Privacy Policy

1. Who is responsible for your data

For account, security and service-operation data, Flatly is the data controller.

For tenant, property, lease, payment and utility records entered by a landlord, the landlord is the data controller and Flatly acts as a data processor on the landlord's behalf, as described in our Data Processing Addendum.

2. Information we collect

• Account data: email address, password (stored only as a one-way hash), account role, and sign-in details if you use Google sign-in.
• Profile data you choose to provide: city, location, search preferences and profile photo.
• Rental records: properties, leases and contract details, payment records and statuses, utility readings, and notifications.
• Communications: messages you send and receive through Flatly, and emails we send to you such as reminders and password resets.
• Technical data: IP address, browser type, and security and error logs.

3. Why we use your data and our legal basis

We do not sell personal data and we do not use it for advertising or profiling.

• To provide the service and perform our contract with you (Art. 6(1)(b) GDPR): running your account, leases, payment tracking, utilities and messaging.
• To pursue our legitimate interests (Art. 6(1)(f) GDPR): securing the platform, preventing abuse and fraud, fixing errors and improving the service.
• To comply with legal obligations (Art. 6(1)(c) GDPR): for example accounting, tax and responding to lawful requests from authorities.
• With your consent (Art. 6(1)(a) GDPR): for optional features such as location-based search. You can withdraw consent at any time.

4. Who we share data with

Landlords and tenants connected through a lease can see the records relevant to that lease, including contact details, payments, utility readings and messages.

We use trusted service providers that process data on our behalf under written agreements: hosting and database infrastructure, email delivery (Resend), file storage for photos (Supabase), and Google for optional sign-in.

We may disclose data when required by law or to protect the rights, safety and security of users and the platform.

5. International transfers

If a provider processes data outside the European Economic Area, we rely on safeguards recognised by the GDPR, such as Standard Contractual Clauses or an adequacy decision.

6. Cookies and local storage

Flatly uses only what is strictly necessary: a session token kept in your browser's local storage so you stay signed in, and a cookie that remembers your language. We do not use advertising or third-party tracking cookies.

7. Data retention

We keep data while your account is active. After an account is closed we keep only what is needed for legal, accounting, security and dispute-resolution purposes, and then delete or anonymise it.

Landlords decide how long tenant and lease records are kept, subject to their own legal obligations.

8. Security

We apply appropriate technical and organizational measures to protect personal data, including encrypted connections, hashed passwords, access controls and monitoring. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your rights and freedoms we will notify you and the supervisory authority as required by law.

9. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent. To exercise these rights contact us below; if your data is held by a landlord as controller we will help route your request. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or your local supervisory authority.

10. Children

Flatly is intended for adults aged 18 and over. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. The date above shows the latest version, and we will notify you of material changes.

12. Contact

For privacy requests and questions, contact:

privacy@flatly.lt