Privacy Policy

Last updated: August 2026 · Version 2.2

1. Data Controller

The controller responsible for the processing of your personal data under the General Data Protection Regulation (GDPR) is:

Mikhail Mikhalev
Sole proprietor (Einzelunternehmer), operating as FlatHunt
Bundesallee 195, 10717 Berlin, Germany
Email: hello@flat-hunt.com
Phone: +49 176 6166 0319

2. Data We Collect

2.1 Anonymous and Unregistered Use

You may browse FlatHunt's marketing pages and use search features without creating an account. In that case we do not require registration data. We may still process technical data as described in section 2.5 (for example IP address in server logs) and, with your consent, analytics data as described in section 2.6. Search filters you set while not signed in may be stored temporarily on your device (for example in browser storage) or transmitted to our servers to display results; they are not linked to an account unless you register and choose to save them.

2.2 Account Data

Creating an account is optional. When you register, we collect your email address and, optionally, your name. This data is necessary to create and manage your account and to deliver account-based features (such as saved searches and alerts).

Passwordless login (email code). When you sign in by email, we send a one-time 6-digit verification code to your email address via our transactional email provider (Resend). We temporarily store a hashed version of the code with a lifetime of up to 15 minutes and delete it once the code is used or expires. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Sign-in with Google. If you choose «Continue with Google», Google LLC transmits to us your basic profile information (email address, name and profile picture) solely to create or authenticate your FlatHunt account. We do not receive your Google password or other account data. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). For more information see Google’s Privacy Policy.

2.3 Search Preferences and Filters

If you save searches or set preferences while signed in, we store the search criteria you define (district, budget, move-in date, apartment size, etc.) to run your saved alerts and send you matching listings.

2.4 Notification Data

If you connect a Telegram account, we store your Telegram username and chat ID solely to send you apartment alert messages via the Telegram Bot API. Email notifications use your registered email address.

2.5 Usage and Technical Data

We may collect data about how you interact with the platform (pages visited, features used) and technical data such as IP address, browser type, and device type. Server access logs (including IP address and user-agent) are kept for up to 30 days for security, abuse prevention and to ensure the stability of our service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

2.6 Analytics Data (with consent only)

If you accept analytics cookies, we use Google Analytics 4 to collect aggregated usage statistics. This may include pages visited, session duration, and general geographic region. Your full IP address is anonymised before storage. You can withdraw consent at any time via the Cookie Settings link in the footer.

2.7 Partner Enquiry Data

When you submit a housing request, we collect the information you provide so a FlatHunt operator can review the request, contact you, and identify suitable accommodation across selected providers. Where needed to handle your request, and in line with the permission shown in the form, we may share relevant enquiry data with selected accommodation providers.

This may include your name, email address, phone number, selected listing or property ID, move-in date, budget, household size, preferred areas, university, desired rental duration, housing preferences, and your message or introduction.

A request is not automatically sent to every provider. A FlatHunt operator selects only the provider or providers considered relevant to the request. A provider that receives the enquiry processes it as an independent controller for its own enquiry and booking process and may contact you directly.

2.8 No Current Payment Processing

FlatHunt does not currently process subscription or payment card data. We do not use a payment provider for the free service described in our Terms of Service.

If optional paid features are introduced in the future, we will update this Privacy Policy before collecting payment-related data and inform you about the payment provider and categories of data processed.

If historical accounting or billing records exist from previously offered paid features, such records may be retained for up to 10 years where required by German commercial and tax law (HGB §257, AO §147). Legal basis: Art. 6(1)(c) GDPR.

2.9 AI Assistant Data

If you use the FlatHunt AI Assistant, we process dialogue and related technical data as described in detail in section 6 (AI Assistant).

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

  • Performance of a contract (Art. 6(1)(b)): account creation and management, delivery of apartment alerts and other account-based features you request.
  • Legitimate interests (Art. 6(1)(f)): security, fraud prevention, service stability, and aggregate service improvement (where consent is not required); providing anonymous search functionality and related technical processing.
  • Consent (Art. 6(1)(a)): analytics and marketing cookies/tracking. You may withdraw your consent at any time by changing your Cookie Settings.
  • Consent (Art. 6(1)(a)): where the housing request form expressly asks for permission to share a provider-neutral request with selected accommodation providers. You may withdraw this consent at any time by contacting us; withdrawal does not affect processing carried out before withdrawal.
  • Legal obligation (Art. 6(1)(c)): retention of accounting records where applicable under German commercial and tax law (HGB §257, AO §147).
  • Steps prior to entering into a contract or user-requested enquiry handling (Art. 6(1)(b)): when you ask us to send your accommodation enquiry to a partner provider.
  • Legitimate interests (Art. 6(1)(f)): keeping records of partner enquiry submissions for service operation, troubleshooting, fraud prevention, partner attribution, and commission tracking.

4. Cookies and Tracking Technologies

The storage of information on, and access to information already stored on, your end device (e.g. cookies, local storage) is governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG) in conjunction with Art. 6(1)(a) GDPR. Storage and access that is strictly necessary to provide a service expressly requested by you does not require your consent (§ 25(2) No. 2 TDDDG); all other use of cookies and comparable technologies takes place only on the basis of your prior consent, which you may withdraw at any time with effect for the future.

