Privacy Policy

Flatren is operated by Fines Software Consulting SRL, a Romanian limited liability company. We act as the data controller for the personal data described in this policy.

Company name

Fines Software Consulting SRL

Registered office

Splaiul Independenței 313B, Sector 6, Bucharest, Romania

VAT number

RO45479400

Privacy contact

contact@fines-software-consulting.ro

We have not appointed a Data Protection Officer because our processing does not meet the criteria in Article 37(1) GDPR. For all privacy questions, requests, or complaints, write to the email above and a human will respond within 30 days (typically much sooner).

Our supervisory authority in Romania is the National Supervisory Authority for Personal Data Processing (ANSPDCP): dataprotection.ro. You have the right to lodge a complaint with them, or with the supervisory authority of your habitual residence.

This policy covers personal data we process when you:

• Visit flatren.app or any Flatren-owned subdomain;
• Sign up for, install, or use the Flatren mobile application on iOS or Android;
• Join our pre-launch waiting list;
• Contact us by email about Flatren;
• Receive a lease invitation from a Flatren landlord and choose to claim it.

It does not cover websites or services we link out to (for example your bank or payment app — Revolut, Bunq, Monzo, PayPal, etc.). When Flatren opens one of these apps to start a payment, you leave Flatren and the third party's privacy policy applies.

We only collect what we need to run the service. Below is the full list — grouped by where it comes from and what it's used for.

3.1 Account and profile data

• Email address, display name, profile photo — provided when you sign up or copied from your sign-in provider (Google, Apple).
• Authentication identifiers — the unique account ID assigned by Firebase Authentication and, where applicable, by Google or Apple.
• Payment handles — your Revolut, Bunq, Monzo, PayPal, or other handles, if you add them to your profile so counterparties can pay you. Optional.
• Active role — whether you're currently using Flatren as a landlord or tenant.

3.2 Property, lease, and payment data

• Property records — name, address, country, optional photo, optional latitude/longitude when you pin the property on the map.
• Lease records — landlord and tenant identifiers, rent amount, currency, frequency, start and end dates, security deposit, free-text notes you choose to add.
• Payment requests — amount, currency, type (rent, utility, reimbursement, other), due date, status (pending, sent, confirmed, cancelled, overdue), and the timestamps recording when each side marked it.
• Invitations — the invite link tokens you generate and the metadata (lease preview) needed to claim them.
• Attachments — files you choose to attach to a lease or payment (receipts, photos, PDFs). Attachments are capped at 10 MiB per file and gated by a per-upload consent step. See Section 3.6.

Flatren does not read your bank account, scan transactions, or detect payments automatically. Payment status changes only when you or your counterparty taps a button in the app.

3.3 Device and notification data

• Push notification tokens — the token your device exposes to Apple Push Notification service or Firebase Cloud Messaging, so we can deliver alerts you opted into.
• Device locale and time zone — used to format dates and currencies correctly.
• Crash and error diagnostics — when the app crashes or hits an unexpected error, Sentry collects a stack trace, device model, OS version, the steps leading to the problem, and your Flatren account ID. We use this to fix bugs.

3.4 Subscription data

• If you subscribe to Flatren Pro through the App Store or Google Play, we receive an anonymous purchase identifier from RevenueCat plus your subscription state (active, trial, cancelled, expiry date). We never see your card details — those stay with Apple or Google.

3.5 Location data

• If you choose to pin a property on the map, the iOS app may request when-in-use location permission to centre the map on your current position. The coordinates we save are the ones you pin — not your device's real-time location. You can decline the permission and place the pin manually.

3.6 Attachment uploads — important

Lease contracts in many jurisdictions legally contain national identification numbers. Flatren's attachment system is deliberately designed for non-identifying lease and payment documents (receipts, invoices, photos, summaries). Before each attachment upload, you confirm a per-file consent that records:

• That you have read the attachment-upload terms;
• The version of those terms you agreed to;
• The exact text shown to you at the time;
• The timestamp of your consent.

This record is stored alongside the file as a compliance receipt and is included in your data export if you request one. You can remove an attachment at any time from inside the app, except where doing so would alter a closed payment record (see Section 7).

3.7 In-app feedback and support contacts

• If you send feedback through the app or by email, we keep your message and your email so we can reply and triage. We don't use feedback content for any other purpose.

