Privacy Policy

1. Introduction

Welcome to Roomates ("we," "us," or "our"). Roomates operates a roommate matching platform that helps individuals discover compatible roommates, view compatibility scores, manage properties and shared living spaces, handle bookings, and communicate in real time. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use our website, mobile applications, and related services (collectively, the "Platform").

We are committed to protecting your privacy and handling your data with transparency and care. Because our Platform relies on detailed personal and lifestyle information to deliver accurate roommate matches, we take our responsibility as a data controller seriously. We encourage you to read this Privacy Policy carefully to understand our practices regarding your personal data.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the Platform.

2. Information We Collect

We collect several categories of information to provide, improve, and personalize our services:

Account and Profile Data. When you register for an account, we collect your full name, email address, date of birth, gender, profile photographs, biographical description, and any other information you choose to include in your profile. You may also provide your phone number for verification purposes.

Lifestyle and Compatibility Preferences. To power our matching algorithm, we collect detailed lifestyle information, including your preferred sleep schedule, cleanliness standards, noise tolerance, smoking habits, pet ownership or preferences, dietary habits, work-from-home schedule, guest policies, and budget range. These preferences form the core of our compatibility scoring system.

Verification Data. To promote trust and safety, we may collect identity verification documents, email and phone verification status, and background check authorization where permitted by law.

Device and Technical Data. We automatically collect information about the device and browser you use to access the Platform, including your IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.

Usage Data. We collect information about how you interact with the Platform, including pages visited, features used, search queries, profiles viewed, matches accepted or declined, messages sent, session duration, and referring URLs.

Payment Information. When you make payments through the Platform, our third-party payment processor collects your payment card details, billing address, and transaction history. We do not store full payment card numbers on our servers.

Communications. We retain messages you send through the Platform's messaging system, as well as any correspondence you have with our support team.

3. How We Use Your Information

We use the information we collect for the following purposes:

Account Management. To create and maintain your account, verify your identity, and provide customer support.
Roommate Matching. To power our compatibility algorithm, generate compatibility scores, and present you with relevant roommate recommendations based on your lifestyle preferences and stated requirements.
Personalized Recommendations. To suggest properties, shared living spaces, and potential roommates that align with your preferences, location, and budget.
Communication. To facilitate real-time messaging between matched users, send booking confirmations, and deliver system notifications about your account activity.
Payment Processing. To process subscription fees, booking payments, and other financial transactions associated with your use of the Platform.
Safety and Security. To detect and prevent fraud, enforce our Terms of Service, protect the safety of our users, and maintain the integrity of the Platform.
Analytics and Improvement. To analyze usage patterns, measure the effectiveness of features, conduct A/B testing, and improve the Platform's functionality and user experience.
Marketing (Opt-In). With your explicit consent, to send promotional emails about new features, special offers, or partner services. You may opt out of marketing communications at any time through your account notification settings or by using the unsubscribe link in any marketing email.

4. Legal Basis for Processing (GDPR)

[LEGAL-REVIEW-REQUIRED] If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data only where we have a valid legal basis under Article 6 of the General Data Protection Regulation (GDPR). The table below maps our main processing purposes to their corresponding legal basis.

Processing purpose	Legal basis (GDPR Art. 6)
Account creation and management	Performance of a contract (Art. 6(1)(b))
Roommate matching and compatibility scoring	Performance of a contract (Art. 6(1)(b)); explicit consent for lifestyle data (Art. 9(2)(a))
Payment and booking processing	Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Fraud prevention, safety and security	Legitimate interests (Art. 6(1)(f))
Analytics and product improvement	Legitimate interests (Art. 6(1)(f)); consent where required (Art. 6(1)(a))
Marketing communications	Consent (Art. 6(1)(a))
Compliance with legal and regulatory obligations	Legal obligation (Art. 6(1)(c))

[LEGAL-REVIEW-REQUIRED] Special category data (GDPR Art. 9). Certain lifestyle preferences you provide for matching (for example, dietary habits or other details that may reveal sensitive information) could constitute special category data. We process such data solely on the basis of your explicit consent under Article 9(2)(a) GDPR, which you may withdraw at any time through your privacy settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Matching & Compatibility Data

Our matching algorithm is central to the Roomates experience. Understanding how your data is used in this process is important:

How the Algorithm Works. Your lifestyle preferences — such as sleep schedule, cleanliness level, noise tolerance, smoking habits, and pet preferences — are compared against those of other users using a weighted scoring system. The resulting compatibility score (displayed as a percentage) reflects how well two users' living habits and preferences align.

What Is Shared with Potential Matches. When you appear in another user's discovery feed or match results, they can see your public profile information: your display name, profile photos, bio, general location (city or neighborhood level), and an overall compatibility score. Specific lifestyle preference details (e.g., "goes to bed at 10 PM") are visible only if you have enabled them in your Privacy Settings.

