Subletty Privacy Policy

The key points in brief

1. We count visits with our own statistics (Umami) on our own server – without cookies, without storing anything in your browser and without storing your IP address. With “Do Not Track” in your browser we do not count you. We also count how often a highlight was delivered, without any link to you. We do not sell data. Ads from Google appear at most in the search, even while you are signed in. Google sees your IP address as soon as the page loads. Ads are personalised only after your choice in the consent banner. Otherwise we only store what is technically necessary.
2. Without an account you can search, read and report. Cloudflare sees your full IP address, our own logs only a shortened one.
3. For an account we only need your email address. No password, no real name.
4. To publish and write messages we need your mobile number. We show it to nobody unless you share it.
5. We do not store the address of a home. We convert the place you type on our own server; it goes to no one else.
6. Listings are public and can be found through search engines, unless you switch that off for a listing. Photos lose all metadata when uploaded, including where they were taken.
7. We do not read your messages. Only if a message is reported do we see it and the ten before it.
8. We log security-relevant events for 12 months, for example every sign-in and every time a mobile number is shown.
9. After a suspension your mobile number stays in the suspended account until you ask us to delete it. So that you do not create a new account, we also keep a check value of the number for 24 months from the suspension, beyond the deletion too.
10. Paying is only possible for an optional highlight of your own listing, and only while we offer it. You pay at Stripe. We do not see your payment details; we only store the order. After the purchase you get an order confirmation from us by email. You can withdraw with “Withdraw from contract” in the footer of every page.
11. Your rights such as access and erasure are handled by email to [email protected].

1. Who is responsible

2. When you use Subletty without an account

Page visits. All requests to subletty.app go through Cloudflare. Cloudflare provides encryption and protection against attacks and in doing so sees your full IP address and the pages you visit. For each request, our application logs the method, the path without search parameters, the status, the duration and your shortened IP address. Content, email addresses, numbers, codes, place entries and messages are not in our logs. The only exception: if two accounts confirm the same mobile number at the same moment, it can appear once in the database log. We delete all logs after 14 days.
Legal basis: Art. 6(1)(f) GDPR, our interest in secure operation.

Protection against abuse. We count requests to limit spam and costs. For this we do not store your IP address, only a check value derived from it with a secret key, for at most 24 hours. Before codes are sent, on the contact form, when you report without a confirmed account and when you withdraw without being signed in, your browser usually solves a small computing task (ALTCHA). This is not an external service, and nothing is stored in your browser.
Legal basis: Art. 6(1)(f) GDPR.

Place search. If you enter a place or an address, our own server converts the text you typed with the map service Photon (data from OpenStreetMap). The text goes to no other service. What comes back is a rough location, accurate to about 500 m, and “district, city”. We do not store the text you typed.
Legal basis: Art. 6(1)(b) GDPR, for searches without an account point (f).

Visitor statistics (Umami)

What for. We want to know how Subletty is used: how many visits there are, which pages are opened, roughly where visits come from and how often, for example, a listing is published. For this we use Umami, open-source statistics that we run ourselves on our server in Germany. The data goes to no other service.

What is counted. When a page loads, your browser sends to our own address (subletty.app/stats): the page without search details, private pages such as account, messages or “My listings” only as an area without an identifier, the website you came from (only its address without a path), browser, operating system, device type, screen size and language, and whether you are signed in (only “signed in” or “anonymous”, never which account). In addition a few events without content: listing published (offer or request), sign-in completed (and by which way), number confirmed and a click on a card in “Join in”. No account ID, no email address, no number, no page titles.

Without cookies. Umami sets no cookies and stores nothing in your browser. To group page views into one visit, Umami forms a check value from your IP address and browser details with a random value that changes every month. Your IP address is processed only briefly for this and is not stored. From it Umami derives your rough origin (country, at most region and city), never a precise location.

Legal basis: Art. 6(1)(f) GDPR, our interest in improving Subletty and seeing what is used. Because nothing is stored in or read from your browser, we do not ask for consent.

Objection. Turn on “Do Not Track” or “Global Privacy Control” in your browser and we do not count you. You can also object by email to [email protected] (section 13).

Storage period. We keep the statistics for at most 24 months.

