Privacy Policy - FellowFlats

Last updated: 13 July 2026 Effective date: 13 July 2026

FellowFlats ("FellowFlats," "we," "us," or "our") operates the website at fellowflats.com (the "Platform"), a marketplace that connects landlords and property owners with students and other tenants seeking shared accommodation rented by the bed. We protect personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the substantially similar provincial private-sector privacy laws of Alberta, British Columbia, and Quebec (including Quebec's Law 25) where they apply, and Canada's Anti-Spam Legislation (CASL).

Our practices follow PIPEDA's ten Fair Information Principles: Accountability; Identifying Purposes; Consent; Limiting Collection; Limiting Use, Disclosure, and Retention; Accuracy; Safeguards; Openness; Individual Access; and Challenging Compliance. This Policy explains how we apply each of them.

1. Definitions

• "Personal information" means information about an identifiable individual, including online identifiers such as IP addresses, cookie IDs, and device identifiers where they can be linked to you.
• "Sensitive personal information" means information warranting a higher degree of protection given the context, such as gender, date of birth, and identity or student-status documents.
• "Service provider" means a third party that processes personal information on our behalf and on our instructions.
• "User" means any person with a FellowFlats account, whether acting as a landlord, a tenant, or both.

2. Accountability and Privacy Officer

FellowFlats is operated by AlgoCrew Inc., a corporation incorporated under the Canada Business Corporations Act, with its registered office at 35 Herkley Dr, Brampton, Ontario L6V 2E7, Canada. We are responsible for personal information under our control, including information transferred to service providers for processing, and we use contractual and other means to ensure a comparable level of protection while information is handled by them.

We have designated a Privacy Officer accountable for compliance with this Policy and applicable privacy laws (as required by PIPEDA Principle 1 and Quebec's Law 25). Direct all privacy questions, access and correction requests, consent withdrawals, and complaints to:

• Privacy Officer: Privacy Officer, AlgoCrew Inc.
• Email: notifications@fellowflats.com (subject line "Privacy request")
• Mail: Privacy Officer, AlgoCrew Inc., 35 Herkley Dr, Brampton, Ontario L6V 2E7, Canada

3. Information we collect

We limit collection to what is necessary for the purposes identified in Section 5, and we collect it by fair and lawful means.

a) Information you provide directly

• Account data: name, email address, password (stored hashed), phone number, profile photo, account role (landlord and/or tenant).
• Tenant profile (some fields sensitive): gender, age or date of birth, budget, move-in date, lifestyle preferences (e.g. smoking, pets), bio, school or university, occupation.
• Landlord and listing data: property address and location, descriptions, photos, room and bed counts, pricing, amenities, house rules, availability dates.
• Verification data (sensitive, optional): identity or student-status documents you choose to submit, processed only to confirm authenticity.
• Communications: messages you exchange with other users through the Platform, and messages you send to us (support, contact form).
• Booking activity: booking requests you send or receive, and their status.

b) Information collected automatically

• Device and usage data: IP address, browser type and version, operating system, pages viewed, referring page, actions taken, and timestamps.
• Approximate location: derived from listing addresses you enter (geocoded to display maps) and, at a coarse level, from your IP address. We do not collect precise GPS location from your device.
• Cookies and similar technologies: see Section 7.
• Server and security logs: kept to operate, secure, and rate-limit the Platform.

c) Information from third parties

• If you sign in with Google, we receive basic profile information (name, email address, profile photo) from Google under your Google account settings.

4. Sensitive personal information and express consent

Gender, date of birth, and identity or verification documents are treated as sensitive personal information. Consistent with OPC guidance on meaningful consent and Quebec's Law 25, we collect and use this information only with your express, informed consent, requested separately from acceptance of the Terms, and only for the purposes stated in Section 5 (matching, eligibility for gender-based shared rooms where lawful, and fraud prevention). You may withdraw this consent at any time (Section 12); some features (such as gender-restricted rooms or a verification badge) may then be unavailable to you.

