Privacy Policy

Last updated: March 2026 · Version 1.0

1. Data Controller

The controller responsible for the processing of your personal data under the General Data Protection Regulation (GDPR) is:

Mikhail Mikhalev
Sole proprietor (Einzelunternehmer), operating as FlatHunt
Bundesallee 195, 10717 Berlin, Germany
Email: hello@flat-hunt.com
Phone: +49 176 6166 0319

2. Data We Collect

2.1 Account Data

When you register, we collect your email address and, optionally, your name. This data is necessary to create and manage your account and to deliver the service.

Passwordless login (email code). When you sign in by email, we send a one-time 6-digit verification code to your email address via our transactional email provider (Resend). We temporarily store a hashed version of the code with a lifetime of up to 15 minutes and delete it once the code is used or expires. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Sign-in with Google. If you choose «Continue with Google», Google LLC transmits to us your basic profile information (email address, name and profile picture) solely to create or authenticate your FlatHunt account. We do not receive your Google password or other account data. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). For more information see Google’s Privacy Policy.

2.2 Search Preferences and Filters

We store the search criteria you define (district, budget, move-in date, apartment size, etc.) to run your saved alerts and send you matching listings.

2.3 Notification Data

If you connect a Telegram account, we store your Telegram username and chat ID solely to send you apartment alert messages via the Telegram Bot API. Email notifications use your registered email address.

2.4 Payment Data

Subscription payments are processed by Stripe, Inc. We do not store your full card details. We receive and store transaction identifiers, subscription status, and billing history for accounting and support purposes.

Stripe itself acts as an independent controller for payment data and, in connection with the checkout process, typically collects: your name, email address, the last four digits and brand of your card (or other payment method identifier), the country of issuance, the billing address you provide and your IP address. Stripe uses this data for fraud prevention, payment processing and compliance with its own legal obligations. Please see Stripe’s Privacy Policy for details.

2.5 Usage and Technical Data

We may collect data about how you interact with the platform (pages visited, features used) and technical data such as IP address, browser type, and device type. Server access logs (including IP address and user-agent) are kept for up to 30 days for security, abuse prevention and to ensure the stability of our service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

2.6 Analytics Data (with consent only)

If you accept analytics cookies, we use Google Analytics 4 to collect aggregated usage statistics. This may include pages visited, session duration, and general geographic region. Your full IP address is anonymised before storage. You can withdraw consent at any time via the Cookie Settings link in the footer.

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

  • Performance of a contract (Art. 6(1)(b)): account creation, delivery of apartment alerts, payment processing, and subscription management.
  • Legitimate interests (Art. 6(1)(f)): security, fraud prevention, service stability, and aggregate service improvement (where consent is not required).
  • Consent (Art. 6(1)(a)): analytics and marketing cookies/tracking. You may withdraw your consent at any time by changing your Cookie Settings.
  • Legal obligation (Art. 6(1)(c)): retention of accounting and payment records as required by German commercial law (HGB §257, AO §147).

4. Cookies and Tracking Technologies

The storage of information on, and access to information already stored on, your end device (e.g. cookies, local storage) is governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG) in conjunction with Art. 6(1)(a) GDPR. Storage and access that is strictly necessary to provide a service expressly requested by you does not require your consent (§ 25(2) No. 2 TDDDG); all other use of cookies and comparable technologies takes place only on the basis of your prior consent, which you may withdraw at any time with effect for the future.

4.1 Essential Cookies

Essential cookies are required for the service to function. They manage your authentication session and remember your preferences (e.g. cookie consent choice). They are set without your consent as they are strictly necessary.

4.2 Analytics Cookies (Google Analytics 4)

With your consent, we use Google Analytics 4 to understand how visitors use FlatHunt. Google Analytics sets cookies that collect anonymised usage data and transmits it to Google servers. IP anonymisation is enabled. Google may transfer this data to the United States — such transfers are covered by the EU–US Data Privacy Framework or Google's Standard Contractual Clauses.

You can opt out of Google Analytics by declining analytics cookies or by installing the Google Analytics opt-out browser add-on.