Ads in the search (Google AdSense)

Where and for whom. We may show ads from Google in the search, for everyone, even while you are signed in. They appear only on the results page of a search without a place or with a rough place, that is a city or a district. A search for an address, street, postcode or a specific point shows no ads. There are no ads on any other page. The ad is a tile of its own between the results and labelled “Advertisement”. Google's notice on the ad says who pays for it and why you see it.

Who provides them. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For collecting your data when Google's code loads on our page and for passing them to Google, we and Google are joint controllers (Art. 26 GDPR). Everything Google does with the data afterwards is Google's sole responsibility. You can exercise your rights with us or with Google. Data may go to Google LLC in the USA. This is based on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified. More in Google's privacy policy at policies.google.com/privacy and at policies.google.com/technologies/partner-sites.

As soon as the results page opens, your browser loads Google's ad code and Google's consent banner from Google's servers. Google receives your IP address, details of your browser and device (such as type, language, screen size) and the address of the page before you choose in the banner. Without consent, Google sets no cookies for advertising and shows only limited, non-personalised ads. Google processes these data for that too, for example to detect fraud.
Legal basis: for passing on your IP address when Google's code loads, Art. 6(1)(f) GDPR, our interest in funding Subletty through ads and in being able to ask for your consent. Loading the banner and storing your choice are strictly necessary for this (Section 25(2) no. 2 TDDDG).

With your consent, Google may store and read cookies and similar identifiers in your browser to select and personalise ads, measure them and detect fraud. The banner shows the exact purposes and partners. It follows the IAB Europe standard TCF 2.2.
Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

What Google's code can read on the page. Google's code runs in the results page itself and can read everything on it: the page address with the details of your search, such as period and budget, the public results and what you type above the results under “Change search”. If you search with a city or a district, the address also holds its name, its rough location (a hexagonal cell about 500 m across) and the radius, never a typed address or street. While you are signed in, Google's code runs on the results page next to your sign-in. The page itself then holds no details of your account, only whether you saved results. We ourselves pass nothing to Google: no account ID, no email address and no search details.

Withdrawal. Under “Cookie settings” in the footer of every page you can change your choice at any time and withdraw your consent for the future, as easily as you gave it. The link takes you to the search and opens Google's banner there, whether you are signed in or not.

3. Account and sign-in

Sign-in by email. We send you a code and a link, valid for 15 minutes. Your account is created with the first confirmation. We store your email address, an account ID and timestamps. We store the code only as a check value.

Sign-in with Google or Apple. If you choose this option, Google or Apple see that you sign in with them. We only receive and store your email address and an identifier from the provider. Google (Google Ireland Limited) and Apple (Apple Distribution International Ltd.) process your data as independent controllers.

Sessions. A sign-in stays valid for at most 90 days, and ends earlier after 30 days without use. For this we store neither your IP address nor a device identifier. Under “Where you are signed in” you can end sessions.

Sign-in log. Every successful sign-in is kept in our security log for 12 months, with account ID and time, without IP address (section 10).

Settings. We store your switches for emails and for showing your number, as well as the time and version of your acceptance of the terms of use and of your acknowledgement of this privacy policy.

Legal basis: Art. 6(1)(b) GDPR, for the sign-in log point (f). Accounts without a confirmed mobile number and without listings, photos and conversations are deleted automatically after 7 days, including saved listings.

4. Mobile number

To publish, write messages and see numbers, you confirm a mobile number once with an SMS code. We store the number and the time of confirmation. A number belongs to exactly one account; this protects against multiple accounts and fraud.

Nobody sees your number, not even moderators. Other confirmed users only see it if you turn on “Show the number at your listings” and they tap “Show number”. We log every time it is shown, with the account that asked, the listing and the time, never with the number. You do not find out who looked at it.

Legal basis: Art. 6(1)(b) and (f) GDPR; sharing it with others is based on consent under point (a). You can withdraw it at any time with the same switch.

5. Name, profile and what others see

After confirmation you get a generated name, for example “Birke 4821”. You can change it once every 30 days. We do not store old names.

No other user sees your email address. Profiles are blocked for search engines.

6. Listings and photos

We store the details of your listing: period, price, features, description, private or commercial, the rough location as a hexagonal cell about 500 m across, and “district, city”, and your choice “Findable on Google & co.”. We do not store the exact address. Active listings are public and can be found by search engines unless you switch that off for a listing. Then we ask search engines not to include the listing, and it is not in our sitemap. Search engines only notice after a few days. The link to the listing keeps working. If you pause or delete a listing or we remove it, it can no longer be accessed right away. It disappears from our list for search engines (sitemap) within an hour at the latest, as does a listing whose period is over. Search engines may still show it for a while until they fetch the page again.

