This Privacy Policy explains how Buzybytes Solutions (CRO: 759889), Dublin, Ireland ("we", "us", "our") collects, uses, and protects your personal data when you use the Cohabi platform at cohabi.eu. We are committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Acts 1988–2018 (Ireland).
For the purposes of GDPR, Buzybytes Solutions is the Data Controller. All data protection queries can be directed to connect@cohabi.eu.
1. Data We Collect
1.1 Account Registration Data
- Mobile phone number (used for OTP authentication via Firebase)
- Email address (if Google Sign-In is used)
- Full name
- Age confirmation (18+ declaration)
- Profile photo (optional)
1.2 Host Data
- Room address and location coordinates
- Room photos
- Rental price, availability, and room details
- Amenities and house rules
- Contact phone number (displayed to seekers who have an active paid plan)
1.3 Room Seeker Data
- Search preferences (location, budget, gender preference)
- Requirement listings (if posted)
- Paid plan payment data (processed by Stripe — we do not store card details)
- Verification status (Seeker Pass tier and expiry)
1.4 Technical & Usage Data
- IP address and approximate geolocation
- Device type, browser type, and operating system
- Pages visited, clicks, and session duration
- Meta Pixel conversion and event data (only with your explicit cookie consent)
- Cookies and similar tracking technologies (see our Cookie Policy)
1.5 Communications Data
- Support messages sent to connect@cohabi.eu
- Dispute and complaint records
2. Legal Basis for Processing
We process your personal data only where we have a lawful basis under GDPR Article 6:
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the Platform, authenticate accounts, display listings, and facilitate connections.
- Consent (Art. 6(1)(a)): Processing your phone number for OTP login, displaying your contact number to verified seekers, using the Meta Pixel, and placing non-essential cookies. Consent is freely given, specific, informed, and withdrawable at any time.
- Legitimate interests (Art. 6(1)(f)): Fraud prevention, platform security, and product improvement — where these do not override your fundamental rights.
- Legal obligation (Art. 6(1)(c)): Compliance with Irish law, tax obligations, and responding to lawful requests from authorities.
3. How We Use Your Data
- To authenticate your identity via phone OTP (Firebase) or Google Sign-In
- To create and manage your account and listings
- To display room listings to verified seekers
- To reveal your contact phone number to paying, verified seekers (Hosts only, with your explicit consent)
- To process subscription payments via Stripe
- To send transactional notifications (OTP codes, payment confirmations)
- To detect, investigate, and prevent fraud and platform abuse
- To improve platform features and user experience
- To measure advertising performance via Meta Pixel (with consent)
- To comply with legal obligations
4. Data Sharing & Third-Party Processors
We do not sell your personal data. We share data only with the third-party processors under binding Data Processing Agreements:
- Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4) — processes your phone number and email address strictly for the purpose of identity verification (sending one-time codes by SMS and authenticating Google sign-in). Phone numbers and authentication metadata may be retained in Firebase for fraud prevention and audit purposes. Data is processed within the European Economic Area.
- Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2) — processes subscription payments. We do not store your card details on our servers; Stripe receives and tokenises them directly.
- ImageKit — stores and serves the photos you upload to your listing. Photos are publicly readable by URL once a listing is live; we delete the originals when you remove a listing.
- SendGrid (Twilio Inc.) — delivers transactional email (password resets, receipts). We share the email address and the message body only.
- Google AdSense / Meta Pixel — only when you have explicitly opted in via the cookie consent banner. See section 5 below for details.
5. Meta Pixel — Special Disclosure
We use the Meta Pixel on our Platform. This allows us to:
- Track whether users who clicked our Facebook or Instagram ads subsequently visited cohabi.eu or completed a purchase
- Measure the effectiveness of our advertising campaigns
- In the future, build Custom Audiences to show ads to users with similar interests (retargeting)
The Meta Pixel is only activated with your explicit consent via our cookie consent banner. You may withdraw consent at any time by adjusting your cookie preferences.