What Remains Private. Your email address, phone number, exact address, payment information, and verification documents are never shared with other users. Internal algorithm weightings and scoring mechanics are also not disclosed. You retain full control over which lifestyle details are visible to others through the Privacy section of your Account Center.

Opting Out of Matching. You can pause your visibility in the discovery feed at any time through your privacy settings. This will prevent your profile from appearing in other users' match results while preserving your existing connections and conversations.

6. Location Data

Why We Collect Location Data. Location information allows us to show you nearby roommate matches, display relevant property listings in your area, and provide distance estimates between you and potential shared living spaces.

Precision Levels. We use location data at varying levels of precision depending on the feature:

City/Region Level. Used for broad roommate discovery and property search filtering. This is derived from your IP address or the location you manually enter in your profile.
Neighborhood Level. Used for more refined match recommendations and is displayed on your public profile (if enabled). We never display your exact street address to other users.
Precise Location. Collected only with your explicit permission via browser or device geolocation APIs, and used solely for proximity-based search features. Precise coordinates are not stored permanently and are never shared with other users.

How to Disable. You can control location data collection through your Privacy Settings. You may revoke browser geolocation permissions at any time through your browser settings. Disabling location services may limit the accuracy of nearby match recommendations and property search results.

7. Information Sharing

We share your personal information only in the following circumstances:

With Other Users. Your public profile information, including your display name, photos, bio, general location, and compatibility score, is visible to other users of the Platform. The specific lifestyle details you choose to make visible in your privacy settings may also be shared. Messages you send through the Platform are visible to their intended recipients.

Service Providers. We engage trusted third-party service providers who perform services on our behalf, including payment processing, cloud hosting and data storage, email delivery, analytics, customer support tools, and identity verification. These providers are contractually obligated to use your data only for the purposes we specify and to maintain appropriate security measures.

Legal Requirements. We may disclose your information if required to do so by law, regulation, legal process, or governmental request. We may also disclose information when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

Business Transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Platform of any change in ownership or use of your personal information.

We Never Sell Your Personal Data. Roomates does not sell, rent, or trade your personal information to third parties for their marketing purposes. We do not participate in data broker networks or advertising exchanges that involve the sale of user data.

8. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience on the Platform. For detailed information, please review our Cookie Policy.

Essential Cookies. These cookies are strictly necessary for the Platform to function. They enable core features such as user authentication, session management, security protections, and remembering your privacy preferences. You cannot opt out of essential cookies.

Analytics Cookies. We use analytics cookies to understand how users interact with the Platform, measure feature adoption, identify performance issues, and improve our services. Analytics data is aggregated and does not identify you personally.

Marketing Cookies. With your consent, we may use marketing cookies to deliver relevant advertisements on third-party platforms and measure the effectiveness of our campaigns. You can manage your cookie preferences at any time through the cookie settings accessible in the Platform's footer.

9. Data Security

We implement robust technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

Encryption. All data transmitted between your device and our servers is encrypted using TLS 1.3. Sensitive data at rest, including passwords and payment references, is encrypted using industry-standard AES-256 encryption.
Two-Factor Authentication (2FA). We offer multiple second-factor authentication methods, including TOTP-based authenticator apps and email verification codes, to add an extra layer of protection to your account.
Passkeys and WebAuthn. We support FIDO2/WebAuthn passkeys as a phishing-resistant authentication method, allowing you to sign in securely using biometric sensors or hardware security keys.
Secure Password Storage. Passwords are salted and hashed using bcrypt. We never store passwords in plain text.
Regular Security Audits. We conduct periodic security assessments, penetration testing, and code reviews to identify and remediate vulnerabilities.
Incident Response. We maintain a documented incident response plan. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities within 72 hours as required by applicable law.
Access Controls. Access to user data within our organization is restricted to authorized personnel on a need-to-know basis, and all access is logged and audited.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

10. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Active Accounts. Your profile data, lifestyle preferences, match history, and messages are retained for the duration of your active account.
Inactive Accounts. If your account remains inactive for 24 consecutive months, we will send you a notification. If no action is taken within 30 days, we may deactivate your account and begin the deletion process.
Post-Deletion. When you delete your account, we remove your profile from the Platform immediately. Your personal data is purged from our active systems within 30 days. Residual copies in encrypted backups are overwritten within 90 days as part of our regular backup rotation cycle.
Legal Obligations. Certain data, such as transaction records and communication logs related to disputes or legal proceedings, may be retained for up to 7 years to comply with applicable tax, financial reporting, and legal requirements.
Anonymized Data. We may retain anonymized and aggregated data (which cannot be used to identify you) indefinitely for analytical and research purposes.

11. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Right of Access. You may request a copy of the personal information we hold about you. You can access much of this data directly through the Data & Export section of your Account Center.
Right to Correction. You may request that we correct inaccurate or incomplete personal information. You can update most profile data directly through your Account Center.
Right to Deletion. You may request that we delete your personal information, subject to certain legal exceptions. Account deletion can be initiated through your Account Center's Security settings.
Right to Data Portability. You may request a machine-readable copy of the personal data you have provided to us. Our Data & Export feature allows you to download your data in JSON format.
Right to Restrict Processing. You may request that we restrict the processing of your personal information in certain circumstances, such as while we verify the accuracy of data you have contested.
Right to Object. You may object to the processing of your personal information for direct marketing purposes or where processing is based on our legitimate interests.
Right to Opt Out of Marketing. You can opt out of marketing communications at any time through your notification preferences or by clicking the unsubscribe link in any marketing email.
CCPA-Specific Rights. California residents have the right to know what personal information is collected, the right to request deletion, the right to opt out of the sale of personal information (we do not sell your data), and the right to non-discrimination for exercising their privacy rights.
GDPR-Specific Rights. Users in the European Economic Area have additional rights including the right to withdraw consent, the right to lodge a complaint with a supervisory authority, and the right to be informed about automated decision-making.

To exercise any of these rights, please contact us at privacy@roomates.co. We will respond to your request within 30 days, or within the timeframe required by applicable law.

12. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. Our registration process requires users to confirm that they are at least 18 years old.

If we become aware that we have collected personal information from a child under 18, we will take immediate steps to delete that information from our servers and terminate the associated account. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at privacy@roomates.co so that we can take appropriate action.

13. International Data Transfers

Roomates is based in the United States, and your personal information is primarily stored and processed on servers located in the United States. If you are accessing the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

When we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including:

Standard Contractual Clauses (SCCs) approved by the European Commission.
Data processing agreements with our service providers that include appropriate technical and organizational security measures.
Where applicable, reliance on adequacy decisions issued by the European Commission or the UK Secretary of State.

You may request a copy of the safeguards we use for international data transfers by contacting us at privacy@roomates.co.

14. EU Representative (GDPR Art. 27)

[LEGAL-REVIEW-REQUIRED] Because we offer our services to individuals in the European Economic Area while being established outside the EEA, we have designated a representative in the Union pursuant to Article 27 of the GDPR. You may contact our EU representative on all matters relating to the processing of your personal data:

EU Representative: EU Representative — to be appointed
Address: To be appointed (EEA)
Email: privacy@roomates.co

[LEGAL-REVIEW-REQUIRED] You also have the right to lodge a complaint with the supervisory authority in your EEA member state of residence, place of work, or place of the alleged infringement.

15. Brazil — LGPD (Lei Geral de Proteção de Dados)

[LEGAL-REVIEW-REQUIRED] If you are located in Brazil, we process your personal data in accordance with the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018). Roomates acts as the data controller (controlador) for the personal data you provide through the Platform. The National Data Protection Authority (Autoridade Nacional de Proteção de Dados, "ANPD") is the competent supervisory authority.

[LEGAL-REVIEW-REQUIRED] Rights of the data subject (titular). Under Articles 18 and 9 of the LGPD, you have the right to confirmation of processing, access, correction of incomplete or inaccurate data, anonymization or deletion of unnecessary data, data portability, information about shared processing, and the right to withdraw consent. Processing of sensitive personal data (dados pessoais sensíveis) used for matching is carried out on the basis of your specific and highlighted consent.

[LEGAL-REVIEW-REQUIRED] Data Protection Officer (Encarregado). We have appointed an encarregado de proteção de dados as our point of contact for data subjects and the ANPD:

Encarregado (DPO): Encarregado (DPO) — a ser designado
Address: A ser designado (Brasil)
Email: privacy@roomates.co

16. California — Do Not Sell or Share My Personal Information

[LEGAL-REVIEW-REQUIRED] If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), grants you the right to opt out of the "sale" or "sharing" of your personal information, including sharing for cross-context behavioral advertising.

[LEGAL-REVIEW-REQUIRED] We do not sell your personal information for monetary consideration, and we do not knowingly sell or share the personal information of consumers under 16 years of age. Where we use advertising or analytics technologies that may constitute "sharing" under the CCPA, you may exercise your choice through our cookie preference center or by submitting a request as described below.

[LEGAL-REVIEW-REQUIRED] To exercise your right to opt out of sale or sharing, use the "Do Not Sell or Share My Personal Information" control available in our cookie preferences, or contact us at privacy@roomates.co. We honor opt-out preference signals where required by law. You also have the right to limit the use of sensitive personal information and the right not to be discriminated against for exercising your privacy rights.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

Send an email notification to the address associated with your account at least 30 days before the changes take effect.
Display a prominent in-app notification alerting you to the updated policy.
Update the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated terms, you should discontinue use of the Platform and delete your account.

18. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Privacy Team Email: privacy@roomates.co
Mailing Address: HOLA GROUP S.A.S. (NIT 902089337-1, commercial registry 851289-12), Medellín, Antioquia, Colombia

Data Protection Officer. Our Data Protection Officer oversees compliance with applicable data protection laws. You may reach the DPO directly at privacy@roomates.co with the subject line "Attn: Data Protection Officer."

We aim to resolve all privacy-related inquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.