Controller and contact
Controller: [LEGAL ENTITY], [ADDRESS]. Privacy contact / DPO: [PRIVACY EMAIL]. This notice describes the intended service and must be finalized after a data protection impact assessment and vendor review. Terms acceptance, notice acknowledgment, and optional consent are separate records. We do not interpret acknowledgment as blanket consent.
What we process and why
We process account details, explicitly shared roommate preferences, interests, connection permissions, chats, application information, references, evidence metadata, identity-check outcomes, and security/audit events. Purposes include authentication, matching at your direction, application review, fraud prevention, safety, support, and compliance. Lawful basis for each purpose, biometric processing condition, and required vs optional fields: [COUNSEL / DPO TO COMPLETE]. No opaque compatibility score or inference of sensitive characteristics is used.
Who sees what
Public visitors see published listings and approximate locations. Verified interested renters may see eligible lifestyle profiles and exact addresses. Direct chats are limited to their accepted participants. A household chat includes its accepted members and responsible lister. Each applicant sees their own financial evidence; the lister receives it for review after submission. Roommates do not receive one another’s private evidence. Case-related document access requires a recorded reason and time-limited grant.
Vendors and international processing
Supabase supports authentication, database, photos, and message delivery; Vercel hosts the application; Smile ID processes verification evidence; AWS stores and scans documents; LiveKit carries unrecorded audio; Resend sends transactional email; Mapbox displays maps; Sentry receives minimized diagnostics. Frankfurt is the intended primary hosting region, not a guarantee that every vendor processes only there. Document actual subprocessors, vendor agreements, cross-border safeguards, and transfer grounds before launch.
Retention, deletion and copies
Provisional document defaults are 30 days for abandoned uploads and 90 days after application closure, subject to Nigerian legal review. An applicable legal hold pauses erasure. Versioned storage objects must be erased as well as active metadata; restoration must reapply the erasure ledger. Separate retention schedules for accounts, verification outcomes, chats, audit records, and backups: [DPO TO APPROVE]. A downloaded copy cannot be technically recalled. Listers must use evidence only for its stated purpose and protect and delete their copies appropriately.
Your choices and rights
Contact [PRIVACY EMAIL] for applicable access, correction, deletion, restriction, objection, portability, or consent-withdrawal requests and identity-safe handling. We will assess requests under applicable law and explain lawful exceptions. You may raise concerns with the Nigeria Data Protection Commission. Response procedures and responsible contacts must be operational before launch. Optional marketing and behavioral analytics are disabled in this build.
Legal review reference: Nigeria Data Protection Commission guidance. Region selection alone does not establish compliance.