Data Protection Notice (Datenschutz)

In this Privacy Policy, the following terms shall have the specified meanings:

• 'Personal Data' means any information relating to an identified or identifiable natural person.

• 'Processing' means any operation performed on personal data, such as collection, storage, adaptation, retrieval, or deletion.

• 'Controller' means the entity determining the purposes and means of processing personal data (StayForAll Plus Services Private Limited).

• 'Processor' means a third-party service provider processing personal data on behalf of the Controller.

• 'Account' means the registered profile created by a Tenant or Landlord to access platform services.

• 'Platform' means the stayforall.com website, APIs, and associated digital applications.

• 'Zero-Document Safeguard' means StayForAll's policy under GDPR Art. 5(1)(c) of not collecting or storing government identity documents, passports, or financial records on platform servers.

• 'Cookies' means small data files placed on your device to store preferences or session state.

The Data Controller responsible for personal data processed across StayForAll is:

StayForAll Plus Services Private Limited

C/o Mustafa K A, Kizhakkan, Perumbavoor, Ponjassery, Ernakulam, Kunnathunad, Kerala, India, 683547

Telephone: +91 8075540817

Email: [email protected]

Website: www.stayforall.com

Privacy Inquiries: Data protection inquiries, access requests, or deletion requests are handled directly by our dedicated Data Protection team at [email protected].

We process personal data strictly under lawful GDPR bases:

• Account Registration & Social Login — Contract Performance (Art. 6(1)(b))

• Application Inquiries & Messaging — Contract Performance & Consent (Art. 6(1)(b)/(a))

• Physical Room & Listing Verification — Legitimate Interest (Art. 6(1)(f))

• Reviews & Platform Integrity Safeguards — Legitimate Interest (Art. 6(1)(f))

• Automated Fraud & Risk Screening — Legitimate Interest (Art. 6(1)(f))

• Commercial Tax & Statutory Reporting — Legal Obligation (Art. 6(1)(c))

• Marketing & Non-Essential Cookies — Consent (Art. 6(1)(a))

We collect data directly from you, via social login providers, and automatically during platform interaction:

• Account & Profile Information: Name, email address, phone number, password hash, profile photo, and OAuth tokens from Google or Apple (including Apple 'Hide My Email' relay addresses).

• Rental Preferences & Applications: Desired move-in dates, lease duration, self-reported occupation/student status, and introduction messages sent to landlords.

• Communication & Inquiries: In-app chat messages, inquiry notifications, and interaction histories exchanged between tenants and landlords.

• Zero Identity Document Storage: Under our data minimization policy, StayForAll DOES NOT collect, store, or process government ID scans, passports, student enrollment certificates, or bank statements on its servers. Tenancy registration documents and proofs of income are exchanged directly peer-to-peer (P2P) between tenant and landlord during contract execution.

• Reviews & Ratings: Quality feedback, star ratings, interaction survey responses, and timestamp logs.

• Technical Telemetry & Cookies: IP address (anonymized where required), device user-agent, session tokens, search queries, and analytics telemetry.

We offer seamless authentication via 'Sign in with Google' and 'Sign in with Apple'.

• Authentication Scope: Authentication is handled directly by the provider. We receive your name, email address, profile picture (if permitted), and an application-specific user ID. We never receive or store your Google or Apple account passwords.

• Apple 'Hide My Email' Support: If you utilize Apple's private relay feature, we process the generated relay address to communicate securely without receiving your private personal email.

• Revocation: You can revoke StayForAll's access at any time through your Google Account Permissions or Apple ID Settings.

StayForAll operates as an introduction and accommodation discovery marketplace. Official tenancy agreements, municipal city registration papers (*Wohnungsgeberbestätigung* in Germany), enrollment confirmations, and security deposit handling occur directly between the Tenant and the Landlord.

• Direct Exchange: Users are advised not to transmit sensitive identity scans or banking details over in-app chat. Official documents should be exchanged directly during in-person/virtual viewings or tenancy contract signing.

• Landlord Obligations: Landlords receiving tenant credentials directly are independent controllers bound by applicable data protection laws to use such data strictly for the tenancy evaluation.

StayForAll does not collect, store, or process credit card numbers, debit cards, or online payment credentials on its servers, nor does it integrate third-party card payment gateways at this time. All rental payments, security deposits, and housing transactions are arranged and executed directly between tenants and landlords. StayForAll does not currently act as an escrow agent or payment intermediary.

StayForAll uses automated risk screening algorithms to detect fraudulent listings, fake profiles, spam messaging, and suspicious payment behavior.

