Legal

Privacy Policy

Effective date: 15 July 2026

Urban Tribe ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and share your personal data when you use the Urban Tribe platform (the "Platform"), and describes your rights under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Irish Data Protection Acts 1988–2018.

GDPR at a glance

Urban Tribe is the data controller for personal data processed on this Platform. We are based in Ireland, so the Data Protection Commission (DPC) is our lead supervisory authority. Your rights include access, rectification, erasure, restriction, portability and objection — see Section 9 for details.

1. Who we are (data controller)

The data controller is Urban Tribe, registered in Ireland. For all data protection matters, contact us at dpo@urbantribe.io.

2. What personal data we collect

2.1 Data you provide directly

Account registration	Full name, email address, password (hashed), Google account ID (if using Google Sign-In).
Profile	Age, nationality, languages spoken, personal bio, occupation, university or employer (optional), profile photo.
Living preferences	Lifestyle information (pets, smoking, sleep schedule, social vibe, tidiness) used for roommate matching.
Listings	Property address and coordinates, photos, description, price, availability, BER rating.
Reviews	Free-text reviews you write about landlords, tenants or properties.
Communications	Messages sent via the masked chat feature.
Support	Any information you share when contacting us for help.

2.2 Data collected automatically

Device & browser	Browser type and version, operating system, device type, screen resolution.
Usage data	Pages visited, features used, search queries (including natural-language queries to our AI search), timestamps.
IP address	Used for geolocation (country/city level) and security fraud detection.
Cookies & local storage	Session cookies required for authentication; preference cookies (if you consent). See Section 8.

2.3 Data from third parties

Google OAuth	If you sign in with Google: your name, email and profile picture as provided by Google.
Google Cloud Storage	Metadata associated with uploaded images (file size, format, upload timestamp).

3. How we use your data and our legal basis

Under GDPR, we must have a lawful basis for every processing activity. The table below sets out each purpose, the data used, and the applicable lawful basis.

Purpose	Data used	Lawful basis
Create and manage your account	Name, email, password	Contract (Art. 6(1)(b))
Authenticate your identity at login	Email, password hash, session token	Contract (Art. 6(1)(b))
Display your public profile to other users	Name, photo, bio, preferences, reviews	Contract (Art. 6(1)(b))
Publish and display listings	Listing content, address, photos	Contract (Art. 6(1)(b))
Roommate lifestyle matching	Living preferences	Contract (Art. 6(1)(b))
Facilitate viewing scheduling and masked chat	Messages, viewing requests	Contract (Art. 6(1)(b))
Smart alerts (price drops, new listings)	Search preferences, email	Contract / Legitimate interests (Art. 6(1)(f))
AI conversational search (Claude API)	Natural-language search query only — no PII is sent	Legitimate interests (Art. 6(1)(f))
Detect and prevent fraud and scams	IP, usage data, listing data	Legitimate interests (Art. 6(1)(f))
Improve and develop the Platform	Aggregated, anonymised usage data	Legitimate interests (Art. 6(1)(f))
Send transactional emails (viewing confirmations, password resets)	Email address	Contract (Art. 6(1)(b))
Send marketing emails	Email address	Consent (Art. 6(1)(a)) — opt-in only
Comply with legal obligations (e.g. tax, law enforcement requests)	As required	Legal obligation (Art. 6(1)(c))

Legitimate interests balancing test: Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You have the right to object to such processing — see Section 9.

4. AI search — how we handle your queries

The Platform uses the Anthropic Claude API to convert your natural-language search queries (e.g. "room near UCD under €900, bills included") into structured database filters.

Only the search query text itself is sent to the API. Your name, email, profile data or account identifiers are never included in API calls to Anthropic.

Anthropic processes data as a data processor on our behalf under a data processing agreement. Anthropic does not use your query to train its models. See Anthropic's privacy policy for full details.

