Privacy Policy

Squarelly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our rental marketplace platform.

This policy applies to all users of the Squarelly platform, including property owners, renters, and property managers. By using our Service, you consent to the data practices described in this policy.

As we operate in Malta, we comply with the General Data Protection Regulation (GDPR) and Malta's Data Protection Act.

1. Data Controller

Squarelly is the data controller responsible for your personal information. For any privacy-related questions or to exercise your rights, please contact us via our support form.

Squarelly is a brand operated by Fulcrum Station Ltd — Birkirkara, Malta

2. Information We Collect

Information You Provide

We collect information you provide directly to us:

• Account Information: Name, email address, password, role (owner/renter/property manager)
• Profile Information: Profile photo, mobile phone number, preferences
• Verification Information: Government-issued photo ID (processed via Stripe Identity), payment card details
• Property Listings: Property details, photos, descriptions, location, rental terms
• Communications: Messages between users, support enquiries
• Payment Information: Payment card details (processed and stored by Stripe)

Information Collected Automatically

When you use our Service, we automatically collect:

• Usage Data: Pages viewed, features used, search queries, compatibility scores
• Device Information: IP address, browser type, operating system, device identifiers
• Analytics Data: Property view counts, click tracking, user behaviour analytics
• Cookies and Similar Technologies: See Section 9 below

Information from Third Parties

• Stripe: Payment verification status, card authorisation confirmations, identity verification results
• SMS Provider: Mobile verification confirmations

3. How We Use Your Information

To Provide Our Service

• Create and manage your account
• Process property listings and searches
• Calculate compatibility scores between renters and properties
• Facilitate communication between owners and renters
• Process payments for contact access
• Verify your identity and calculate trust scores

To Improve and Personalise

• Analyse usage patterns to improve our Service
• Personalise your experience and recommendations
• Develop new features and services

To Communicate

• Send transactional emails (account verification, payment confirmations, invoices)
• Notify you of messages, updates, and property changes
• Send marketing communications (with your consent)
• Respond to your support requests

For Safety and Security

• Verify user identities through Stripe Identity
• Detect and prevent fraud, spam, and abuse
• Enforce our Terms of Service
• Protect the rights and safety of our users

Legal Obligations

• Comply with legal requirements and regulations
• Respond to lawful requests from authorities
• Maintain tax and accounting records

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• Contractual Necessity: To provide our Service as outlined in our Terms of Service
• Consent: For marketing communications, cookies, and identity verification
• Legitimate Interests: To improve our Service, prevent fraud, and ensure security
• Legal Obligations: To comply with applicable laws and regulations

5. How We Share Your Information

With Other Users

When you use our Service, certain information is shared with other users:

• Public Profile: Name and verification badges are visible to other users
• After Payment: Owner contact details are shared with the renter once a contact fee is paid and the owner confirms availability
• Property Listings: Visible to all users browsing the platform

Service Providers

We share information with trusted third-party service providers:

• Stripe: Payment processing, card verification, and identity verification via Stripe Identity
• Mailtrap / SendGrid: Email delivery
• Twilio: Mobile SMS verification
• Railway: Cloud hosting and infrastructure
• Analytics Services: Usage analytics (anonymised where possible)

Legal Requirements

We may disclose your information if required by law, court order, or legal process, or to protect the rights, property, or safety of Squarelly, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity.

6. Identity Verification and Data Handling

Identity verification on Squarelly is carried out through Stripe Identity. When you submit a government-issued ID document for verification:

• The document is transmitted directly to Stripe and processed in accordance with Stripe's data protection standards
• Squarelly receives a verification result (verified / not verified) and stores that status only
• Squarelly does not store copies of your identity documents
• Identity documents are not shared with other users of the platform under any circumstances

For details on how Stripe handles your identity data, please refer to Stripe's Privacy Policy.

7. Data Retention

We retain your personal information for as long as necessary to provide our Service and fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

• Account Data: Retained while your account is active and for 6 months after closure
• Identity Verification Status: Retained for the duration of your account
• Payment Records: Retained for 7 years for tax and accounting purposes
• Analytics Data: Anonymised and aggregated data may be retained indefinitely

8. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention requirements
• Right to Restrict Processing: Request limitation on how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent for processing based on consent at any time
• Right to Lodge a Complaint: File a complaint with the Malta Information and Data Protection Commissioner or your local supervisory authority

To exercise any of these rights, please contact us via our support form. We will respond within 30 days.

9. Cookies and Tracking Technologies

Cookies are small text files stored on your device that help us provide and improve our Service.

Types of Cookies We Use

• Essential Cookies: Required for the Service to function (authentication, security). These cannot be disabled.
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with our Service
• Marketing Cookies: Used to measure whether advertising we run elsewhere brings people to Squarelly. We do not currently use any marketing cookies. If that changes, none will be set unless you consent to them first.

What We Do Not Do

We do not sell, rent or trade your personal data.

We do not display third-party advertising on Squarelly. The only listings you see are properties published by owners and property managers on the platform, each of whom has completed identity verification before being able to list. Nothing on Squarelly is a paid placement, and no listing is promoted in search in exchange for payment.

We may advertise Squarelly itself on other platforms. That is separate from the Service, and any measurement of it would fall under the marketing cookies described above — which require your consent.

Managing Cookies

You can control cookies through our cookie consent banner and your browser settings. Note that disabling certain cookies may limit your ability to use some features of the Service.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal information:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Incident response procedures

However, no method of transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

11. International Data Transfers

Your personal information may be transferred to and processed in countries outside the European Economic Area (EEA) where our service providers are located. In such cases, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses and adequacy decisions by the European Commission.

12. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

13. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email.

Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. Contact

If you have questions about this Privacy Policy or wish to exercise your GDPR rights, please contact us via our support form.

Malta Data Protection Authority: Office of the Information and Data Protection Commissioner — idpc.org.mt