Privacy Policy

This Privacy Policy applies to all personal data processed by Roomscan in connection with the Platform, including data relating to Renters, Verifiers, and, where applicable, third parties whose personal data appears incidentally in Report content. It does not govern the data practices of third-party services linked from the Platform.

• Account data. When you register, we collect your name, email address, and password. Verifiers additionally provide identity verification information as part of onboarding.
• Booking and transaction data. When a Booking is placed, we process the property address, Booking details, and transaction records including payment confirmation. We do not store full payment card details; these are processed directly by our third-party payment processor.
• Report content. Reports submitted by Verifiers may contain written observations, photographs, and video recordings of the property. This content may incidentally include personal data of third parties such as landlords, occupants, or other individuals visible in uploaded media.
• Communication data. We retain records of messages exchanged through the Platform between Renters and Verifiers in connection with a Booking.
• Usage and technical data. We collect IP addresses, browser type, device identifiers, and log data generated by your use of the Platform. This data is used for security, fraud prevention, and service improvement.
• Payment data. Payment transactions are processed by Stripe. Roomscan receives transaction confirmations and payout records but does not store full card or bank account details.

• Performance of contract (Art. 6(1)(b) GDPR). We process account data, Booking data, Report content, and communication data to facilitate the matching of Renters and Verifiers, deliver Reports, process payments, and handle disputes. This processing is necessary to perform the contract with you.
• Legal obligation (Art. 6(1)(c) GDPR). We retain certain transaction and identity records where required by applicable tax, financial, or regulatory law.
• Legitimate interests (Art. 6(1)(f) GDPR). We process usage and technical data, and carry out fraud detection and abuse prevention, on the basis of our legitimate interest in operating a secure and reliable platform. We have assessed that this interest is not overridden by your rights and interests, given the limited nature of the data involved and the security purpose served.
• Compliance with legal proceedings. Where required by a court order, regulatory authority, or mandatory legal process, we may process and retain data beyond our standard retention periods.

We do not rely on consent as a legal basis for any core processing activity.

Reports submitted through the Platform may contain photographs, videos, or written observations that include personal data of individuals who are not users of the Platform, such as landlords, occupants, neighbours, or other persons incidentally visible at the property.

Roomscan processes this content as data controller solely for the purpose of delivering the Report to the relevant Renter and resolving any disputes arising from the Booking. Roomscan does not use incidental third-party personal data in Reports for any other purpose.

Verifiers are responsible for ensuring that on-site data capture is conducted lawfully and with appropriate regard for the privacy of individuals present at or near the property. Verifiers must not deliberately record individuals in a manner that is disproportionate to the purpose of documenting the property's condition. These obligations are set out in the Verifier Terms.

Individuals whose personal data appears incidentally in a Report and who wish to exercise data subject rights may contact us at hello.roomscan@gmail.com. We will assess each request in accordance with GDPR, balancing the individual's rights against our legal obligations to retain dispute-related records.

We share personal data only in the following circumstances.

• Between Renters and Verifiers. The Renter's Booking details and property address are shared with the assigned Verifier. The Verifier's first name and, where applicable, profile information are shared with the Renter. Full contact details are not shared between parties unless strictly necessary.
• Payment processors. We share transaction data with Stripe for the purpose of processing payments and disbursing Verifier Compensation. Stripe's privacy policy is available at https://stripe.com/privacy.
• Service providers. We may share data with third-party providers who assist with platform infrastructure, email delivery, analytics, and fraud detection, acting as processors under data processing agreements with Roomscan.
• Legal and regulatory authorities. We may disclose data to courts, regulators, law enforcement, or other public authorities where required by law or where necessary to protect the rights and safety of users or third parties.
• Business transfers. In the event of a merger, acquisition, or sale of Roomscan's business or assets, user data may be transferred to the successor entity, subject to equivalent privacy protections.

We do not sell personal data to third parties.

Roomscan uses only strictly necessary cookies to operate the Platform. These are session cookies required for login and security and are set automatically when you use the Platform. They do not track you across other websites and do not require your consent under applicable law.

We do not currently use analytics, advertising, or any other non-essential cookies or tracking technologies. If this changes in the future, we will update this Policy, notify you in advance, and seek your consent before activating any non-essential cookies.

You can manage or delete cookies through your browser settings at any time. Deleting strictly necessary cookies may prevent you from logging in or using the Platform.

• Account data. Retained for the duration of your account and deleted within 6 months of account closure, unless a longer period is required by law or for pending dispute resolution.
• Booking and transaction data. Retained for 5 years from the date of the transaction to comply with Portuguese tax and accounting law (Lei n.º 150/2019 and applicable fiscal obligations).
• Report content including photographs and video. Retained for 12 months from the date of Report delivery. Where a dispute has been opened, relevant Report content is retained until the dispute is resolved and any applicable limitation period has expired.
• Communication data. Retained for 12 months from the date of the relevant Booking.
• Usage and technical data. Retained for 90 days for security and fraud prevention purposes, after which it is deleted or anonymised.

Where data must be retained beyond these periods due to a legal obligation or ongoing legal proceedings, we will retain only the minimum data necessary and will delete it as soon as the obligation ceases.

Roomscan is based in Portugal and processes data within the European Economic Area. Some of our third-party service providers, including payment processors and infrastructure providers, may process data in countries outside the EEA. Where such transfers occur, we ensure they are carried out under appropriate safeguards, including the EU Standard Contractual Clauses (SCCs) as approved by the European Commission under Art. 46 GDPR. A list of third-party providers and their locations is available on request at hello.roomscan@gmail.com.

We implement technical and organisational measures appropriate to the nature and sensitivity of the data we process. These include access controls, encryption of data in transit, and regular review of our security practices. No transmission over the internet is entirely secure, and we cannot guarantee absolute security. We will notify affected users and the relevant supervisory authority in the event of a personal data breach as required by Art. 33–34 GDPR.

Under GDPR, you have the following rights in relation to your personal data.

• Right of access. You may request a copy of the personal data we hold about you.
• Right to rectification. You may request correction of inaccurate or incomplete personal data.
• Right to erasure. You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain data.
• Right to restriction. You may request that we restrict processing of your data in certain circumstances, for example while a dispute is pending.
• Right to data portability. Where processing is based on contract or consent and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object. You may object to processing carried out on the basis of legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent. Where we process data on the basis of consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello.roomscan@gmail.com. We will respond within one month of receiving your request. We may need to verify your identity before processing your request.

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has registered on the Platform, we will delete their account and associated data without delay.

You have the right to lodge a complaint with the Portuguese data protection supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, if you believe that our processing of your personal data does not comply with GDPR. You may also lodge a complaint with the supervisory authority of the EU member state in which you habitually reside or work.

We may update this Privacy Policy from time to time. Material changes will be communicated by email and by notice on the Platform at least 14 days before taking effect. The current version is always available at Privacy Policy.

All privacy-related enquiries and data subject requests should be directed to: Roomscan · hello.roomscan@gmail.com · Lisbon, Portugal

A Data Protection Officer has not been appointed, as Roomscan does not meet the thresholds for mandatory DPO appointment under Art. 37 GDPR at this stage. This will be reviewed as the platform scales.