3.8 Waiting list

• If you join the pre-launch waiting list, we record your email address, the platform you chose (iOS or Android), the source of the signup (always "marketing_site" today), your IP address, and your browser's user-agent string. We use this only to send you a single launch notification and to prevent duplicate signups. We do not use it for general marketing.

3.9 Website visits

• Standard server logs (IP address, user-agent, request path, timestamps), kept short-term for security and abuse prevention.
• If — and only if — you grant analytics consent in our cookie banner, Google Analytics 4 collects pseudonymous page-view events. Section 11 covers this in detail.

3.10 Diagnostics and crash data

• When the iOS app crashes or hits an unexpected error, we collect a diagnostic report — device model, operating-system and app version, the error and its stack trace, and a short trail of preceding in-app events ("breadcrumbs") — so we can reproduce and fix the problem. We attach your Flatren account ID (a random identifier) so we can find and fix problems affecting your account. We deliberately do not attach screenshots, your IP address, your name, or your email address to these reports.

Under Article 6(1) GDPR every processing activity needs a lawful basis. Here's ours, mapped to each purpose.

Where we rely on legitimate interests, we've weighed our interest against the impact on you and concluded the processing is proportionate. You always have the right to object — see Section 8.

Flatren never sells your personal data. We share it only with the service providers ("processors" under GDPR Article 28) we need to operate the product, each bound by a written contract that includes the Article 28(3) clauses, and — where applicable — Standard Contractual Clauses for international transfers.

We may also share personal data with public authorities when we are legally compelled to do so, with our professional advisors when bound by confidentiality, and — in the unlikely event of a corporate restructuring — with successors of the business, provided they take on the same obligations under this policy.

Your account data and the operational core of Flatren run on Google Cloud's europe-west1 region (Belgium). Some of our processors and partners — RevenueCat, Slack, Apple, Namecheap, parts of Google, and (for website advertising measurement only) TikTok — are headquartered in or transfer data to the United States and may access it from there to provide their services.

For every transfer outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where the processor publishes one, additional supplementary measures (encryption in transit and at rest, restricted admin access, audit logging). You can request the list of SCCs in force by emailing us.

We keep personal data only as long as we need it for the purposes in Section 4. The schedule below reflects what actually runs in production.

You have the following rights over personal data we hold about you:

• Access (Art. 15) — get a copy of your data and information about how we use it.
• Rectification (Art. 16) — ask us to correct inaccurate or incomplete data. Most fields are editable directly inside the app.
• Erasure (Art. 17) — ask us to delete your data. The in-app Delete account action triggers this with a 30-day grace period, after which the deletion is irreversible.
• Restriction (Art. 18) — ask us to pause processing while a dispute is resolved.
• Data portability (Art. 20) — receive your data in a structured, machine-readable format. Use the in-app Export my data action to generate a ZIP that contains your records and a sanitised view of records you share with someone else.
• Object (Art. 21) — object to processing based on our legitimate interests (Section 4). Tell us why and we'll stop unless we have compelling lawful grounds to continue.
• Withdraw consent (Art. 7(3)) — where processing is based on consent (website analytics, website advertising / the TikTok Pixel, in-app ads, push notifications, the waiting list), you can withdraw it at any time without affecting the lawfulness of earlier processing.
• Lodge a complaint with a supervisory authority (Art. 77) — see Section 1.

We won't make you pay to exercise these rights, and we don't make decisions about you based solely on automated processing — see Section 13.

You can exercise most rights without contacting us:

• Access and portability — open the app, go to Profile → Export my data. We'll prepare a ZIP and notify you when it's ready (within 30 days, usually within minutes).
• Rectification — edit fields directly in the app (profile, payment handlers, properties, leases, payment notes).
• Erasure — Profile → Delete account. We confirm with a typed-DELETE step to prevent accidental deletion. The 30-day cancel window lets you reverse this if you change your mind.

For everything else — restriction, objection, complaints, or if any in-app flow doesn't work for you — write to contact@fines-software-consulting.ro. We respond within 30 days. If we need an extension because the request is complex, we'll tell you within the same period (Art. 12(3) GDPR).

