Datenschutzerklärung

1. Controller

Simon Huang, Weinbergsweg 10, 10119 Berlin, Germany · hello@flatsignal.de. There is no data protection officer, as none is legally required for a service of this size.

2. What Flatsignal is

Flatsignal is a Telegram bot. It reads publicly visible rental listings from third-party portals, compares them with the search criteria and profile you give it, and sends you the ones that fit. Most of the data we process is data you type into the bot yourself.

3. Data we process, why, and on which legal basis

3.1 Website (flatsignal.de)

When you open this site, Cloudflare (our hosting provider) processes the technical data of your request: IP address, time, requested page, browser and operating system, referrer. We use this only to deliver the site and to keep it secure (Art. 6(1)(f) GDPR). Request logs are kept for up to 7 days. The website sets no cookies for visitors and uses no analytics, tracking or advertising services. (A single functional cookie exists for the operator's own admin login.)

3.2 Your Telegram account and what you tell the bot

When you start the bot we receive from Telegram your chat ID, your first name and, if set, your username. During setup and later you send us: a location pin (the centre of your search), budget, size and other filters, and a free-text profile (who you are, job, move-in date, duration, and anything else you choose to add, e.g. a phone number for application drafts). We also store which listings we sent you, your questions and the drafts we produced, so replies can continue the conversation. If a friend invited you, we store the link between your accounts for the referral reward.

Purpose: providing the service you asked for. Legal basis: performance of the contract, Art. 6(1)(b) GDPR. You control the content of your profile; only share what you want to appear in application drafts.

Messages between you and the bot travel through Telegram's servers. Telegram's own privacy policy applies to your use of Telegram: telegram.org/privacy.

3.3 AI processing (OpenAI)

To score a listing for you, answer your questions about it, or write an application draft, we send the listing's public text together with your profile, your filters and your question to OpenAI's API (OpenAI Ireland Ltd. for EU customers; processing may take place in the USA). OpenAI processes this data only on our behalf under a data processing agreement and does not use API data to train its models. Transfers to the USA are covered by the EU-US Data Privacy Framework and the EU standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR. The scores are recommendations only; no decision with legal effect on you is taken automatically.

3.4 Payments (Stripe)

Subscriptions are paid through Stripe Payments Europe Ltd. (Ireland). Stripe processes your payment details under its own responsibility; we never see your card number. To match your payment to your Telegram account we store the e-mail address you tell the bot after paying. Legal basis: Art. 6(1)(b) and (c) GDPR (contract, tax record-keeping). Stripe's privacy policy: stripe.com/privacy.

3.5 Listing data from rental portals

We store, for each listing we see, the public facts needed to match and show it: title, price, size, rooms, district, coordinates, availability, the listing's URL and a picture URL. We do not store advertisers' names, phone numbers or e-mail addresses, and we never contact advertisers ourselves; application drafts are handed to you, and you decide whether to send them. Where a listing title incidentally contains a person's name, it is processed on the basis of our legitimate interest in matching listings to searchers, Art. 6(1)(f) GDPR. Advertisers may object at any time (see section 6).

3.6 Cancellation and withdrawal requests

When you use the cancellation page, we store the details you enter (name, e-mail, requested end date, reason) with a timestamp, to process the request and to prove receipt. Legal basis: Art. 6(1)(b) and (c) GDPR.

4. Processors and recipients

We do not sell personal data and do not share it with anyone else unless legally required.

5. Retention

• Your account (profile, filters, listing history, chats): until you delete it. Send /delete to the bot and everything tied to your account is erased immediately.
• Payment-matching e-mail and cancellation records: 10 years, as required by German tax law.
• Listing data (no contact details): kept for the service and for aggregate market statistics.
• Server and application logs: up to 7 days.

6. Your rights

You have the right to access the data we hold about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR). Write to hello@flatsignal.de or message the bot. You also have the right to lodge a complaint with a supervisory authority, for example the authority competent for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit (list of German authorities).

7. Changes

We update this policy when the service changes. The current version is always at https://flatsignal.de/datenschutz. Version 2026-09-15.