Privacy Policy

• Name, email address, and phone number
• Profile photos and personal descriptions
• University or workplace information
• Age, gender, and location preferences
• Payment information (processed securely by Stripe)
• Identity verification data, if you choose to verify your identity: the document you upload is held in private storage and reviewed by our team. Text read from it automatically is shown to the reviewer as an aid and is never used to decide. Where the check runs through OpsisID, we send OpsisID your account reference, the first and last name on your profile, your confirmed email address and, for a property you list, its address, so it can confirm them. We receive back your verification level (contact, name or ID verified), which kind of source confirmed your name, whether you are an adult, until when the level counts, whether a property address was confirmed, and whether the same email, bank account, ID or name and birth date was already verified for another MyRoomie account (used to stop banned accounts returning). We do not receive your ID images, selfie, bills, bank details or document numbers. When you delete your account we tell OpsisID, which then deletes your evidence.

• Housing preferences and compatibility quiz responses
• Search history and listing interactions
• Communication patterns and messaging data
• MBTI personality assessment results

• IP address, browser type, and device information
• Usage analytics and platform interaction data
• Cookies and similar tracking technologies
• Location data (with your permission)

• Creating and maintaining your user profile
• Matching you with compatible flatmates and accommodations
• Facilitating communication between users
• Processing payments and managing subscriptions
• Providing customer support and platform assistance

• Analyzing usage patterns to improve our services
• Developing new features and compatibility algorithms
• Conducting research to enhance user experience
• Ensuring platform security and preventing fraud

We process your data based on:

• Consent: When you explicitly agree to data processing
• Contract: To provide our services as agreed
• Legitimate Interest: For platform improvement and security
• Legal Obligation: To comply with applicable laws

Your profile information, preferences, and photos are visible to other users for matching purposes. You control what information to include in your profile.

• Stripe for payment processing
• Clerk for account sign-in and authentication
• CapyDB for database hosting in the EU (Helsinki, Finland)
• Cloudflare R2 for photo and file storage
• Supabase for real-time message delivery
• Vercel AI Gateway and the AI model providers it routes to (OpenAI, Google, Anthropic, DeepSeek) for the Rumi assistant, translating listings and profiles, safety screening of listings, profiles, reviews and photos, search, explaining matches, sorting support requests, reading receipts and maintenance reports you submit, and filling in forms from your own descriptions. Private messages are sent to AI providers only in the two cases described under "Private messages and AI" below.
• OpsisID (operated by Entro314 Labs, Athens) for identity verification. OpsisID processes your national eID, identity document and selfie, or the bill, lease, bank account or gov.gr declaration you choose to show, and keeps that evidence under its own retention rules; MyRoomie receives only the result described above.
• Email service providers for communications
• Analytics services for platform improvement

Translating messages. When you tap "See translation" on a message you received, or if you turned on automatic translation in your account settings, the text of that message is sent to an AI model to be translated into your language. Only the person a message was sent to can have it translated. We send the message text only, not who wrote it or who received it.

Checking first-contact messages for scams. When someone sends you a message request - the first message from a member you have no conversation with yet - its text is checked once by an AI model for signs of fraud, spam, sexual solicitation, harassment or hate. Messages in a conversation you have accepted are never checked. Sharing a phone number, email address or messaging handle is not treated as a problem. The check never blocks or delays a message; if it finds something, it files a report that a member of our team reviews before any action is taken.

Both run through the Vercel AI Gateway, restricted to model providers with a zero-data-retention agreement: the provider processes the text to produce the result and does not store it or use it to train models. We store a translation so it does not have to be made twice, and delete it when the message is edited or deleted. For a flagged message request we keep the short passages the check quoted and a one-line reason so a moderator can review the report; they do not see the rest of your conversation. For message requests that are not flagged we keep no text.

We may disclose information when required by law, court order, or to protect user safety and prevent fraud.

• Sell your personal data to third parties
• Share your information without legal basis
• Use your data for unauthorized marketing

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Revoke consent for data processing

File and track a data subject request (access, rectification, erasure, portability, restriction, objection or consent withdrawal) directly from your account. We respond within 30 days as required by GDPR. You can also email us at privacy@myroomieapp.com.

• Encryption of data in transit and at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Secure hosting with industry-standard protections

• Profile data: Retained while your account is active
• Communication data: Retained for 2 years for safety purposes
• Payment data: Retained as required by financial regulations
• Search history: Linked to your account for 30 days, then anonymized, and deleted after 180 days
• Analytics data: Anonymized and retained for platform improvement

You can request data deletion at any time, subject to legal retention requirements.

• Email: privacy@myroomieapp.com
• Data Protection Officer: privacy@myroomieapp.com
• Address: MYROOMIE GR Ι.Κ.Ε., Ploutarchou 58, Agios Dimitrios 17342, Greece (VAT EL802069467, ΓΕΜΗ TY169324101000)

If you have concerns about our data processing that we cannot resolve, you have the right to lodge a complaint with your local data protection authority.