Privacy Policy

1. Introduction and Data Controller

At Conejome, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

Data Controller:

Conejome is operated by Rabbit Hole Technologies Oy (Business ID 3587542-1)
Registered Address: Sibeliuksenkatu 9 A 14, 00250 Helsinki, Finland
Country: Finland
Email: support@conejome.com
Data Protection Contact: dpo@conejome.com

2. Information We Collect

2.1 Information You Provide

• Account information (name, email, password)
• Profile information
• Tenant search ads you publish (the areas, budget, move-in date and type of home you are looking for, and a short introduction)
• An optional profile photo for your tenant search ad, stored with your tenant profile
• Invitations you send to tenants as a landlord, including an optional note
• Property listings and descriptions
• Messages sent through our platform
• Payment information (processed securely by Stripe)
• Contact information for landlords and tenants

2.2 Automatically Collected Information

• Device information and IP address
• Browser type and version
• Usage data and analytics
• Cookies and similar tracking technologies

3. Legal Basis and How We Use Your Information

Under GDPR, we process your personal data based on the following legal grounds:

3.1 Contract Performance (GDPR Art. 6(1)(b))

Processing necessary to provide our services:

• Account creation and authentication
• Property listing and search functionality
• Facilitating communication between landlords and tenants
• Showing your tenant search ad to logged-in users and delivering landlords' invitations to you
• Processing contact information unlock payments
• Delivering platform features you requested

3.2 Legal Obligation (GDPR Art. 6(1)(c))

Processing required by law:

• Tax and accounting requirements
• Fraud prevention and detection
• Responding to legal requests from authorities

3.3 Legitimate Interest (GDPR Art. 6(1)(f))

Processing for our legitimate business interests:

• Platform security and abuse prevention
• Preventing spam and fraud: limiting how many invitations, reports and notification emails can be sent, keeping contact details out of search ads and invitation notes, and reviewing reports
• Improving user experience and platform functionality
• Analytics to understand platform usage
• Customer support and dispute resolution

We have conducted a legitimate interest assessment (LIA) to ensure that our interests do not override your fundamental rights and freedoms.

3.4 Consent (GDPR Art. 6(1)(a))

Where applicable, with your explicit consent:

• Marketing communications (you can withdraw consent anytime)
• Optional cookies and analytics

4. Information Sharing and Disclosure

4.1 With Other Users

When you list a property or unlock contact information:

• Property listings are visible to all platform users
• Your contact information is shared after payment is processed
• Messages are shared between conversation participants

Tenant search ads

If you publish a tenant search ad, it is visible to everyone who is logged in to Conejome. It is not shown to logged-out visitors or search engines. The ad shows:

• your first name, your profile photo (if you added one) and whether your identity is verified
• the areas, budget, move-in date and type of home you are looking for, your household size, whether you have pets, and your short introduction
• when you were last active

Your ad never shows your last name, email address, phone number, documents or current address. Your photo is stored with your tenant profile and served from a link that doesn't identify your account; other users only see it on your search ad. Search ads and invitation notes can't contain phone numbers, email addresses, links or social media handles. You can pause, edit or close your ad at any time. An ad is shown for 30 days at a time and is hidden as soon as it is paused, closed or expired.

Landlords can invite you to view one of their listings. You see the landlord's first name, whether their identity is verified, the listing and their note. We email you about an invitation when the landlord's identity is verified or the listing has been on Conejome for at least 24 hours (at most one invitation email every 6 hours); other invitations appear only on Conejome. To stop invitations, pause or close your ad, or block a landlord from one of their invitations. You decide whether to reply: if you send an inquiry, it is handled like any other inquiry, and the landlord only sees your contact details after unlocking them for that property.

If you invite a tenant as a landlord, the tenant sees your first name, whether your identity is verified, the listing and your note. We keep invitations as long as the tenant's ad exists.

If you report an ad or an invitation, our support team receives the report together with your account email so they can follow up; the person you reported is not told who reported them. We may restrict accounts that break our rules.

4.2 With Service Providers (Data Processors)

We share information with trusted service providers who process data on our behalf under GDPR-compliant data processing agreements:

• Stripe for payment processing (Note: Conejome does not store credit card details; Stripe processes payments securely)
• Supabase for data storage and authentication
• Didit for optional identity verification (ID document, selfie and liveness check). Processing takes place in the EU. Conejome only stores the verification result and the name on your ID document — document images and biometric data remain with Didit
• Resend for transactional email delivery
• Analytics providers to improve our service (Google Analytics and Microsoft Clarity, only if you accept analytics cookies). Clarity session recordings mask the contents of search ads, invitations and the search ad form

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests from authorities.

