Privacy Policy

Last updated: June 18, 2026

QualiFlow ("QualiFlow," "we," "us," or "our") operates the QualiFlow rental discovery and recommendation platform. This notice explains what personal data we collect, why, how it is shared, and the choices you have. QualiFlow is the data controller for personal data processed through this platform.

1. Who we are

QualiFlow is the trading name of the entity operating this platform. For data protection inquiries, contact privacy@getqualiflow.com.

2. Personal data we collect

Account & profile data — name, email, password (hashed), role (renter or landlord), profile photo, contact preferences.
Renter onboarding data — household composition, employment and income, rental history, preferred areas and price range, move-in readiness, and optional disclosures about credit or rental challenges. This data powers compatibility explanations, never automated approval decisions.
Landlord data — listing details, flexibility profile, verification status, and contact preferences.
Communication data — inquiries, tour requests, inquiry messages, and notifications.
Technical data — IP address, browser/device identifiers, session and security logs.
Payment data — collected and processed by Paddle.com (see §5). We receive only a transaction reference, status, and amount.

3. Purposes and legal bases

Provide and operate the platform (performance of contract).
Generate rule-based compatibility explanations between renters and landlord listings (legitimate interest in generating recommendations).
Communicate service updates, security notices, and support (contract).
Prevent fraud and abuse, secure the platform (legitimate interest).
Comply with legal obligations (legal obligation).
Marketing emails only with consent, which you can withdraw at any time.

4. How we share data

Between renters and landlords — when a renter contacts a landlord or requests a tour, the relevant profile details and message are shared with that landlord. Deposit-amount specifics are kept out of renter-facing UI but remain available to the landlord for legitimate screening.
Service providers (subprocessors) — Lovable Cloud (hosting/database), Paddle.com (payments and tax), and Google Maps (address autocomplete).
Merchant of Record — Paddle Inc. and its affiliates act as the seller of record for paid passes and may process billing-related personal data on its own behalf.
Authorities — when required by law, court order, or to protect our rights and the safety of our users.

5. Payments

Card and bank details are submitted directly to Paddle.com, the Merchant of Record for QualiFlow Plus. QualiFlow does not see, store, or transmit your payment instrument. Paddle's own privacy notice governs that processing and is available at paddle.com/legal/privacy.

6. Data retention

Account and profile data are retained while your account is active. Inactive accounts and associated data are deleted or anonymized after 24 months of inactivity, unless we are required to retain them for legal, tax, or fraud prevention purposes. You can request earlier deletion at any time.

7. Security

We use industry-standard encryption in transit (TLS), encryption at rest, row-level security on every multi-tenant table, role-based access controls, audited backups, and least-privilege server credentials. Sensitive operations are restricted to server-side functions to prevent client tampering.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent. Email privacy@getqualiflow.com and we will respond within 30 days.

9. Cookies

QualiFlow uses essential cookies and local storage to keep you signed in and remember UI preferences. We do not use third-party advertising cookies.

10. International transfers

Personal data may be processed on servers operated by our hosting and payments providers in the United States and the European Union. Transfers rely on the providers' standard contractual clauses where applicable.

11. Children

QualiFlow is not directed to anyone under 18 and we do not knowingly collect their data.

12. Changes

We may update this policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect.