Privacy Policy

Who we are

FlexRoom is run by ALPHAWIN INC., “[ADDRESS]”, Canada. The person responsible for privacy is our Privacy Officer, who can be reached at privacy@flexroom.ca.

What we collect

• •Account: your name, email address and a password (stored only in scrambled form). Staff accounts also use a two-step verification code.
• •Phone (optional): if you choose to verify a phone number, we store the number and the fact that it was confirmed.
• •ID verification (optional, paid): the check is done by Stripe. We receive the result (passed, failed, and a short reason code) and the payment record. We do not receive or store your ID document, your selfie or your card number.
• •Listings: what you write about a room, its price, city, neighbourhood and the photos you upload.
• •Roommate profile (only if you choose to list yourself): your first name, city, budget, move-in date, a short text, a few tags and an optional photo. This profile is public. A photo of a person is checked automatically like listing photos, and a person may look at it before it is shown.
• •Messages: what you and another member write to each other. Only the two of you can read a conversation, except that a member of our team may read it when a report, a safety concern, a support request or a legal duty makes it necessary. Only administrators may do so, each time with a written reason and a case number, and every access is recorded in a log that cannot be changed.
• •Reports of a conversation: if you report a conversation with the red flag, we keep a copy of its most recent messages (up to 200) with your report. By sending the report you agree to share that copy with us. Only administrators can read it, each reading is recorded, and we do not tell the other person who reported them. We keep the copy as long as needed to deal with the report and what follows. “[RETENTION PERIOD: TO BE CONFIRMED WITH A LAWYER.]”
• •Saved homes, reports you file, and support requests you send us.
• •Alerts: if you ask for email alerts about new rooms, your email address and the city you chose.
• •Technical information: the times you sign in, your IP address and browser type (kept with your sessions for security), and records of errors on the site.
• •Sign-up details: when you create an account we keep, once, the year of birth (we ask for your full date of birth to check that you are 18 or older, and keep only the year), the country, province and city your connection appears to come from, the kind of device and browser you used, and how you arrived (the campaign tags on the link you followed, the website you came from and the first page you opened).
• •Approximate location: our host tells us the country, province and city your connection appears to come from, so we can suggest a city or the French site. Apart from the sign-up details above, we do not store it. If you allow location in your browser, your city choice is kept in your own browser.
• •Visit counts: to see which pages are used, we count page views with PostHog. It works without cookies and stores nothing on your device. It receives the address of the page, the page you came from, your screen size, browser type and approximate location. Your IP address is used for a moment to tell one visitor from another during a single day and is not kept. These counts are not linked to your account.

Why we use it

• •To run your account, show your listings, deliver your messages and send the emails you asked for.
• •To keep people safe: checking listings and photos, handling reports (including reading the messages concerned when needed), limiting abuse and blocking accounts that break the rules.
• •To answer support requests and fix problems.
• •We do not sell personal information, and we do not use it for advertising.

Automatic checks

Every listing photo is checked automatically before it is stored: one check looks for content that is not allowed, another checks that the picture shows a room or a home. A photo can be refused by these checks. A listing whose photos are in doubt is reviewed by a person. If you think a photo was refused by mistake, contact us: a person will look at it again, and you can ask what information the check used.

Who we share it with

• •Companies that work for us and only handle the information to provide their service: Cloudflare (website hosting, protection against robots, the automatic room-photo check), Neon (database), Stripe (payments and ID verification), Twilio (text messages for phone verification), Resend (email), OpenAI (the automatic check of photo content), PostHog (visit counts, stored in the United States) and Sentry (reports of errors in your browser: the error, the page address, the browser type and approximate location, stored in Germany).
• •Other members: your first name and last initial, your listings and your verified badges are visible to people using the site. Your email address and phone number are not shown to other members.
• •Authorities (for example the police), when the law requires it or to prevent serious harm.

Where it is stored

Our database and photo storage are located in the United States, and our service providers may process information in other countries. Information stored outside Canada can be accessed by courts and authorities of those countries under their laws.

How long we keep it

We keep your information while your account is open. When you delete a listing, its photos are deleted with it. The record of actions taken by our staff is kept and cannot be edited. When you delete your account it is closed at once and deleted 30 days later. We then keep, for 2 years, a separate safety record: your name and email, your support requests, reports you sent or that were made about you, notes our team wrote and any ban. It is used only for safety, disputes and legal requests, only admins can open it, and it is deleted after 2 years unless the law or an ongoing investigation requires us to keep it longer. “[TO BE CONFIRMED WITH A LAWYER.]”

How we protect it

We protect personal information with measures that fit how sensitive it is: connections to the site are encrypted, passwords are stored only in scrambled form, staff access is limited by role and protected by two-step verification, and what staff do is recorded. No system is perfectly secure. If you think your account was compromised, change your password and write to privacy@flexroom.ca.

If something goes wrong

If a security incident involving your personal information creates a real risk of serious harm, we will tell you and the privacy authorities as the law requires, and we keep a record of every incident. “[TO BE CONFIRMED WITH A LAWYER.]”

Other websites

Listings and messages may contain links to other websites. We do not control them and this policy does not apply to them.

Your choices and rights

• •You can change your name and password, archive or delete your listings, and stop email alerts with the link in every alert.
• •You can delete your account yourself at any time (My account, then “Delete my account”; see the page “Delete your account”). You can also ask to see the personal information we hold about you, have it corrected or withdraw your consent, by writing to privacy@flexroom.ca or support@flexroom.ca. We answer within 30 days.
• •If you live in Québec you can also ask to receive your computerized personal information in a structured, commonly used format, or have it passed to another organisation, and ask us to stop sharing, or to de-index, personal information in the cases the law allows. “[SCOPE TO BE CONFIRMED WITH A LAWYER.]”
• •If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.

Children

FlexRoom is meant for adults. You must be at least 18 to open an account. We ask for your date of birth when you sign up and refuse an account if you are under 18.

Changes

If we change how we handle personal information, we will update this page and its date, and tell members about important changes.