5. Why we use your information (identified purposes)

We identify our purposes at or before the time of collection. We use personal information to:

• create and manage your account and profile;
• display listings and tenant profiles, and power search, filtering, and matching (including gender-based room eligibility where lawful under applicable human-rights law);
• facilitate booking requests and in-platform communications between landlords and tenants;
• verify identity or student status (only where you opt in) and detect and prevent fraud, scams, and abuse;
• send transactional messages (account verification, booking updates, security alerts);
• send marketing or promotional messages only with your CASL-compliant consent (Section 8);
• maintain security, enforce our Terms, and comply with legal obligations.

We will not use your personal information for a new purpose without first identifying that purpose and obtaining your consent, except where permitted or required by law.

Automated processing. Search ranking and room-eligibility filtering are applied automatically based on the criteria you and other users enter (for example, gender-based room rules set by a landlord). We do not use your personal information to make fully automated decisions that have a legal or similarly significant effect on you without human involvement. If we ever do, we will tell you and explain the factors used, as required by Quebec's Law 25.

AI. We do not use your personal information to train artificial-intelligence models or to provide AI-generated recommendations. If we introduce such features, we will update this Policy and obtain any required consent first.

6. How we share information

• With other users: your public profile and listing details are visible to other users so the marketplace can function. Messages are visible to the participants in the conversation. Do not include information in your profile, listings, or messages that you do not want the recipient to see.
• With service providers: we use third parties to operate the Platform, under contracts requiring them to protect your information and process it only on our instructions:
  • database, authentication, and file storage: Supabase (hosted in Canada);
  • web hosting and content delivery: Vercel;
  • transactional email delivery: Resend;
  • rate limiting: Upstash;
  • geocoding of listing addresses: OpenStreetMap Nominatim (the listing address you enter is sent to the service to place it on a map; no account data is sent with it);
  • analytics: Google Analytics, only if you opt in via our cookie banner (Section 7).
• Identity and student-status verification is performed by our own team; documents are not shared with an external verification provider.
• For legal reasons: where required or permitted by law, for example in response to a court order, a lawful demand by a government institution, or to protect the rights, safety, or property of FellowFlats, our users, or the public.
• Business transfers: in connection with a prospective or completed merger, acquisition, financing, or sale of assets, personal information may be disclosed under confidentiality obligations and, on completion, used only for the purposes described in this Policy. We will give notice as required by law.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

7. Cookies and tracking technologies

We use cookies and similar technologies:

• Strictly necessary cookies (session/authentication, security, load balancing, your cookie choices) are always active because the Platform cannot function without them.
• Preference cookies (e.g. your light/dark theme choice) store your settings.
• Analytics cookies (Google Analytics) are off by default and set only with your explicit, opt-in consent, given through our cookie banner, consistent with OPC guidance on online behavioural advertising and Quebec's Law 25. When enabled, Google Analytics collects usage data (pages viewed, approximate location from IP, device information) to help us understand how the Platform is used; Google may process this data in the United States. You can change or withdraw your choice at any time via the "Cookie settings" link in the page footer, and your withdrawal takes effect immediately. We do not use advertising or marketing cookies, and we do not use tracking techniques that cannot be turned off.

We do not knowingly collect sensitive personal information via cookies, and information about our cookies is provided here and at the point of consent rather than only buried in this Policy.

8. Marketing emails and CASL

We send commercial electronic messages only where we have your express consent or where implied consent exists as permitted by CASL (for example, an existing business relationship). Every commercial message identifies FellowFlats, includes our contact information, and contains a functioning unsubscribe mechanism that remains usable for at least 60 days; we honour unsubscribe requests within 10 business days (in practice, immediately). Transactional messages essential to a service you requested (booking updates, security alerts, verification emails) are not marketing and may still be sent.

