Privacy Policy

This privacy policy explains how personal data is processed when using Flat-Radar.com (flat-radar.com). Data controller:

Flat-Radar.com, Andrii Tvardovskyi / Андрій Твардовський, Knesebeckstraße 62–63, 10719 Berlin, Deutschland. Email: info@flat-radar.com.

1. Purposes and Legal Bases

• Account and authentication (registration, email verification, login, password recovery) — Art. 6(1)(b) GDPR (contract or pre-contractual steps) and (f) (security of access).
• Companies (landlords) and team (company, member roles, invitations) — Art. 6(1)(b)/(f) GDPR.
• Apartment listings and media (listings, photos in private storage, publication charged against company credit) — Art. 6(1)(b)/(f) GDPR.
• Company legal notice (Impressum) and further notes — A company’s Impressum and further notes are published on all of its listings and are visible without login. Their purpose is identifying the provider and providing the publication service requested. The basis is Art. 6(1)(b) GDPR where the data subject is a contracting party, or Art. 6(1)(f) for necessary representative and contact-person data, subject to their rights; the platform’s own statutory duties rely on Art. 6(1)(c). Login and private notification email addresses are not automatically copied into the Impressum. Data that authors include in public text may be read and copied by others.
• Applications (applicant details; recipients are authorised members of the listing’s company) — Art. 6(1)(b) GDPR. The notice in the application form relates to transparent information about this processing, not marketing.
• Viewing appointments — To arrange housing viewings, we process the linked application, participants, meeting location and time, status, notes and schedule changes. Access is available to the applicant and authorised members of the relevant company within their permissions. System emails about invitations, responses, rescheduling or cancellation are sent via the transactional email provider named in section 2. For reliable sending we store the recipient address, notification content, attempts and technical status. Legal bases: Art. 6(1)(b) GDPR for the requested service and (f) for reliability and security; these are not marketing messages. Acceptance by the email provider does not guarantee inbox delivery.
• Housing requests («Шукаю житло») — city and description plus optional criteria (household, rooms, district/street/radius as preference, payment) and first name for the public board. Contact details (verified account email, optional phone) remain hidden until a logged-in user with a confirmed email explicitly retrieves them. Without publication by the authorising person the request stays private (author + platform admin). No company-level access. Legal basis: Art. 6(1)(b)/(f) GDPR.
• Favourites and personal viewing history — stored server-side with user_id for logged-in users (personal data; not anonymous statistics). Legal basis: Art. 6(1)(b)/(f) GDPR.
• Aggregated listing events (impressions and opens without storing visitor identity in event rows) — Art. 6(1)(f) GDPR (reach metrics for providers and platform operation).
• Site visits (event counts only; no visitor identity; each full page load counts again; no historical backfill) — Art. 6(1)(f) GDPR (reach metrics for platform operation).
• Abuse protection (rate limits; CAPTCHA / Turnstile if enabled) — Art. 6(1)(f) GDPR.
• Contact and report form — storage of category, subject, message text, email address and optionally name and URL for handling by the operator; for logged-in users optionally user_id. Notices of illegal content additionally require a name, the exact URL and a good-faith declaration of accuracy; name and email address may be omitted only under the statutory exception in Art. 16(2)(c) DSA. When handling reports we also process the report ID, listing link, reason, decision and technical delivery data of notifications. Legal basis: Art. 6(1)(c) GDPR for statutory notice-and-action duties (including notice procedures), otherwise Art. 6(1)(f) (support and protection of the service). Internal operator notes are not part of replies.
• Records of acceptance and confirmations — When you accept the terms of use, we store on the server your user ID, the terms version, the privacy notice version and the time (database time). When an Impressum is confirmed, we store the company, the acting user, the time and the confirmed version (text and checksum). This supports evidence of authority and contractual actions and the handling of disputes — Art. 6(1)(b)/(f) GDPR, as applicable. Acknowledging this notice is not marketing consent. These records are not public and access is limited to authorised persons as necessary.

