant listings, only when you grant permission.
• Usage data: device type, OS version, app interactions, and crash reports collected via Firebase Analytics and Crashlytics.
• Communications: messages you send to other users inside the App.
• Owner portal account: if you sign up on the Portal, the email address and name you sign up with (or your Google account's name, email and profile photo if you sign in with Google), whether you rent out as a private person or a business, and the city or area of your property.
• Listings created on the Portal: photos, description, rent and details. Photo metadata, including any GPS location, is removed on upload, and the property's location is stored only as an approximate area (about 500 m), never your street address.
• Portal activity: your answers to tenants' requests and the messages you send them, the time you last used the Portal (so your listings stay visible while you are active), and short-lived request counters that protect the Portal against abuse.

2. How We Use Your Data

• To create and manage your account.
• To provide AI-powered roommate matching and compatibility scoring.
• To verify your identity and keep the platform safe.
• To send you notifications about matches, messages, and platform updates.
• To improve the App through aggregated analytics.
• To comply with legal obligations.
• To email Portal users about their account and listings: email verification, the outcome of our review of a new owner's first listing, new requests from tenants, and new messages (at most one email per conversation every 30 minutes). To stop request and message emails, contact us.
• To review a new owner's first Portal listing before it is shown to tenants.

3. Legal Basis for Processing (GDPR)

• Contract: processing necessary to provide the services you requested, including account and listing emails on the Portal.
• Legitimate interests: fraud prevention, security (including reviewing new listings and limiting abuse on the Portal), and improving our service.
• Consent: location access, marketing emails, and optional features — you can withdraw consent at any time.
• Legal obligation: where required by law.

4. Data Sharing

We do not sell your personal data. We share data only with:

• Google / Firebase: cloud infrastructure, authentication, storage, and analytics (EU/EEA Standard Contractual Clauses apply).
• Google Gemini AI: selfie images processed for identity verification only; data is not retained by Google for training under our enterprise agreement.
• Meta (Facebook): when you use Facebook Login, subject to Meta's own privacy policy.
• Resend: email delivery for Portal emails (EU region) — your email address and the content of the email.
• Google Places: the text you type when searching for your area on the Portal, to suggest places; we store only the approximate area you pick.
• Other users: your public profile information is visible to other Room8 users for matching purposes.
• Law enforcement: where required by a valid legal request.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. You may request deletion at any time (see Section 7). Verification selfies are deleted immediately after processing. Aggregated, anonymised analytics data may be retained indefinitely.

On the Portal, abuse counters and email-throttling records are deleted automatically within 2–7 days. The Portal uses no analytics or advertising cookies; it keeps only your language choice and your sign-in session in your browser, which are strictly necessary for it to work.

6. International Transfers

Your data may be processed in countries outside your own. Where this involves transfers from the EEA/UK, we ensure adequate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

7. Your Rights

Under GDPR (and equivalent laws) you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at room8.contactteam@gmail.com or visit our data deletion page.

8. Security

We use industry-standard measures including TLS encryption in transit, Firebase Security Rules, and limited access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children

Room8 is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via in-app notice or email. The "Last updated" date at the top indicates the most recent revision.