6. International Data Transfers
Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) approved by the European Commission. You may request a copy of the relevant safeguards by contacting connect@cohabi.eu.
7. Data Retention
- Account data: Retained for the duration of your account plus 2 years after deletion, unless legal obligations require longer retention.
- Payment records: Retained for 7 years in accordance with Irish tax law (Taxes Consolidation Act 1997).
- Room listings: Deleted 30 days after the listing is marked inactive or the account is closed.
- OTP logs: Deleted within 24 hours of generation.
- Meta Pixel data: Subject to Meta's own retention policies (typically 2 years).
- Support correspondence: Retained for 3 years from the date of resolution.
8. Your Rights Under GDPR
The General Data Protection Regulation offers you a number of rights in relation to your data. These include the right to access a copy of your data, a right to receive a copy of your data that can be transferred to another organisation, a right to data deletion, a right to withdraw your consent to data processing, a right to restrict the processing of your data, and information on any automated decision-making processes.
Right to Access Your Personal Data
Registered users of Cohabi can request a copy of the personally identifiable information we hold about them. To make this request, please contact us directly at connect@cohabi.eu. We will respond within 30 days of receiving your request.
Right to Control Your Personal Data
Registered users can update their personal information by logging into their account and editing it directly from their dashboard. You can also contact our support team at connect@cohabi.eu to request any necessary changes and ensure your information is accurate and up to date. You may update your contact preferences at any time from your account dashboard.
Right to Data Deletion
You may request that we delete any personally identifiable information we hold about you by contacting us at connect@cohabi.eu. Please note that in some instances we may be unable to delete your data where we are required to retain it to comply with our legal obligations — including payment records which must be retained for 7 years under Irish tax law, or requests from law enforcement agencies.
Right to Data Portability
You have the right to data portability. This means you can request that a copy of your data is made available in a structured, commonly used, and machine-readable format that can be transferred to you or to another organisation. To request a portable copy of your data, please contact us at connect@cohabi.eu.
Right to Restrict Processing
You have the right to request that we limit how we process your personal data in certain circumstances — for example, if you contest the accuracy of the data we hold, or if you have objected to our processing and we are assessing that objection. Contact us at connect@cohabi.eu to make such a request.
Right to Withdraw Consent
Where we rely on your consent as the legal basis for processing your data — for example, for phone OTP authentication, revealing your contact number to verified seekers, or placing advertising cookies — you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal. Cookie consent can be withdrawn at any time via the Cookie Settings link in our footer. All other consent withdrawals can be requested at connect@cohabi.eu.
Right to Object to Direct Marketing (Art. 21)
You have an absolute right to object to your personal data being used for direct marketing — including our occasional promotional emails (launch offers, re-engagement nudges, weekly listing digests). When you object, we will stop sending you marketing email immediately.
How to opt out:
- Click Unsubscribe in the footer of any marketing email we send. This is a one-click action — no login required.
- In Gmail or Yahoo, use the Unsubscribe link that appears next to the sender name (RFC 8058 one-click unsubscribe).
- Email connect@cohabi.eu with the subject line Unsubscribe if neither of the above works.
Opting out of marketing email does not stop transactional email — payment receipts, password resets, plan-expiry reminders and listing notifications. Those messages are necessary for the performance of your contract with us (GDPR Art. 6(1)(b)) and you have a right to receive them while your account remains active. To stop those as well, you must close your account — see "Right to Data Deletion" above.
You can re-subscribe at any time from the same page that you unsubscribed from.
9. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- TLS/HTTPS encryption for all data in transit
- Database encryption at rest
- Access controls limiting who can access personal data
- Authentication handling OTP security
- Regular security reviews
In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the Irish DPC within 72 hours and affected individuals without undue delay.
10. Children
Cohabi is intended solely for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover a user is under 18, we will immediately delete their account and all associated data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice on the Platform at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the updated Policy.
12. Contact
Buzybytes Solutions — Data Controller
CRO No. 759889
Dublin, Ireland
Email: connect@cohabi.eu
Website: cohabi.eu