Privacy policy

Technical draft, not legal advice. Boommate processes personality/value scores from the Kornelia interview — partly special-category personal data under Art. 9 GDPR. This text should be reviewed by legal counsel before a real launch.
Beta notice: Boommate is currently in a testing phase. Participation (the waitlist, and later the interview) is voluntary. Identity verification for offering users is currently a simplified test process, not yet a full ID check (e.g. via PostIdent) — a proper security concept is in development. The "verified" badge should be understood with that caveat during the testing phase.

1. Data controller

See legal notice. Contact for data-protection questions: info@boommate.de

2. What we process

  • Waitlist (prelaunch): name and email address you voluntarily provide via the signup form (see section 4 on Tally)
  • Account: email, name, password hash
  • Profile: age, city, budget, lifestyle answers, address (only once an active invitation is sent)
  • Kornelia interview: free-text answers plus derived personality (Big Five), values (Schwartz) and conflict-style scores, life phase — special category under Art. 9 GDPR, collected only after explicit consent before the interview starts
  • Messages between users (chat)
  • Payment status (currently simulated, see section 5)

3. Legal bases

  • Art. 6(1)(b) GDPR — contract performance (account, matching, communication)
  • Art. 9(2)(a) GDPR — explicit consent for the personality/value data from the interview
  • Art. 6(1)(f) GDPR — legitimate interest in fraud/abuse prevention (e.g. login lockout after failed attempts)

4. Recipients / processors

The following providers process data on our behalf or receive it to deliver the service:

  • Tally (Tally Labs OÜ) — processes the name and email address from the waitlist form on the prelaunch page (possible third-country transfer; data-processing-agreement status needs to be confirmed before the real product launch).
  • Vercel Inc. — application hosting
  • Neon Inc. — database (EU region)
  • Resend — sending notification emails
  • Anthropic PBC — processes the free-text interview answers to generate Kornelia's reactions (third-country transfer, USA; the data-processing-agreement / Data Privacy Framework status needs to be confirmed before launch).

5. Payments

Boommate is currently free to use. The Stripe integration prepared in the code is deliberately simulated (no real payment, no card data processed) — it will only be activated once a real paywall is introduced, at which point this policy will be updated accordingly.

6. Retention

Data is retained for as long as the account exists. Deleting the account immediately removes the profile, messages, interview answers and match requests (see section 7).

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time.

You can trigger data export and account deletion yourself under My account. You also have the right to lodge a complaint with a data protection supervisory authority.