2. Recipients and Data Processing

• Vercel — hosting and delivery of the web application. Processing locations may include EU and non-EU regions; the specific production region depends on the deployment configuration.
• Supabase — authentication, database and private media storage. The project runs in the Ireland region (eu-west-1).
• Resend — sending transactional system emails (including confirmation, invitations, password, viewing appointments, and receipts and decisions for reports) to the addresses provided; Reply-To / human contact: info@flat-radar.com.
• Microsoft — receipt and storage of operator emails sent to info@flat-radar.com (operator mailbox).
• Company members — recipients of applications for the respective listing and, within their role, participants in viewing appointments (not Flat-Radar.com as landlord).
• Company of a reported listing — receives a statement of reasons if the listing is restricted or removed; the reporter’s identity is not automatically disclosed to the provider.
• Public board / verified users — criteria of published housing requests are publicly readable; contact details only after retrieval by a user with a confirmed email. Company members have no additional rights regarding private requests.
• Cloudflare Turnstile — only if CAPTCHA is enabled in the respective environment.
• External maps: Mapbox and OpenStreetMap Foundation — maps load only after your consent (see section 4). Depending on configuration, map tiles come from Mapbox or from the OpenStreetMap Foundation (OpenStreetMap tiles). The provider may receive your IP address, technical request data and the coordinates needed to display the map; Mapbox may also process telemetry. Legal basis: Art. 6(1)(a) GDPR; non-essential access to your device relies on § 25(1) TDDDG. If enabled in the respective environment, our server requests address suggestions or geocoding from Mapbox during address entry; the entered address text is sent to Mapbox. Links to external directions services open only on your action, after which that service’s rules also apply. Further information: Mapbox Privacy Policy, OpenStreetMap Foundation Privacy Policy. Retention periods and contractual details depend on the respective provider configuration and are not guaranteed here.

Disclosure to other recipients occurs where required by law or necessary for contract performance. Where processing takes place outside the EEA (in particular hosting or email), we name the known recipients and regions above. For information on recipients and any transfer safeguards, contact info@flat-radar.com.

3. Retention Period

Retention depends on the respective purpose and legal obligations:

• Account and company data: as long as the account or company exists and retention obligations persist.
• Favourites and personal viewing history: until you remove the entries in your account or clear the history, or the account is deleted.
• Aggregated listing events (without visitor ID): as long as they are needed for operational statistics and abuse protection.
• Impressum and further notes: as long as they are needed for the relevant company’s publication service.
• Contact and report records, including technical delivery data: until processing is complete and beyond that only as long as they are needed for troubleshooting, defending rights or evidentiary or retention obligations.
• Records of acceptance of the terms and of Impressum confirmations: only as long as they are needed as evidence, for defending rights or for statutory obligations.
• Housing requests are active for 30 days from creation or the last renewal; the author can renew them. Closed or expired requests are no longer displayed publicly and are deleted automatically 45 days after they end, together with their moderation records. Until then, their author and authorised platform administrators can still view them. You can request earlier erasure at info@flat-radar.com.

For information or deletion requests, contact info@flat-radar.com.

4. Cookies and Device Storage

• Essential auth/session cookies (Supabase) — required for login (§ 25(2) TDDDG).
• Language cookie (display language) and storage of your privacy choice (see below) — strictly necessary; no consent required (§ 25(2) TDDDG).
• Workspace preference cookie and local UI settings (e.g. display theme) — functional for using the interface.
• sessionStorage for short-lived return intent after login / registration during applications.

Consent for external maps. A banner at the bottom of the screen asks whether external maps (Mapbox or OpenStreetMap tiles) may be loaded: “Accept all”, “Necessary only” or “Settings”. Maps are off by default and load only after your consent; accepting the terms of use does not enable them. Your choice (version, time of decision and selected purposes) is stored in your browser for 180 days, in local storage (localStorage key fr_privacy_consent_v1) and in a first-party cookie (fr_privacy_consent); a refusal is stored in the same way. No additional visitor identifier is created for this. You can change your choice at any time, and withdraw your consent just as easily, via “Privacy settings” in the site footer or at the top of this page. Withdrawal stops future map requests, does not undo requests already made and does not affect the lawfulness of processing before withdrawal. If your browser blocks storage, your choice may apply only to the current visit. Strictly necessary storage (sign-in session, language, this choice) does not require consent.