• Human Review Safeguard: Automated risk flags do not result in permanent automated account termination without human moderation oversight. Users subject to enforcement actions may request a manual human review by emailing [email protected].

We implement multi-layered technical and organizational security measures:

• Infrastructure Isolation: Application databases and servers are hosted in EU data centers (AWS Frankfurt & Hetzner Germany) with full AES-256 encryption at rest.

• TLS 1.3 Encryption in Transit: All web and API traffic is encrypted over HTTPS/TLS 1.3.

• Access Restrictions: Role-Based Access Control (RBAC), TOTP Multi-Factor Authentication (MFA/2FA) for administrative accounts, append-only audit logging (`AuditLog` & `SecurityLog`), and automated disaster recovery backups.

When you request account deletion through account settings or via API (`DELETE /v1/users/me`):

• Immediate PII Scrubbing: Personal identifiers (name, phone, bio, avatar, OAuth links, FCM tokens) are scrubbed immediately. Your account email is replaced with a non-identifiable randomized address (`deleted+<uuid>@deleted.stayforall.invalid`).

• Message & Review Anonymization: Internal chat histories and submitted reviews remain accessible to recipients with your sender name permanently replaced by the anonymous label **'Deleted User'**.

• Disaster Recovery Backup Lifecycle: Residual data residing in encrypted, immutable system backup snapshots is overwritten on rolling lifecycle rotation schedules (typically within 30 to 90 days) in accordance with standard disaster recovery practices.

• Statutory Accounting Retention: Financial invoices and commercial transaction records required by commercial and tax laws are securely archived for statutory periods before permanent destruction.

We disclose personal data to judicial authorities, law enforcement, or statutory bodies only when legally compelled by a binding court order, subpoena, statutory reporting obligation (such as EU DAC7 tax reporting), or to prevent imminent physical harm or illegal activity.

Our website, API backend, and services integrate trusted cloud infrastructure providers and third-party processors:

• Database & Compute Infrastructure: Neon Serverless PostgreSQL (Neon Inc.) & Hetzner Online GmbH, encrypted at rest and in transit, hosted in the AWS Frankfurt datacenter region (eu-central-1, Germany) and Nuremberg/Falkenstein, Germany.

• Storage & Media Infrastructure: Amazon Web Services (AWS S3), encrypted bucket in Frankfurt am Main, Germany (eu-central-1).

• Email Transactional Service: Resend (Resend Inc.) / Twilio SendGrid for sending operational notices (booking alerts, verification codes) under the EU-US Data Privacy Framework (DPF) / Standard Contractual Clauses (SCCs).

• Push Notifications & Mobile Auth: Google Cloud / Firebase (Google LLC) for push messaging tokens and OAuth authentication.

• OAuth Social Sign-In: Google LLC & Apple Inc. for secure token-based user authentication.

• AI Content Processing: Google Gemini API (Google LLC) for dynamic translation of user reviews and room listings without transmitting sensitive identity data.

• Web Analytics: Google Analytics (Google LLC) with IP anonymization, strictly gated behind explicit cookie consent.

Personal data collected in the EU/EEA (such as account names, contact emails, rental inquiries, and support correspondence) is stored on servers in Frankfurt, Germany. Where remote administration, customer support, or technical maintenance is conducted by StayForAll Plus Services Private Limited in India, such cross-border data access is governed by appropriate safeguards under GDPR Chapter V (including Standard Contractual Clauses approved by the European Commission pursuant to Art. 46(2)(c)) alongside technical and organizational security measures. Because StayForAll does not collect or store government IDs, passport scans, or financial dossiers, the scope of processed data is strictly limited to low-risk basic account and operational correspondence.

We categorize platform cookies into:

• Essential Cookies: Authentication tokens (`auth_token`), session security, and theme preferences. Necessary for platform operation.

• Functional Cookies: Store search preferences, filter states, and localized region settings.

• Analytics Cookies: Collect pseudonymized usage metrics to optimize performance.

• Consent Management: Users can adjust cookie preferences at any time via our Cookie Policy banner.

Under GDPR, users hold statutory rights including Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Data Portability (Art. 20), and Objection (Art. 21).

• Automated Data Export: You can generate a complete downloadable JSON archive of your personal profile, listings, applications, chat history, reviews, and consent records instantly via your profile settings (`GET /v1/users/me/export`).

• Support Requests: Send manual inquiries to [email protected]. We verify identity prior to processing and fulfill valid requests free of charge within one (1) calendar month.

Significant changes to this Privacy Policy will be announced via email or platform notification.

For privacy inquiries or data requests, contact:

Email: [email protected]

StayForAll Plus Services Private Limited, Ernakulam, Kerala, India, 683547.