Privacy Policy

This policy explains how Flatnumber Ltd ("flatnumber", "we", "us") handles personal data in the flatnumber app — on the web at app.flatnumber.com and on Android and iOS — and on our websites, www.flatnumber.com and help.flatnumber.com.

flatnumber helps the owners and administrators of residential buildings run their community: units and owners, fees and payments, expenses and invoices, budgets, documents, meetings, notices and support tickets.

1. Who we are and our role

Flatnumber Ltd is a company registered in Malta. Address: 28/flat 11 Nazzarenu Street, Sliema SLM 2074, Malta. Privacy contact: privacy@flatnumber.com.

We have two roles, depending on the data:

• We are the controller (we decide why and how the data is used) for our own purposes: your flatnumber account and sign-in, the support you ask from us, keeping the service secure, understanding how our websites and app are used (section 6), and billing our customers.
• We are a processor (we process data on someone else's behalf and on their instructions) for the data used to run each community: its members, units, fees and payments, expenses, documents, minutes, meetings and notices. For that data the controller is the community (the owners' association). If the community uses a managing agent, the agent acts for the community and we work for the agent as its sub-processor. This applies both to communities run by a managing agent and to communities run by their own owners.

If you have a request about your community's data, you can write to your community's administrator or to us; we will pass it on and help them answer it.

2. What data we collect

Your account

• Name and surname, email address, and your password (stored only in encrypted form by our sign-in provider; we never see it).
• Optional: phone number and profile photo.
• If you sign in with Google or Apple, we receive your name and email address from them. With Apple's "Hide My Email", we receive a private relay address and never see your real one. We do not receive your contacts or any other data from your Google or Apple account.

Data about you in a community Usually entered by the community's administrator, sometimes before you join:

• Your name, email and phone number, your unit, and whether you are an owner or an administrator.
• Fees charged to you, payments, and any balance pending.
• Your attendance at meetings and your replies to meeting invitations.

Content that you and others add Expenses and income, invoices and receipts, documents (for example contracts, insurance policies, minutes, certificates and plans), photos and videos, support tickets and their comments, notices, meetings and budgets. Invoices and documents may contain the names of suppliers or other people. Please do not upload health information or other sensitive data unless it is necessary.

The building The community's name and address, and its location on a map.

Technical data

• IP address and server logs, generated when the app talks to our servers.
• App version, device type and operating system.
• Performance measurements (how long screens and network requests take).
• A device token used to send push notifications.
• When you were last active in the app.
• Your notification preferences.

Usage statistics — only if you accept (section 6)

• On our websites: the pages you visit, how you arrived (for example from a search engine or an advert), your approximate location (country and city, derived from your IP address), your browser and device type, and the links you click.
• In the app: the screens you open and the main actions you take (for example creating a community, a fee or an expense — never their content), your role in the community, the platform (web, Android or iOS), your approximate location (country and city, derived from your IP address), and a random identifier for your device or browser. If you are signed in, we also use your internal account identifier so that your activity on our websites and in the app counts as one person, not several.

What we do not collect Your device's precise location, your contacts, payment card details, or advertising identifiers. (On Android, the analytics library declares the permission to read the advertising ID; we have switched that collection off, so the advertising ID is never read or sent.) We do not show ads and we do not track you across other companies' apps or websites.

3. Why we use your data, and our legal basis

We do not sell personal data and we do not use it for advertising.

4. Who can see your data

Other members of your community. By default, the members of your community can see your name and unit. Your email, phone number and profile photo are private by default: you decide in your profile whether other members can see them. The community's administrators can always see your contact details. Members can see the community's financial information, including fees and who has paid, because they share those costs.

Our service providers, who process data only on our instructions and under data protection terms:

We may also disclose data if the law requires it, to protect our rights, or to a buyer if the business is sold — in which case this policy will continue to protect it.

5. Artificial intelligence

flatnumber uses Google's Gemini model through Vertex AI, processed in the European Union (Netherlands), for the two tasks below. Both are started by an administrator, and in both the result is only a draft that an administrator reviews before it is used. No decision with legal or similarly significant effects is taken automatically. Under Google Cloud's terms, Google does not use this data to train its models.

Reading invoices. Administrators can upload an invoice or receipt and ask flatnumber to read it. We send the file to the model, which suggests the amount, date, supplier, invoice number and a category. An administrator always reviews and confirms the draft before it becomes an expense. The draft and the model's answer are stored with the expense in the community's records.

Helping prepare the annual general meeting. Administrators can ask flatnumber to help draft the document presented at the community's annual general meeting (accounts, budget, fees, the state of the building, insurance, planned works and how the meeting works).