4.3 Marketing Cookies

We may use marketing cookies (with your consent) for remarketing purposes. Currently no marketing cookies are active unless you explicitly accept them.

4.4 Managing Cookies

You can change your cookie preferences at any time using the Cookie Settings link in the footer of this website. You can also configure your browser to block or delete cookies, though this may affect service functionality.

5. Third-Party Service Providers

We share your data only where necessary with the following trusted service providers, each acting as a data processor under appropriate safeguards:

  • Stripe, Inc. (payment processing) — Privacy Policy. Data may be transferred to the USA under the EU–US Data Privacy Framework.
  • Telegram Messenger Inc. — your Telegram chat ID and username are shared with the Telegram Bot API solely to deliver your apartment alerts. Privacy Policy.
  • Google LLC (Google Sign-In) — when you choose «Continue with Google» on our login page, we receive your basic profile information (email address, name and profile picture) from Google solely to create or authenticate your FlatHunt account. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Privacy Policy.
  • Google LLC (Google Analytics 4) — only if you have accepted analytics cookies. Privacy Policy.
  • Resend, Inc. (transactional email delivery) — used to send account-related and alert emails on our behalf. Privacy Policy. Data may be transferred to the USA under the EU–US Data Privacy Framework.
  • Hosting provider — we use a managed cloud platform to run the application and store data; processing takes place on servers in the European Economic Area (EEA) or in regions with an adequate level of protection (including appropriate safeguards where applicable).

We do not sell your personal data to any third party.

6. Data Retention

  • Account and preference data: retained for as long as your account is active. You may request deletion at any time.
  • Payment and billing records: retained for 10 years as required by German commercial law (HGB §257).
  • Analytics data: retained by Google Analytics for up to 14 months.
  • Technical logs: retained for up to 30 days for security purposes.

7. Your Rights under GDPR

As a data subject, you have the following rights, which you can exercise by contacting us at hello@flat-hunt.com:

  • Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy of it.
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17): request deletion of your personal data where there is no overriding legal basis to retain it.
  • Right to restriction of processing (Art. 18): request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format and transfer it to another controller.
  • Right to object (Art. 21): object to processing based on legitimate interests (Art. 6(1)(f)).
  • Right to withdraw consent (Art. 7(3)): withdraw consent for analytics or marketing cookies at any time via Cookie Settings without affecting prior processing.

We will respond to your request within 30 days. We may need to verify your identity before processing your request.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Website: www.datenschutz-berlin.de

9. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA), in particular in the United States (Stripe, Google, Resend). Whenever personal data is transferred to a third country, we ensure that an adequate level of protection is in place by relying on one of the following safeguards under Chapter V GDPR:

  • an adequacy decision of the European Commission, including the EU–US Data Privacy Framework (for certified US recipients);
  • the European Commission’s Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures;
  • your explicit consent for the specific transfer pursuant to Art. 49(1)(a) GDPR, where applicable.

You may request a copy of the relevant safeguards by contacting us at hello@flat-hunt.com.

10. Automated Decision-Making and Profiling

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The matching of listings against your saved search criteria is a purely technical filter and does not constitute such automated decision-making.

11. Data Protection Officer

A Data Protection Officer is not required under § 38 BDSG (Bundesdatenschutzgesetz) and has therefore not been appointed. For all data protection matters please contact us directly at hello@flat-hunt.com.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data in transit is encrypted via TLS. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

13. Children's Privacy

FlatHunt is not directed at persons under the age of 18. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy on this page and updating the "Last updated" date above. We recommend reviewing this page periodically.

15. Contact

For questions, data access requests, or any privacy-related concerns, please contact us:

Mikhail Mikhalev / FlatHunt
Email: hello@flat-hunt.com
Address: Bundesallee 195, 10717 Berlin, Germany

16. Language Versions

This Privacy Policy may be provided in multiple language versions. To the extent permitted by applicable law, the English version prevails in case of inconsistencies. Mandatory data protection rights under applicable law remain unaffected.