Privacy Policy
How EzyFlat collects, uses and protects personal data.
Effective date: 2026-10-25 · Version 1.0
The controller is Φρατζέσκος Δαφερέρας (Fratzeskos Dafereras), trading as EzyFlat, registered at Φραγκούλη 36, 18541. Privacy contact: contact@ezyflat.com.
1. Data EzyFlat collects
- Account: name, surname, email, optional phone, date of birth, age, gender, hashed password, verification status and Google OAuth details.
- Profile and matching: photo, bio, occupation, budget, areas, rental period, sleep, smoking, pets, guests, hobbies and music.
- Listings: address, exact coordinates, property/room details, photos, prices, deposits, availability, rules and host-authority declaration.
- Service activity: saved listings/searches, viewing proposals (the day/time you proposed, sent to the host as a message), tenancy dates, notifications, conversations and messages. (Booking requests are not currently offered.)
- Technical/security: session tokens, sign-in times, IP/device where logged, logs, failed attempts and anti-bot results.
- Support and reports: communications, complaints, evidence and moderation actions.
2. Sources
Data comes from you, from other users when they invite or add you to a home, from Google when you use Google sign-in, from technical systems when you use the service, and from partners or authorities where lawful and necessary.
3. Purposes and lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Account, profile and sign-in | Name, email, date of birth, gender, hashed password, photos, sessions, public identifier | Performance of a contract — Article 6(1)(b) |
| Listings, search and flatmate matching | Listings, lifestyle preferences, area and approximate point | Performance of a contract — Article 6(1)(b) |
| Messages, viewing requests and tenancy history | Messages, requests, dates and tenancy memberships | Performance of a contract — Article 6(1)(b) |
| Service email: verification, notifications, reminders | Email address and account events | Performance of a contract — Article 6(1)(b) |
| Protection against bots, spam, fake sign-ups and repeated failed sign-ins | Technical logs, IP address, Turnstile signals; and, for sign-ins, a coded fingerprint of the email typed and the times of failed attempts, in memory only, for up to 15 minutes | Legitimate interests — Article 6(1)(f). The interest: keeping the platform free of automated and fake entries |
| Reports, content moderation and user safety | The report, the content it identifies, and the decision taken on it | Legitimate interests — Article 6(1)(f). The interest: the safety of users. And legal obligation — Article 6(1)(c) — where Regulation (EU) 2022/2065 applies |
| Legal claims and requests from authorities | Whatever is relevant to that specific claim or request | Legal obligation — Article 6(1)(c), or legitimate interests — Article 6(1)(f) for establishing and defending claims |
| Optional cookies and similar technologies | As described per category in the Cookie Policy | Consent — Article 6(1)(a) and Article 4(5) of Greek Law 3471/2006. No optional category is active today |
Where EzyFlat relies on legitimate interests, the interest is named in the table and has been balanced against your rights; you can object to that processing (section 9). Where it relies on consent, you can withdraw it at any time, without affecting the lawfulness of what was done before.
4. Public and visible information
Privacy settings determine which profile fields are shown to other members. Some cannot be hidden, and they fall into two groups. Age and gender are trust signals. The facts that decide whether two people can share a flat — budget, areas of interest, rental period, sleep schedule, smoking (your own and what you accept), pets (your own and what you accept) and guests (your own and what you accept) — are always visible to signed-in members, because without them nobody can tell whether you would suit each other.
Everything that identifies you stays your own choice: first name, surname, photo, email address and occupation, along with your interests and music. Your exact date of birth and your email are never public. And if you would rather not be found at all, a single setting removes you from Flatmate Search entirely — your listing, if you have one, is unaffected, because that is a property rather than a person.
None of the above is shown to anonymous visitors. Signing in is required before any of it is visible, whatever your settings say.
A listing’s exact address — street, number, postcode and the precise pin — is shown only to someone who has made contact about it: the owner, confirmed members of the household, anyone who has asked to view it, and anyone who has written to the owner. Everyone else — anonymous visitors and signed-in users alike — sees the neighbourhood and a point 200-400 m from the building. Radius search runs against that coarse point, so it cannot be used to find the exact one. Exact addresses do not appear in metadata or share previews. A host may also choose that a listing’s exact address is never shown. On such a listing nobody outside the household sees it, however far they get — the address is still stored, because radius search runs on it, and the host gives it out themselves in the conversation.
5. Flatmate matching and profiling
EzyFlat calculates compatibility indicators from declared preferences and habits. The logic, in plain words: six dimensions are weighted — smoking 25%, sleep schedule 20%, pets 15%, guests 15%, shared hobbies and music 15%, closeness in age 10%. For smoking, pets and guests what counts is the distance between what you do and what the other person tolerates, in both directions; a large distance in any of those three acts as a clash and caps the overall result. Dimensions that cannot be compared are not held against you: the weights are renormalised over the ones that can.