• All figures, tables and fees are calculated by flatnumber, not by the AI. The AI writes the explanatory text around them.
• The AI receives the community's financial figures and the fees of each unit, identified by the unit's name, not the owner's; unpaid amounts only as totals, never per unit; short summaries of support tickets (their description, not their comments); and extracts from documents the community has archived (for example its rules, insurance policies and supplier quotes), plus the administrator's answers to the AI's questions. It does not receive owners' names, email addresses or phone numbers.
• The AI cannot read anything else, change data or send anything.
• The draft is visible only to the community's administrators until they decide to share it. It is a support draft, not legal advice: the administrator is responsible for the final document.
• The working material (questions, drafted sections and the data prepared for the AI) is deleted 90 days after the document is finalised; the final document stays in the community's documents. We keep a technical record of each AI request (which records were used, not their content) for security and billing.

We will update this section before using AI for any other purpose.

6. Usage statistics (analytics)

We use Google Analytics (on our websites) and Firebase Analytics (in the app), both provided by Google, to understand how people find flatnumber, which pages and features they use, and whether our campaigns bring new communities. They only run if you accept.

• On our websites (www.flatnumber.com and help.flatnumber.com) you choose in the cookie banner. Your choice is stored in a cookie named fn_consent for one year and applies to all flatnumber websites. You can change it at any time with the "Cookie settings" link in the footer.
• In the app you choose when you create your account (the box is unticked by default) and can change it at any time in Profile → Usage statistics. Nothing is collected until you switch it on.
• If you accept, Google sets cookies (_ga, _ga_*, for up to 13 months) or, in the mobile app, a random app identifier, and receives the usage data described in section 2. Google processes it on our behalf; we have turned off the Google features that would share it with Google's advertising products or combine it with your Google account.
• We use the statistics in aggregate. We do not use them to take decisions about you, to show you ads, or to follow you on other companies' sites or apps.

Our cookie policy at https://help.flatnumber.com/cookies/ lists each cookie and what it is for.

7. International transfers

Your community's data and files are stored in Frankfurt (Germany). Some processing takes place outside the European Economic Area — mainly in the United States, where our server functions run and where Google processes usage statistics, and wherever Google and Apple operate their sign-in and notification services. These transfers are protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU-US Data Privacy Framework (Google LLC is certified). You can ask us for a copy of the safeguards at privacy@flatnumber.com.

8. How long we keep data

• Your account is kept until you delete it.
• Community records (members, fees, payments, expenses, documents, minutes, notices) are kept while the community uses flatnumber, because communities usually have to keep them by law. When a community is deleted, its data and files are deleted with it.
• When you delete your account (section 10), your account and profile are deleted at once — or after 30 days if you are the only administrator of a community with other members. In each community, your membership is either kept without an account (if you are still an owner) or anonymised (if you are not), and the community keeps only the records it must keep by law.
• Usage statistics are kept by Google Analytics for 14 months and then deleted; aggregated reports that cannot identify anyone may be kept longer.
• Backups are deleted automatically within 98 days.
• Server logs are kept for a limited period (normally 30 days) for security and troubleshooting.

9. Security

Data is encrypted in transit and at rest. Access is restricted by security rules: you only see the communities you belong to, and within them only what your role allows. Only authorised staff can access personal data, and only when needed — for example, to answer a support request.

10. Your rights

These rights apply to every user, wherever you live. We give everyone the rights of the EU General Data Protection Regulation (GDPR): you can ask us to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. We do not sell or share your personal data for advertising, and we will not treat you differently for exercising your rights.

• Correct your details in your profile in the app.
• Withdraw your consent to usage statistics in Profile → Usage statistics in the app, or with "Cookie settings" in the footer of our websites.
• Delete your account in the app (Profile → Delete my account), or follow the steps at https://help.flatnumber.com/delete-account.
• For anything else, write to privacy@flatnumber.com. We answer within one month.

If the data was entered by your community's administrator or managing agent (section 1), we will pass your request on to them and help them answer it. Some records may have to be kept because the community is legally required to keep them.

You can complain to the Information and Data Protection Commissioner (IDPC) in Malta (idpc.org.mt), or to the data protection authority of the country where you live.

11. Children

flatnumber is for adults. We do not knowingly collect data from anyone under 18.

12. Cookies and local storage

The app stores only what it needs to work — for example, keeping you signed in and remembering your choices — in your browser or device. Our websites use one cookie of our own, fn_consent, to remember your choice about usage statistics. Google Analytics cookies are set only if you accept (section 6). We do not use advertising or cross-site tracking cookies. Full list: https://help.flatnumber.com/cookies/.

13. Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we tell you in the app or by email before it takes effect.

14. Contact

privacy@flatnumber.com Flatnumber Ltd, 28/flat 11 Nazzarenu Street, Sliema SLM 2074, Malta.