We may ask you to confirm your identity before acting on a request — typically by replying from the email address on your Flatren account. We do this to protect your data from someone impersonating you.

Article 32 GDPR requires us to apply appropriate technical and organisational measures. In practice, that means:

• Encryption in transit — every connection between your device and our servers uses TLS.
• Encryption at rest — Firestore, Cloud Storage, and the underlying Google infrastructure encrypt data on disk by default.
• Strong authentication — we rely on Firebase Authentication and let you choose Google or Apple sign-in if you prefer not to use a password.
• Access control — Firestore security rules enforce a role-based model: you can read and write your own data, your counterparty can read what they need to see, and nobody else can. Critical state changes (payment status, lease end) only run through server-side Cloud Functions; clients can't bypass them.
• App Check / device attestation — production traffic from the iOS app is signed with Apple DeviceCheck so that traffic from impersonator clients is rejected.
• Least-privilege engineering — administrative access to production is limited to staff who need it, time-boxed, and logged.
• Incident response — if a personal data breach occurs and is likely to result in a risk to you, we will notify the Romanian supervisory authority within 72 hours and you directly without undue delay where Article 34 requires it.

No system is perfectly secure. If you spot a security issue, please report it to contact@fines-software-consulting.ro.

The Flatren website (flatren.app) uses a small number of cookies. They fall into three categories:

• Strictly necessary — used to remember your cookie choice and to keep the site secure. These do not require consent under the ePrivacy Directive.
• Analytics — Google Analytics 4 (measurement ID G-EMVJEB97J8) records pseudonymous page-view events so we can see which pages help, and which to fix. This loads only after you accept analytics in the cookie banner.
• Advertising — the TikTok Pixel measures whether visitors who arrive from our TikTok ad campaigns go on to download the app, so we can judge which ads are worth running. The pixel script is not loaded at all until you grant the advertising category in the banner; when enabled it sets pseudonymous cookies (_ttp, _tt_enable_cookie) and shares event data with TikTok — the page views and download-button clicks we fire explicitly, plus events the pixel collects automatically (a landing-page view and a page-engagement signal such as time spent). TikTok may transfer this data outside the EEA under Standard Contractual Clauses.

Google Analytics is configured with EU-data-residency where Google supports it, IP anonymisation enabled, ad-personalisation signals disabled, and Consent Mode v2 — meaning it sends only cookieless "ping" signals when consent is denied or not yet given. The TikTok Pixel respects the same default-deny: nothing fires until you opt in.

You can withdraw analytics or advertising consent at any time by clicking the cookie preferences button at the bottom of any page. Withdrawing analytics deletes the GA4 cookies on your device; withdrawing advertising stops the TikTok Pixel from firing for the rest of your session and prevents it loading on future visits.

For the full list of cookies and similar storage we use, with each item's name, provider, purpose, and duration, see our Cookie Policy.

On first launch the iOS app shows two consent screens that Apple and the GDPR require:

• Push notifications — iOS asks whether Flatren can send you alerts about payment events, reminders, and security notifications. You can change this any time in iOS Settings → Notifications → Flatren.
• Personalised ads (free tier only) — we ask through a Google User Messaging Platform consent flow whether you allow personalised ads via Google AdMob. If you decline, we either show non-personalised ads or no ads at all, depending on your jurisdiction. You can revisit this choice from inside the app.
• App Tracking Transparency — Apple separately asks whether Flatren can track you across apps and websites (the IDFA prompt). If you say no, we continue to function normally; ad targeting falls back to non-personalised.

We do not use any ad SDKs other than Google AdMob, and we never share your in-app data (leases, payments, attachments) with ad networks.

Flatren is intended for adults entering into rental agreements. The service is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We do not subject you to decisions based solely on automated processing — including profiling — that produce legal or similarly significant effects on you (Article 22 GDPR). The scheduled jobs that flip a payment to "overdue", delete an inactive account after 30 days, or generate a future rent request are deterministic operations on data you already created, not decisions about you.

We'll update this Privacy Policy when our practices change or the law changes. The "Last updated" date at the top of the page reflects the latest version. For changes that materially affect your rights, we'll notify you in the app or by email before they take effect.

If you have questions about anything in this policy, or you want to exercise a right that isn't supported in-app, write to contact@fines-software-consulting.ro.