Privacy policy

The party responsible for processing your personal data (the controller under the GDPR) is euroaff.com SARL, 21, rue du Puits Romain, L-8070 Bertrange, Luxembourg, RCS Luxembourg B280385. For any questions about your data, write to hello@letzflat.com.

Search criteria: budget, area, number of bedrooms, type of property and your own description of what you are looking for.

Household and timing: how many adults and children (with their ages), pets, your preferred move-in date and length of the tenancy, and what matters to you in a home.

Tenant profile for agents — only if you filled it in: whether your income meets the “rent × 3” rule (yes / no / not sure), type of employment, the country you work in, whether you have income other than from work in Luxembourg (only the type: salary from another country, rental or investment income, pension or benefits — no amounts), your residence status and how long it is valid for, and the type of guarantee.

Contact details: name, phone number and/or email, and your preferred way of being contacted.

Viewing requests (“I want to see it”, «Хочу посмотреть» on the Russian-language site): name, phone number, email if you wish, a convenient move-in date and a comment — to arrange a viewing of that particular property.

Trip alerts (“Trips”): the cities you chose, dates, number of guests, budget per night, minimum rating and language.

Notification channels: for Telegram — the ID of your chat with our bot, without your name or username; for browser notifications — the subscription address your browser issues; for email — the address and the time you confirmed it; for WhatsApp — your phone number, if you connect this channel.

Account, if our team has issued you one: email, password (we store only its hash; the password itself cannot be retrieved), favourite listings, your requests. If you ask for a new password — your email address and the time of the request.

Subscription: its status and term, and your customer and subscription IDs in Stripe. Card details are entered on Stripe's page and never reach us.

Technical data: every time your browser accesses the site, our hosting provider automatically receives your IP address, information about your browser and the page address. This is needed for the site to work and stay secure, and it is kept in the hosting provider's logs for a limited time.

We do not collect the amount of your income, your citizenship, documents or payment details.

Matching listings and trips, alerts, your account and subscription — to provide the service you asked for (performance of a contract, Art. 6(1)(b) GDPR).

Tenant profile for agents — based on the consent you give when you submit your request (Art. 6(1)(a) GDPR), so that you don't have to explain the same things all over again to every agent. You can withdraw your consent at any time.

Emails — only after you have confirmed your address via the link in our email (consent, Art. 6(1)(a) GDPR).

Protecting the site against abuse, limiting the number of emails sent to one address, anonymous statistics and internal notifications to our team — our legitimate interest in keeping the service reliable and making it more convenient (Art. 6(1)(f) GDPR).

Keeping payment records — because the law requires it (Art. 6(1)(c) GDPR).

We make no automated decisions that would have legal consequences for you: matching only compares listings with your request.

An estate agent receives a link to your profile for a specific property. That page does not show your name, phone number or email — they appear only if the agent confirms interest. The link is valid for 30 days; we can see when it was opened and can revoke it at any time.

Service providers that process data only on our instructions: Supabase — database and account sign-in, servers in Frankfurt (EU); Vercel — website hosting and anonymous visit statistics (USA); Resend — sending emails (USA).

Notification delivery through the channels you choose: Telegram, WhatsApp (Meta) and, for browser notifications, Google, Apple or Mozilla, depending on your browser. You can turn off any channel on your request settings page or with the /stop command in the bot.

Stripe sells the subscription as the merchant of record: it takes payment through the Link service, calculates VAT and sends receipts. Stripe processes payment details independently, under its own privacy policy.

Booking.com and Airbnb receive your data only if you go to them yourself and make a booking — under their own rules. Along with the link, we pass on only an anonymous partner tag.

Testers invited by our team chat with an AI assistant on Telegram; their messages are processed by Anthropic (USA). This does not apply to tenants.

Writing to us. Emails to hello@letzflat.com are forwarded by Forward Email (USA) to the company's mailbox.

We do not sell data or pass it on for advertising.

Some of our service providers are located outside the EU, including in the USA. Data is transferred to them on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or the EU standard contractual clauses (Art. 45 and 46 GDPR).

Your request and profile — 6 months from when you submit them or, if you took out a subscription, 6 months after it ends. They are then deleted automatically, together with the agent links and the history of listings sent to you.

A viewing request made without an account — 6 months. Requests made from an account are kept along with the account.

A trip alert — while it is on. Once it is turned off, we delete it after 30 days; one that was never connected (no Telegram and no confirmed email), after 7 days; an alert for specific dates, 30 days after those dates.

Your account — until you ask us to delete it. A notification channel — until you turn it off or for as long as the request exists. A new-password request — 7 days. Anonymous statistics — 13 months. Stripe keeps payment records for as long as the law requires.

If you have found a home or changed your mind, write to us and we will delete your data sooner.

We do not use advertising or tracking cookies. The only things stored in your browser are those without which the site would be inconvenient or would not work: a draft of an unfinished request, so that it is not lost if the page reloads (deleted once you submit it); a note that you have already seen the site tips, without any identifier; sign-in data, if you sign in to an account; and a background script for notifications, if you have turned them on. All of this is stored only on your device.

To understand where the request form is inconvenient, we count anonymous events: a page was opened, a step was completed, the field where an error occurred — without the answers themselves. No cookies are used for this and nothing is stored on your device, so this data cannot be linked to you or to your request. If “Do Not Track” or Global Privacy Control is turned on in your browser, we do not count even this.

We view overall statistics — countries, devices, where visitors came from — in Vercel Web Analytics, also without cookies. We count clicks through to Airbnb and Booking.com from the Temporary housing section (in Russian) in the same way, without linking them to a person: some of these links are affiliate links, and the platform pays us a commission on the booking, while your price stays the same.

The connection to the site is encrypted. Only our team has access to requests, and that access is restricted by rules at the database level. Agent links and your personal links to your request settings are long and random; do not forward them to anyone else.

You can find out what data we hold about you, get a copy of it, have it corrected or deleted, restrict its processing or have it transferred to another service. You can object to processing based on our legitimate interest and withdraw your consent at any time — this does not affect anything done before you withdrew it.

Write to hello@letzflat.com or reply to any of our messages — we will respond within one month. We may ask you to confirm that the data is yours.

If you believe we are violating your rights, you can lodge a complaint with Luxembourg's National Commission for Data Protection — CNPD, 15, Boulevard du Jazz, L-4370 Belvaux (cnpd.public.lu) — or with the supervisory authority of the country where you live.

The service is intended for adults. All we know about children is what you tell us in your request: how many there are and how old they are, if they are moving in with you.

If we change this policy, we will update the date at the top of the page. We will let everyone with an active request know about significant changes.