9. Storage location, cross-border transfers

Our primary database and file storage (Supabase) are hosted in Canada (AWS ca-central-1, Montreal). Some service providers listed in Section 6 (web hosting and content delivery, email delivery, and Google Analytics where you opt in) may store or process personal information outside Canada, including in the United States. While your information is in another jurisdiction, it is subject to the laws of that jurisdiction, and courts, law enforcement, and national-security authorities there may be able to access it. We use contractual safeguards to ensure a comparable level of protection, and for information about Quebec residents we assess transfers outside Quebec as required by Law 25 (section 17).

10. Data retention

We retain personal information only as long as necessary to fulfil the purposes identified in Section 5 or as required by law, and we then securely delete or anonymize it. In outline:

• Account and profile data: kept while your account is active; deleted or anonymized within 30 days of account deletion.
• Messages and booking records: retained up to 12 months after account deletion where needed to resolve disputes, prevent fraud, or meet legal obligations, then deleted or anonymized.
• Verification documents: deleted within 30 days of the verification decision; only the verification outcome (badge status) is retained.
• Server and security logs: retained up to 90 days.

Personal information that has been used to make a decision about you is retained long enough for you to access it and exhaust any recourse.

11. Security safeguards

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit (TLS), hashed passwords, role-based access controls, ownership checks on every data mutation, rate limiting, and hosting with reputable providers. Sensitive information such as verification documents receives heightened protection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. If a breach of security safeguards creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada, notify you and any other organizations that can reduce the harm as soon as feasible, and keep records of all breaches for at least 24 months, as PIPEDA requires. For Quebec residents we will also notify the Commission d'accès à l'information and maintain a register of confidentiality incidents, as Law 25 requires.

12. Your rights

Subject to applicable law, you may:

• Access: ask whether we hold personal information about you, how it is or has been used, to whom it has been disclosed, and receive a copy;
• Correct: have inaccurate or incomplete information corrected (you can edit most profile data directly in your account settings);
• Withdraw consent: at any time, subject to legal or contractual restrictions and reasonable notice; we will explain the consequences (some features may stop working for you);
• Delete your account: request deletion of your account and associated personal information at any time from your account settings or by contacting the Privacy Officer; we will action it within the retention windows in Section 10, subject to information we must keep by law;
• Data portability (Quebec residents): request computerized personal information you provided in a structured, commonly used technological format;
• Challenge compliance: complain to our Privacy Officer about our handling of your information.

How to make a request. Contact the Privacy Officer (Section 2). We may need to verify your identity before acting. We respond within 30 days (PIPEDA) at no cost or minimal cost; if we need an extension or must refuse a request in whole or in part (for example, where information reveals another person's personal information or is protected by legal privilege), we will tell you why in writing and explain your recourse.

If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or, depending on your province, to the Information and Privacy Commissioner of Alberta or British Columbia, or the Commission d'accès à l'information du Québec.

13. Accuracy

We keep personal information as accurate, complete, and up to date as necessary for the identified purposes. You are responsible for keeping your account and listing information current, and you can update most of it directly in your account.

14. Children's privacy

The Platform is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn we have done so, we will delete it promptly. If you believe a minor has provided us information, contact the Privacy Officer.

15. Third-party links

The Platform may contain links to third-party websites or services (for example, a landlord's external page or a school's website). This Policy does not apply to those third parties; review their privacy policies before providing them information.

16. Openness and changes to this Policy

This Policy, and plain-language information about our practices, are available on the Platform at all times. We may update this Policy from time to time. Material changes will be posted with an updated "Last updated" date and, where the change involves a new purpose or new sharing, we will seek fresh consent as required by law. Continued use alone is not treated as consent to materially expanded collection or use.

17. Contact

AlgoCrew Inc. - Privacy Officer notifications@fellowflats.com · 35 Herkley Dr, Brampton, Ontario L6V 2E7, Canada

This Policy is currently published in English; a French version is planned. You may write to us in French and we will do our best to respond in French; nous ferons de notre mieux pour répondre en français.