If someone shares the link to an active listing, for example in a messenger, that service fetches a preview from us: title, district and city, period, price and the first photo. These are only details that are public anyway. What the service does with it and how long it keeps the preview is up to that service, even after the listing has been deleted.

If moderation removes a listing, we also delete its photos.

You upload photos to a private storage area. We convert them and remove all metadata in the process, including GPS data. We delete the original after 24 hours at the latest. The finished images are stored under an address that cannot be guessed and can remain in browsers and caches for up to one year.

Legal basis: Art. 6(1)(b) GDPR. Listings and photos stay until you delete them.

Buying a highlight

While we offer it, you can buy a highlight of your own listing (Terms of Use, section 2).

What we store. For each order we store a random order number, the listing, your account, price and duration, the version of the Terms of Use you ordered under, the language you ordered in (for the order confirmation), the time, the state of the order (open, paid, to be refunded, refunded, expired), the IDs of the payment session and of the payment at Stripe, and when we sent you the order confirmation. Of Stripe's notifications we only store their ID, so that we never process one twice. We do not store your payment details, your name, your address or the email address you enter at Stripe. If we cannot start a paid highlight and have to refund it, we note this in the security log, without content.

Order confirmation. After every paid purchase we send you an order confirmation to the email address of your account: order number, listing, start and end, price, withdrawal information, model withdrawal form and the Terms of Use. It contains no phone number and no location. If you have deleted your account in the meantime, we send none.

Refund. If we refund (Terms of Use, section 2, “Refund”), we store the amount, reason, state, the ID of the refund at Stripe, who triggered it and when, and note it in the security log. For this we only pass on to Stripe the ID of the payment, the amount and our ID of the refund.

Impressions. We count how often a highlight was delivered in the search: one number per highlight and day. For this we store no cookies, no IP address, no session, no account ID and no details of your browser. The number has no link to you.

What Stripe receives from us. To pay, we send you on to Stripe. We only pass on the order number, price, duration, the language and the addresses of our pages Stripe sends you back to, and for a refund the details above. Stripe does not receive your account ID, your email address or the listing from us.

What Stripe collects itself. On the payment page you enter your details directly at Stripe, for example your email address and payment details, depending on the payment method also name, country and billing address. Stripe also sees your IP address and details of your device. Stripe sends you the receipt for the payment.

Who Stripe is. Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your data to handle the payment, prevent fraud and meet its own legal obligations, for example against money laundering, and does so as an independent controller. Data may be transferred to Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses of the EU Commission apply. More in Stripe's privacy policy at stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR, for the order confirmation point (c) in conjunction with Section 312f(2) BGB, for keeping the orders and refunds point (c) in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB), for the note in the security log point (f). Counting impressions involves no personal data.

How long. We keep orders, refunds and the IDs of Stripe's notifications for up to eight years after the end of the year of the order, because commercial and tax law require this for accounting records. If you delete the listing or your account, the order stays without any link to the listing or the account.

Withdrawing from a contract

With the button “Withdraw from contract” (Terms of Use, section 10), anyone can withdraw from the purchase of a highlight, even without an account.

What we store. Your name, the order number, your email address, the time of receipt and the state of the withdrawal (open, refunded, rejected with a reason). We do not ask for a reason for the withdrawal. We store the withdrawal even if we do not know the order number. If you name an order number we know, we link the withdrawal to that order.

What for. We process the withdrawal, refund under the Terms of Use and can prove it later. So that nobody can end a highlight with someone else's order number, our server compares the email address entered with the address of the account the order belongs to. You do not see the result. We immediately send an acknowledgement of receipt with your details and the time to the address entered, with the same text for known and unknown order numbers. Against abuse we limit the number of withdrawals per IP address and per email address using check values, as under “Protection against abuse” in section 2. Name, email address and IP address are not in our logs.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Sections 355, 356a and 357a BGB, for the comparison with the account address and protection against abuse point (f).

How long. If we cannot match a withdrawal to an order, we delete name and email address after 90 days. Otherwise we keep the withdrawal as long as the order.

7. Messages and blocking

We store your messages, senders and timestamps. Messages also contain information about the other person, which we receive from the person writing. When a message is sent, a fixed word list checks it for typical fraud patterns. If something matches, the recipient sees a warning. Nothing is blocked, and no AI decides anything.