The indicator is only ever shown as one of two badges (“good” or “great”), and only when your profile is at least 70% complete and at least three dimensions are comparable; otherwise no badge is shown at all. Fields you have marked private are not used in the indicator other people see.
No decision is taken solely by automated means. The indicator is a search aid: it does not decide whether anyone may rent, contact you or appear in results, and no right or access depends on it. Change visibility settings or ask for details at contact@ezyflat.com.
6. Recipients and providers
- Other users, according to Platform functions and visibility settings.
- Render for the API and the PostgreSQL database, in its Frankfurt region.
- Vercel for hosting and delivering the website.
- Cloudinary for photo hosting and technical processing.
- Resend for transactional emails and notifications.
- Google for OAuth.
- OpenFreeMap (tiles.openfreemap.org) for map tiles. When you open a page with a map, your browser requests the tiles directly from the provider; the provider receives your IP address and the map area you view. No account data is sent and no cookie is set.
- Cloudflare Turnstile for bot and abuse protection at sign-up, and at sign-in after repeated failed attempts.
- Lawyers, accountants, insurers, investors/successors and authorities where necessary and lawful.
7. Transfers outside the EEA
Your account and listing data is stored in the European Economic Area: the database and the API run in Render’s Frankfurt region. Some of the other providers named above may process data outside the EEA, and for those it relies on the transfer mechanism in that provider’s data-processing terms — an adequacy decision where one covers them, otherwise the European Commission’s Standard Contractual Clauses. To ask which mechanism applies to a specific provider, or for a copy of the relevant safeguards, write to contact@ezyflat.com.
8. Retention
- Unverified accounts: automatically deleted after 3 days.
- Account and active profile: while the account remains active.
- Session records: up to 60 days from creation, or sooner after expiry/logout.
What happens when you delete your account. Your profile, your photos, your sessions, your tokens, the listings you created with everything in them, your saved searches and listings, your notifications, blocks in both directions and your viewing requests are all deleted. A conversation left with no participants at all is deleted entirely.
Four things survive, without naming you, and the reason for each:
- Messages you sent in a conversation whose other party is still here, with the sender removed. They show as “Deleted user”. One half of a conversation is not ours to erase — and it is the other person’s evidence if they report you.
- Confirmed or ended tenancies in other people’s homes, with the personal details stripped and the name “Former tenant”. A household’s history belongs to that household.
- Reports you filed, with the reporter removed. Closing an account does not erase an accusation about somebody else.
- The conversations of a deleted listing, detached from it, so the other person does not lose the thread.
Your photos are detached from the account, and their files are removed from the image provider by the automatic sweep rather than in the same instant. And one thing that is true of every deletion: the database supports point-in-time restore for the past 3 days, so for that long a deleted item may still exist in a backup. Beyond these, EzyFlat may retain what is needed for claims, fraud, security or a legal obligation.
9. Your rights
Depending on the lawful basis, you may request access, correction, deletion, restriction, portability, objection and withdrawal of consent. Contact contact@ezyflat.com. EzyFlat may request proportionate identity confirmation and normally responds within one month.
You may complain to the Hellenic Data Protection Authority (1-3 Kifissias Ave., 115 23 Athens, tel. +30 210 6475600) or to another competent supervisory authority, in particular the one where you habitually reside.
What you have to provide. Name, email address, date of birth and gender are necessary to create an account: without them the contract cannot be entered into, so no account can be created. Phone number, photo, profile text and lifestyle preferences are optional; without them the service works, but matching is less accurate.
10. Cookies and similar technologies
EzyFlat uses strictly necessary cookies for sessions and language preference. Optional analytics, advertising or other non-essential trackers must not load before valid consent. See the Cookie Policy and manage your choices through “Cookie Settings” in the footer.
11. Security and breaches
Measures include access controls, session expiry, email verification, anti-bot protection, upload restrictions and error logging. No system is completely secure. Where a breach creates relevant risk, EzyFlat will follow legal authority and user-notification procedures. Security reports: contact@ezyflat.com.
12. Children
The service is only for people aged 18 or older. Date of birth is required at sign-up and checked on the server on every path — password sign-up, Google sign-up, and any later change to the profile — so an under-18 account is not created and cannot appear later. It is a declared date, though: EzyFlat does not verify identity and does not ask for documents. If it learns that a minor created an account, it may close it and delete the data, subject to limited lawful retention.
13. Changes
EzyFlat will update the date and notify users of material changes through email or the Platform.