Third-party marketing tracking cookies are not part of the described features in this service. Fonts are delivered with the application and not requested from a separate third-party font CDN.

5. Your Rights

Under the GDPR you have rights including access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent where processing is based on consent. You may lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information. Contact for data subject rights: info@flat-radar.com.

6. Mandatory Information at Registration and Application

Registration and application require the information necessary for the contract. At registration you tick: “I agree to the Terms of Use and acknowledge that I have read the Privacy Notice.” This accepts the terms of use (version 2026-10-03) and acknowledges that you have read this privacy policy. It is not consent to all processing and not marketing consent; the legal bases are set out in section 1. The acceptance is recorded on the server (section 1, “Records of acceptance and confirmations”). This privacy policy is accessible via the footer and this link.

7. Services board

Registered users can publish listings for furniture, trades, moving and cleaning (“Offering” or “Looking for”). FlatRadar does not broker contracts; interested people contact the author directly.

• Data processed: listing content (category, title, description, price, photos); place (country, city, optionally district and a map point rounded to about 100 m); for moving requests also the destination, floor, lift, packing needs and optionally a date; contact details (name, phone and/or e-mail, preferred channel); for business listings the provider details (name/company, address, e-mail, optionally register and VAT details); proof of consent (time, text version, fields released); publication balance and history. Photo metadata (e.g. EXIF and GPS) is removed on upload.
• Visibility: listing content, photos and the rounded place are public. Name and contact details are shown only to signed-in users with a confirmed e-mail, while the listing is live and your consent is in place. Provider details of business listings are visible to everyone.
• Legal bases: providing the board and account — Art. 6(1)(b) GDPR; showing name and contact details to signed-in users — consent, Art. 6(1)(a) GDPR; provider details of business listings — Art. 6(1)(c) and (f) GDPR (the provider’s duty under § 5 DDG); abuse prevention (CAPTCHA, rate limits, reports, blocks) — Art. 6(1)(f) GDPR; proof of consent — Art. 6(1)(c) with Art. 7(1) GDPR.
• Withdrawal: you can withdraw consent at any time for the future by removing the contact details or taking the listing down. This does not affect the lawfulness of earlier display.
• Recipients: the providers listed in section 2 (hosting, database, CAPTCHA). Maps and route calculation for moving requests (Mapbox) load only after your consent to maps; the rounded points are sent and the route is not stored.
• Retention: listings are live for 30 days. Taken-down, expired or removed listings are deleted with their photos 45 days after they end. Consent records are deleted three years after withdrawal or the end of the listing. The publication history is kept for as long as the account exists.
• Email alerts: if you turn on “Email me” when saving a filter, we store the filter criteria (categories, place, drawn area) and email the address of your account as soon as a matching new listing is published. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or in your account; the filter data is deleted with the alert or your account. Emails are sent by Resend (processor, see section 2).

8. Private landlords

• Declaration as a private person — If you offer housing as a private person, we store with your declaration (private, non-commercial letting of your own residential property) your workspace, your user ID, the version and language of the text, a checksum (SHA-256) of the confirmed text and the time (database time). The purposes are to evidence your statement, to label your listings and to inform prospective tenants, which the law requires of us as a platform (Section 312l BGB, Article 246d EGBGB). Legal bases are Art. 6(1)(b) GDPR (requested publication service), (c) (statutory information duty) and (f) (evidence and legal defence). The record is not public and is accessible only to authorised staff of the operator.
• Retention of the declaration — as long as your private workspace exists; it is deleted when the workspace or your account is deleted.
• Public information — Listings by private providers show “Private person” instead of a company name, logo or Impressum; your name is not shown in the listing. People who apply to your listing see the name of your workspace (your display name) in their applications and viewing appointments, so they know whom they are dealing with.
• Location — If the address has no house number, we publicly show only the street, postcode, town and district and an approximate map area. Its centre is moved by 20–50 m on the server using a secret key; the stored coordinates and address details are not published. With a house number, the exact address and exact location are published; we point this out when you enter it. Legal basis: Art. 6(1)(b) / (f) GDPR, in line with data minimisation (Art. 5(1)(c) GDPR).