5. Data Security

We implement appropriate security measures to protect your information:

• Encryption of data in transit and at rest
• Secure authentication through Supabase
• Regular security audits and updates
• Access controls and monitoring

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights and Choices

Under GDPR and applicable data protection laws, you have the following rights:

• Right of Access (Art. 15) - Access and obtain a copy of your personal information
• Right to Rectification (Art. 16) - Update or correct your personal information
• Right to Erasure (Art. 17) - Delete your account and associated data ("right to be forgotten")
• Right to Data Portability (Art. 20) - Receive your data in a structured, commonly used format and transmit it to another controller
• Right to Object (Art. 21) - Object to processing based on legitimate interests or for direct marketing purposes
• Right to Restriction (Art. 18) - Request restriction of processing under certain circumstances
• Right to Withdraw Consent (Art. 7) - Withdraw consent at any time for processing based on consent (e.g., marketing communications)

How to Exercise Your Rights:

To exercise any of these rights, please contact us at support@conejome.com or dpo@conejome.com. We will respond to your request within one month.

Right to Lodge a Complaint:

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Finnish Data Protection Authority (Tietosuojavaltuutetun toimisto):

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
P.O. Box 800
33101 Tampere, Finland
Website: tietosuoja.fi
Phone: +358 (0)29 566 6700

You also have the right to lodge a complaint with the supervisory authority in your country of residence if you are located in another EU member state.

7. Cookies and Tracking

We use cookies and similar technologies to enhance your experience, analyze usage, and personalize content. Under GDPR, we obtain your consent before using non-essential cookies.

Cookie Categories

Managing Cookies: You can manage or withdraw cookie consent at any time via your browser settings. Note that disabling certain cookies may affect platform functionality.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations.

Retention Periods by Data Category

• Account Data: Retained while your account is active and for 30 days after account deletion (to allow for account recovery)
• Property Listings: Retained while listing is active and for 90 days after deletion (for dispute resolution)
• Messages & Communications: Retained for 12 months after last message or until account deletion
• Tenant Search Ads: Hidden as soon as they are paused, closed or expire, and deleted 6 months after they were closed or expired, together with the invitations they received and any reports about them. A paused ad counts as expired 30 days after it was paused or last edited, so a paused ad you don't resume is deleted about 7 months after that (your ad page shows the date). If you tell us why you closed your ad, we keep that answer for statistics, no longer linked to your account once the ad is deleted; an optional note you add is deleted after 12 months
• Profile Photo: Kept with your tenant profile until you remove or replace it or delete your account. Removing or replacing it deletes the file from our storage right away, and cached copies expire within an hour
• Abuse Prevention Records: Counters of sent invitations, reports and notification emails (without their content) are deleted after 30 days. Account restrictions are kept while they apply
• Payment Records: Retained for 7 years to comply with tax and accounting legal obligations
• Analytics Data: Anonymized after 24 months
• Support Communications: Retained for 3 years after last contact

Account Deletion: When you delete your account, we will:

• Immediately deactivate your account
• Delete your personal information within 30 days
• Anonymize data required for legal compliance or legitimate business purposes
• Retain payment records as legally required (7 years)

Some information may be retained in backup systems for up to 90 days after deletion.

9. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect information from children. If we become aware that we have collected information from a child, we will take steps to delete it.

10. International Data Transfers

Your information may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers (Supabase, Stripe, Resend) operate data centers.

Safeguards for International Transfers

We ensure appropriate safeguards are in place to protect your information when transferred internationally:

• Standard Contractual Clauses (SCC): Where applicable, we use EU-approved Standard Contractual Clauses with our data processors to ensure GDPR-level protection
• EU-US Data Privacy Framework: Some of our service providers participate in the EU-US Data Privacy Framework, providing additional safeguards for transatlantic data transfers
• Data Processing Agreements: All third-party processors are bound by GDPR-compliant data processing agreements
• Technical Safeguards: Encryption in transit and at rest for all data transfers

You have the right to obtain information about the safeguards we use for international transfers by contacting us at dpo@conejome.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Your continued use of Conejome after changes become effective indicates acknowledgment of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: support@conejome.com