Privacy policy

1. Controller

Danylo Prokhorenko, Brigittenauer Lände 224-228, 1200 Vienna, Austria

Email: contact@flatdrop.at · in the bot: /support

We have not appointed a data protection officer.

2. What data we process

• Telegram account data (when you start the bot): Telegram user ID and chat ID, username, first name, the language you choose, time of registration and last activity.
• Account data: feature level with its duration and how it was obtained (e.g. trial, promo code, referral), promo codes used, who referred you and whom you referred, where you came from (start-link parameter), whether you joined our channel (if the bot requires this, Telegram tells us your membership status), reminder flags, digest preferences, block status.
• Saved searches: name, rent or buy, property types, city, districts/postcodes, price and size range, rooms, furnished, move-in date, alert threshold, pause/mute state and your free-text wishes.
• Applicant profile (optional): name, age, occupation, income band, smoker (yes/no), pets, guarantor (yes/no), move-in date and a short self-description. Please do not enter sensitive data (health, religion, ethnic origin etc.) in free-text fields.
• Matches and AI results: which listings matched which search, AI fit score, short reasoning, red-flag warnings, delivery status; AI-drafted application messages you requested (cached per listing).
• Support messages: text and photos you send via /support, our reply, timestamps, your username.
• Usage events: which rate-limited action you used and when (for quotas and abuse protection).
• Technical logs: server logs with timestamps, user IDs and error details.
• Listing data from third parties: the bot reads public listing pages (willhaben.at, immobilienscout24.at, immowelt.at, immobilien.derstandard.at, wg-gesucht.de) and stores title, description, price, size, location hint, photo URLs and link. Listings may contain personal data of advertisers (e.g. an agent's name); see section 5.
• We currently process no payment data, because FlatDrop is free. If we introduce paid features, we will update this policy first.

3. Purposes and legal bases

You are not obliged to provide data, but without a Telegram account and a saved search the service cannot work.

• Running the bot (saving searches, matching, alerts, AI scores and drafts you request, applicant profile, promo codes, referrals, trials): Art. 6(1)(b) GDPR (contract).
• Support requests: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f).
• Abuse prevention, rate limits, security, error logs, backups: Art. 6(1)(f) GDPR (legitimate interest in a secure, stable service).
• Aggregated market statistics (e.g. median rent per district): Art. 6(1)(f) GDPR; statistics contain no user data.
• Public listing pages on the website and collecting public listings: Art. 6(1)(f) GDPR (the interest of home seekers and ours in finding published offers).
• Optional features you switch on (e.g. applicant profile, channel membership check): Art. 6(1)(a) GDPR (consent) where required; withdrawable at any time.

4. Recipients and processors

Transfers outside the EU/EEA: Telegram and some AI providers are located outside the EU/EEA (e.g. USA, UAE). Where no adequacy decision exists (for the USA: only for companies certified under the EU-US Data Privacy Framework), we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For Telegram, which you use on your own initiative, the transfer is also necessary to perform the contract (Art. 49(1)(b) GDPR).

• Telegram delivers all messages. Telegram's own privacy policy applies (telegram.org/privacy).
• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, data centre in Helsinki, Finland (EU/EEA); runs the server, database and backups on our behalf (Art. 28 GDPR).
• AI model providers: to compute a fit score, red flags or an application draft we send the listing text, listing photo URLs, your search criteria and free-text wishes and, for drafts, your applicant profile, never your Telegram ID, username or chat history. Providers (as of 2026-09-20): OpenRouter, Inc. (openrouter.ai, USA) and the model brokers a6api (api.a6api.com) and hdd.sb (ai.hdd.sb), which pass the request on to the respective model provider (among others xAI, OpenAI, DeepSeek). Ask us for the current list.
• Authorities and courts where required by law.

5. Data about advertisers (Art. 14 GDPR)

Listings are collected only from pages the portals publish openly. We do not log into portals and do not contact advertisers. Listing data is used to show the offer to home seekers, in anonymised form for price statistics, and for a public page per current Vienna listing on our website. That page shows only facts about the home (district and postcode, never the address; size, rooms, price), the ad's first photo, loaded directly from the portal's server and not stored by us, a link to the original ad, and a short text and score written by us, never the ad's own text, names, phone numbers or email addresses.

Advertisers can object at any time (see section 8, or the "remove" link on each listing page); we then exclude the listing and take its page down.

6. Retention

• Account, searches, profile, matches, drafts: until you delete them or use /deleteme; searches of users inactive for 45 days are paused, accounts inactive for 24 months are deleted.
• Listings pool (with matches and AI scores): 90 days after the listing was last seen.
• Aggregated price statistics: indefinitely (no personal data).
• Public listing pages: while the listing is online, then marked "taken" and removed 60 days later.
• Usage events: 7 days.
• Support messages: 12 months after the request is closed.
• Referral and promo redemption records: as long as your account exists.
• Record of free days received, after /deleteme (only a pseudonymised hash of your Telegram ID): 24 months from deletion, so the same free days cannot be claimed again by deleting and re-joining (Art. 6(1)(f) GDPR).
• Server logs: rotated automatically, at most 30 days. Database backups: 30 days, then overwritten.

7. AI and automated decisions

The AI fit score, red flags and drafts are advisory only. They do not produce legal effects or similarly significant effects on you (Art. 22 GDPR). You decide which listings to pursue and whether to send a draft. AI output can be wrong.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Delete everything at once: send /deleteme in the bot. Edit or delete searches and your profile directly in the bot. For everything else: contact@flatdrop.at or /support.

You may lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at) or with the authority in your EU country of residence.

9. Security

Access to the server is restricted to the operator. Connections to Telegram, portals and AI providers are encrypted (TLS). Bot tokens and API keys are kept out of the code. Backups are stored encrypted (AES). No system is completely secure; we will notify you and the authority of breaches as required by Art. 33-34 GDPR.

10. Cookies and tracking

The bot sets no cookies and uses no tracking or advertising tools.

11. Changes

We may update this policy when the service changes. The date at the top shows the current version; we will announce material changes in the bot.