4.1 Essential Cookies

Essential cookies are required for the service to function. They manage your authentication session when you are signed in and remember your preferences (e.g. cookie consent choice). They are set without your consent as they are strictly necessary.

4.2 Analytics Cookies (Google Analytics 4)

With your consent, we use Google Analytics 4 to understand how visitors use FlatHunt. Google Analytics sets cookies that collect anonymised usage data and transmits it to Google servers. IP anonymisation is enabled. Google may transfer this data to the United States — such transfers are covered by the EU–US Data Privacy Framework or Google's Standard Contractual Clauses.

You can opt out of Google Analytics by declining analytics cookies or by installing the Google Analytics opt-out browser add-on.

4.3 Marketing Cookies

We may use marketing cookies (with your consent) for remarketing purposes. Currently no marketing cookies are active unless you explicitly accept them.

4.4 Managing Cookies

You can change your cookie preferences at any time using the Cookie Settings link in the footer of this website. You can also configure your browser to block or delete cookies, though this may affect service functionality.

5. Third-Party Service Providers

We share your data only where necessary with the following trusted service providers, each acting as a data processor under appropriate safeguards (unless stated otherwise as an independent controller):

  • Telegram Messenger Inc. — your Telegram chat ID and username are shared with the Telegram Bot API solely to deliver your apartment alerts. Privacy Policy.
  • Google LLC (Google Sign-In) — when you choose «Continue with Google» on our login page, we receive your basic profile information (email address, name and profile picture) from Google solely to create or authenticate your FlatHunt account. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Privacy Policy.
  • Google LLC (Google Analytics 4) — only if you have accepted analytics cookies. Privacy Policy.
  • Resend, Inc. (transactional email delivery) — used to send account-related and alert emails on our behalf. Privacy Policy. Data may be transferred to the USA under the EU–US Data Privacy Framework.
  • Hosting provider — we use a managed cloud platform to run the application and store data; processing takes place on servers in the European Economic Area (EEA) or in regions with an adequate level of protection (including appropriate safeguards where applicable).
  • OpenAI Ireland Limited — processes AI Assistant prompts, context and model outputs via the OpenAI API as a processor on our behalf. See section 6 (AI Assistant) and OpenAI’s Privacy Policy.

We do not sell your personal data to any third party.

Partner Accommodation Providers

If you submit a housing request, a FlatHunt operator may share the relevant enquiry data with one or more selected accommodation providers when this is needed to find suitable housing and is covered by the permission shown in the request form. These providers process your data as independent controllers and are responsible for their own handling of the enquiry after receiving it.

Current partner providers may include Amber Internet Solutions Inc. / Amberstudent, Uniplaces, and other accommodation providers presented through FlatHunt. The actual recipient depends on the request and the available suitable housing.

Partner providers may process your data outside the European Economic Area (EEA). Where required, we rely on appropriate safeguards or the partner provider's applicable data protection commitments for EU user data.

You should also review the relevant partner provider's privacy policy before submitting an enquiry.

6. AI Assistant

FlatHunt offers an optional AI Assistant that helps you search and compare FlatHunt listings in a conversational interface. When you use this feature, you interact with an AI system. The AI Assistant only assists with search and comparison on FlatHunt. It does not contact landlords, submit applications, conclude contracts, or make decisions about tenant admission.

6.1 Categories of data

When you use the AI Assistant, we may process:

  • your messages, dialogue history and the Assistant’s replies;
  • search parameters derived from the conversation and necessary tool-call results (for example listing identifiers and compact listing facts needed to answer);
  • your FlatHunt account ID (if signed in) or a guest session identifier (if not signed in);
  • timestamps, token usage, model identifier, latency and error codes related to the request;
  • for abuse prevention of guest use, a privacy-preserving HMAC hash of the client IP address (not the raw IP address and not stored as part of the conversation transcript).

Dialogue text is stored in FlatHunt’s database so that authenticated users can continue a conversation linked to their account and guests can continue a conversation linked to their guest session. We do not send dialogue text to Sentry, PostHog, Google Analytics or similar analytics or error-logging products.

6.2 Purposes and legal bases

We process AI Assistant data for the following purposes:

  • Providing the requested AI chat and preserving context — Art. 6(1)(b) GDPR (performance of a contract / steps at your request to provide the feature).
  • Security, abuse prevention, support, debugging and analysis of technical usage (including cost control) — Art. 6(1)(f) GDPR. Our legitimate interests are to protect the service against abuse and automated misuse, ensure stable and secure operation, answer support requests, diagnose technical faults, and understand aggregate technical usage and AI-related costs without using dialogue text to train models.

6.3 Access by FlatHunt administrators

A limited circle of authorised FlatHunt administrators may review conversation content via our admin tools for security, abuse prevention, user support, cost analysis and technical debugging, and only for those purposes.