We delete conversations automatically 12 months after the last message. You cannot delete them yourself. If you block someone, we store who blocked whom and when, until you lift the block.

Legal basis: Art. 6(1)(b) GDPR, for retention, warnings and blocking point (f) (protection against fraud and harassment).

8. Reporting, moderation, suspension

Reporting. We store the target, the reason, your text, your name if you choose to give it and, if you are signed in, your account ID. Without an account you can also give an email address for our reply. The reported person never learns who reported them. We receive the reasons and text of the report from the person reporting.

Moderation. Reports are currently reviewed by the operator. They only see what belongs to the report: the reported listing with photos; for a message, that message and up to ten previous ones; for the account, name and status; for profile reports also the month of sign-up, the number of listings and earlier decisions. Every access is logged. We explain our decisions by email.

Suspension. When an account is suspended, all sessions end, your listings are removed and conversations are closed. So that no new account can be created with the same number, we also keep a check value of your mobile number for 24 months from the suspension (a hash created with a secret key, from which the number cannot be recovered). The number itself stays in the suspended account until you ask us to delete it. We delete your account if you ask us to; after that only the check value remains, until the 24 months are over.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of the Digital Services Act, otherwise point (f). We delete reports and decisions 12 months after they are closed, suspension decisions only when the suspension ends.

9. Emails and text messages

We do not send newsletters and do not track whether you open emails.

Legal basis: Art. 6(1)(b) GDPR; for matching listings your consent (point (a)), which you can withdraw at any time in your account.

10. Security log, contact and operator access

Security log. We log for 12 months: sign-ins, number confirmations, times a number is shown, moderation access and decisions, suspensions, name changes, paid highlights we have to refund, the receipt of withdrawals and refunds. These entries never contain email addresses, numbers, IP addresses or message texts.
Legal basis: Art. 6(1)(f) GDPR, traceability and security.

Contact. If you write to us by email or through the contact form, we process your address, your message and, if given, your name in order to handle your request. Legal basis: Art. 6(1)(b) GDPR, for requests about your rights point (c).

Operator access. The operator can technically read all data. They only do so for security incidents, for orders from authorities and to handle your requests. If there are signs of a threat to life or limb, we inform the police.

11. Who else receives data

We have data processing agreements with the host, Cloudflare, Resend, seven.io and Apple. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. Authorities only receive data under a legally binding order or if, under Art. 18 of the Digital Services Act, we report a suspected criminal offence involving a threat to life or safety (Art. 6(1)(c) GDPR). We do not sell data. We ourselves pass nothing to Google for ads. What Google's code reads on the results page of the search is described in section 2.

12. How long we keep data

Backups. We back up the database daily, encrypted, to Cloudflare R2 in the EU, separate from our server. Only we hold the key. Deleted data, including deleted accounts, remains there for up to about five weeks until the backup is overwritten. We only use backups to restore after an outage.

13. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future.

Right to object: You can object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interest (point (f)) (Art. 21 GDPR). We then no longer process the data, unless we have compelling grounds, for example to prevent fraud.

How it works: You can do a lot yourself, for example delete listings, change your name, end sessions and turn off emails. Access, deleting your account and changing your email address are handled on request. To do so, write to [email protected] from the address of your account. We reply within one month and usually delete your account within 30 days. In doing so we also delete your conversations, so the other person can no longer see them either.

Complaint: You can lodge a complaint with a data protection supervisory authority, for example the one responsible for us in North Rhine-Westphalia.

14. Cookies and browser storage

We only store in your browser what is strictly necessary for Subletty to work (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We do not ask for this.

Ads in the search. If ads are switched on, a consent banner from Google asks in the search (section 2). Google then sets these entries on our domain and its own domains. The list and the periods come from Google and may change. They are currently listed at business.safety.google/adscookies.

15. Other

No automated decisions. All moderation decisions are made by a human. The order of results depends only on the details of the listings and your search (Terms of Use, section 2, “Order of results”). Above the results, the first page shows at most three marked, highlighted listings in random order, chosen by Subletty or paid for; this does not change the order of the results.

18 and over. Subletty is meant for adults. If we learn that an account belongs to a minor, we delete it.

Changes. If we change this policy significantly, we inform you by email in advance. The current version is always available at /datenschutz, in German and English.