5. Who we share your data with

We do not sell your personal data. We share data only with:

Recipient	Purpose	Safeguard
Supabase (PostgreSQL database & Auth)	Store all user and listing data	Data processor agreement; EU-hosted infrastructure option available
Anthropic (Claude API)	AI-powered search query conversion	Data processor agreement; query text only, no PII
Google Cloud Storage (GCS)	Photo and media storage and delivery via Google Cloud Functions	Data processor agreement; EU storage regions available
Vercel	Web application hosting	Data processor agreement; EU edge locations available
Google (OAuth)	Sign-in authentication (only if you use Google Sign-In)	Standard contractual clauses
Email delivery provider	Transactional emails (viewing confirmations, alerts)	Data processor agreement
Law enforcement / authorities	Only when required by law or court order	Legal obligation; we will notify you where permitted

International transfers: Some of our processors (Anthropic, Google Cloud, Vercel) may process data in the United States. Where this occurs, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or other appropriate transfer mechanisms under GDPR Chapter V.

6. Data retention

Data category	Retention period
Account and profile data	For the lifetime of your account, plus 12 months after deletion (for fraud prevention and dispute resolution)
Listings	Active while published; archived for 24 months after removal (required for potential RTB or legal queries)
Messages (masked chat)	12 months after a viewing is completed or declined, then deleted
Reviews	Indefinitely while your account exists; removed within 30 days of account deletion
Usage logs and IP addresses	90 days, then anonymised
Legal / compliance records	As required by applicable Irish and EU law (typically 6–7 years for financial/tax records)
Deleted accounts	Personal identifiers removed within 30 days; anonymised aggregated data may be retained indefinitely

7. Security

Passwords are stored using industry-standard hashing (bcrypt/Argon2). We never store passwords in plain text.

All data in transit is encrypted via TLS 1.2 or higher. Data at rest is encrypted using AES-256.

Access to personal data is restricted to personnel who require it to operate the Platform, and is subject to strict access controls and audit logging.

We conduct regular security reviews and act promptly on identified vulnerabilities.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the DPC within 72 hours and, where required, notify affected users without undue delay.

8. Cookies

Cookie type	Purpose	Basis
Session / authentication cookies	Keep you logged in; strictly required for the Platform to function	Strictly necessary — no consent required
Preference cookies	Remember UI preferences (e.g. map vs grid view)	Consent — you can decline via our cookie banner
Analytics cookies	Understand aggregate usage patterns (anonymised)	Consent — you can decline via our cookie banner

You can withdraw consent for non-essential cookies at any time via the cookie settings link in the Platform footer. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

9. Your rights under GDPR

As a data subject under GDPR, you have the following rights. To exercise any right, email us at dpo@urbantribe.io. We will respond within one calendar month (extendable by two months for complex requests, with notice).

Right	What it means
Right of access (Art. 15)	Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)	Correct inaccurate or incomplete personal data. You can update most data directly in your profile settings.
Right to erasure ("right to be forgotten") (Art. 17)	Request deletion of your data. We will comply unless we have a legal obligation or legitimate reason to retain it (e.g. dispute resolution).
Right to restriction of processing (Art. 18)	Ask us to pause processing your data while a dispute is resolved.
Right to data portability (Art. 20)	Receive your data in a structured, machine-readable format (JSON/CSV) and transfer it to another service.
Right to object (Art. 21)	Object to processing based on legitimate interests (including profiling). We will stop unless we demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3))	Where processing is based on consent (e.g. marketing emails, non-essential cookies), you may withdraw consent at any time without affecting prior processing.
Right not to be subject to automated decisions (Art. 22)	We do not make solely automated decisions that produce significant legal effects on you. Our AI search only converts queries to filters — humans remain in control of any rental decision.

Right to lodge a complaint: If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie or call +353 (0)76 110 4800. You may also contact the data protection authority in your country of residence within the EU.

10. Children's privacy

The Platform is not directed at persons under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, contact us at dpo@urbantribe.io and we will delete it promptly.

11. Links to third-party sites

The Platform may contain links to third-party websites (e.g. Daft.ie listings referenced in our neighbourhood guides). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or in-app notification at least 30 days before the change takes effect, and will update the "Effective date" at the top of this page.

Continued use of the Platform after the effective date constitutes acknowledgment of the updated policy.

13. Contact and DPO

For all privacy-related queries, including exercising your GDPR rights, contact our data protection contact at:

Urban Tribe — Data Protection

Email: dpo@urbantribe.io

General enquiries: legal@urbantribe.io