6.4 OpenAI as processor / recipient

To generate replies, messages and necessary context are transmitted to OpenAI Ireland Limited via the OpenAI API, which processes this data as our processor. Processing may involve transfers of personal data outside the EEA. Where such transfers occur, they take place under OpenAI’s Data Processing Addendum (DPA), the European Commission’s Standard Contractual Clauses (SCC) and/or applicable adequacy decisions. We do not claim that OpenAI processing occurs exclusively in the EU/EEA.

Voluntary sharing of API inputs and outputs with OpenAI for model improvement is disabled for our API use. FlatHunt does not use production AI Assistant dialogues to train models. We also configure API calls so that OpenAI does not retain Responses API application state for our requests. OpenAI may still apply its own limited abuse / security processing under the DPA and applicable product terms.

6.5 Retention

Full conversation text is retained for a maximum of 90 days from the conversation’s creation and is then deleted automatically, unless a specific conversation must be retained longer to investigate a concrete incident or to comply with a legal obligation. Pseudonymised or aggregated technical metrics that do not contain dialogue text (for example token counts, cost, latency and error classes) may be retained longer for security, capacity and cost analysis.

6.6 Your rights and deletion requests

In addition to the rights in section 8, for AI Assistant processing you may request access, deletion or restriction, and you may object to processing based on Art. 6(1)(f) GDPR. You also have the right to lodge a complaint with a supervisory authority (section 9).

To request deletion of a dialogue, use the in-app account / chat controls where available, or contact us at hello@flat-hunt.com and include your conversation ID and/or guest session ID if you are not signed in.

6.7 No Art. 22 automated decisions

The AI Assistant does not perform automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR. Its outputs are informational search recommendations only; rental decisions remain with you and the relevant provider or landlord.

6.8 What not to send

Please do not send names of other people, contact details, identity documents, payment credentials, special-category data (Art. 9 GDPR) or other people’s personal data in the AI Assistant. Such information is not required for apartment search assistance.

7. Data Retention

  • Account and preference data: retained for as long as your account is active. You may request deletion at any time.
  • Historical accounting records (if any): where records from previously offered paid features exist, retained for up to 10 years as required by German commercial and tax law (HGB §257, AO §147).
  • Analytics data: retained by Google Analytics for up to 14 months.
  • Technical logs: retained for up to 30 days for security purposes.
  • Partner enquiry records: retained for as long as necessary to process the enquiry, handle support requests, maintain partner attribution, and comply with accounting or legal obligations. We delete or anonymise enquiry records when they are no longer needed for these purposes.
  • AI Assistant dialogues: full conversation text is retained for a maximum of 90 days and then deleted automatically, subject to the exceptions in section 6. Pseudonymised or aggregated technical usage metrics without dialogue text may be retained longer.

8. Your Rights under GDPR

As a data subject, you have the following rights, which you can exercise by contacting us at hello@flat-hunt.com:

  • Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy of it.
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17): request deletion of your personal data where there is no overriding legal basis to retain it.
  • Right to restriction of processing (Art. 18): request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format and transfer it to another controller.
  • Right to object (Art. 21): object to processing based on legitimate interests (Art. 6(1)(f)).
  • Right to withdraw consent (Art. 7(3)): withdraw consent for analytics or marketing cookies at any time via Cookie Settings without affecting prior processing.

We will respond to your request within 30 days. We may need to verify your identity before processing your request.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Website: www.datenschutz-berlin.de

10. International Data Transfers

Some of our processors and partner accommodation providers are located or operate outside the European Economic Area (EEA), including in the United States and, where applicable, India (e.g. Google, Resend, and partner accommodation providers such as Amber). Whenever personal data is transferred to a third country, we ensure that an adequate level of protection is in place by relying on one of the following safeguards under Chapter V GDPR:

  • an adequacy decision of the European Commission, including the EU–US Data Privacy Framework (for certified US recipients);
  • the European Commission’s Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures;
  • your explicit consent for the specific transfer pursuant to Art. 49(1)(a) GDPR, where applicable.

You may request a copy of the relevant safeguards by contacting us at hello@flat-hunt.com.

11. Automated Decision-Making and Profiling

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The matching of listings against your saved search criteria is a purely technical filter and does not constitute such automated decision-making. AI Assistant recommendations are assistive search outputs only (see section 6) and likewise do not constitute Art. 22 automated decision-making.

12. Data Protection Officer

A Data Protection Officer is not required under § 38 BDSG (Bundesdatenschutzgesetz) and has therefore not been appointed. For all data protection matters please contact us directly at hello@flat-hunt.com.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data in transit is encrypted via TLS. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

14. Children's Privacy

FlatHunt is not directed at persons under the age of 18. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy on this page and updating the "Last updated" date above. We recommend reviewing this page periodically.

16. Contact

For questions, data access requests, or any privacy-related concerns, please contact us:

Mikhail Mikhalev / FlatHunt
Email: hello@flat-hunt.com
Address: Bundesallee 195, 10717 Berlin, Germany

17. Language Versions

This Privacy Policy may be provided in multiple language versions. To the extent permitted by applicable law, the English version prevails in case of inconsistencies. Mandatory data protection rights under applicable law remain unaffected.