Pilot privacy
How we process your data
Version 2026-08-26.2 · Free pilot for adults aged 18 or over
Controller
Iván López Martínez
Privacy contact
privacidad@houseflow.es
Purposes and legal bases
- Student request and supply onboarding: reviewing the information and providing the requested pilot, based on the consent given when each form is submitted.
- Contact between the parties: only after specific consent identifying the purpose, recipient and next step.
- Security and abuse prevention: an HMAC fingerprint and minimal technical records based on the legitimate interest in protecting the service; IP addresses are not persisted in analytics.
- Aggregate analytics: only with optional, revocable consent.
Data processed
Depending on the role, we process identity and contact details, city, university, dates, budget and practical preferences; or provider contact details, capacity, prices, availability, and private exact address and coordinates. During this beta we do not request copies of national IDs, passports, deeds or other official documents, and we do not record the human review.
Providers and recipients
Hostinger provides hosting and email. Supabase will provide the database only when a separate European pilot project is activated. Both publish data-processing addenda and contractual transfer mechanisms. GitHub contains code and governance only, never requests or addresses. Telegram receives only aggregate technical alerts with no pilot personal data.
If a provider enters an address, the query is sent from our server to the CartoCiudad geocoder (CNIG/IGN), and the map is obtained from the IGN WMS. We do not send name, email or phone number to those services, but the address query itself leaves HouseFlow to return official candidates.
Contact details will only be disclosed to the specific student or provider after specific consent. Data is not sold or used for behavioural advertising.
Retention
We retain a request for up to 180 days after it is closed and delete it sooner if you withdraw consent or request deletion, unless an applicable legal obligation requires otherwise.
Your rights
You may withdraw consent and request access, correction, deletion, restriction, portability or objection through the email above. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Decisions and minors
HouseFlow does not make automated decisions with legal effects and does not use AI to decide compatibility. Initial matching uses objective rules and human review. The pilot is limited to adults aged 18 or over.
Optional analytics
Aggregate pilot measurement runs only if you accept analytics. The preference is kept in your browser; we do not use behavioural advertising.