Privacy Policy

This policy is issued by Admy SpA (RUT 77.209.382-9), operator of the Roomate brand, as data controller, under Chilean Law No. 19.628 on personal data protection, as comprehensively amended by Law No. 21.719 (published 13 December 2024; general entry into force 1 December 2026 unless a later statute postpones that date). Until that date the current Law 19.628 still applies; we already follow the information, consent, and rights standards of Law 21.719.

Admy SpA, RUT 77.209.382-9, operator of the Roomate marketplace for long-term room rentals, decides the purposes and means of processing. Legal representative: Danilo Cortés Farías. Contact for privacy requests: [email protected]. Postal contact: Santiago, Chile. There is currently no data protection officer appointed; requests go to the same email.

Data comes from you when you register, publish, pay, or contact us. We do not buy personal data from public lists.

• Identity and account: full name, email, password (hashed by the authentication provider).
• Contact: WhatsApp/phone if you add it to publish or to your profile.
• Listing content: title, description, address/comuna, price, photos, house rules.
• Payments: Flow.cl processes cards; we store purchase status and slot credits, not card numbers.
• Technical: session cookies, language cookie, IP and device data if you accept analytics.
• Support: messages you send to [email protected] or WhatsApp.

• Create and manage your account and keep you signed in.
• Publish, display, and expire room listings.
• Let seekers contact owners via WhatsApp.
• Process listing-slot payments through Flow.cl.
• Send transactional email (confirm account, recover password, listing expiry).
• Send service reminders about unused listing slots (you may object).
• Measure site use with Google Analytics only if you consent to analytics cookies.
• Prevent abuse (Cloudflare Turnstile) and keep the service secure.

Consent is not the only basis. We rely on:

• Performance of the contract: account, listings, payments, and transactional email.
• Consent: analytics cookies and any optional marketing beyond the service. You may withdraw it at any time without affecting prior lawful processing.
• Legitimate interest: security, fraud prevention, and unused-slot reminders to users who already have an account, balanced against your right to object.
• Legal obligation: tax, accounting, or orders from competent authorities.

We do not sell your data. We share it only with providers needed to run Roomate:

Some providers (Supabase, Resend, Google, Cloudflare, DigitalOcean) may process data outside Chile, including the United States. We use them because they are required to operate the service, under contracts and security measures (HTTPS, access controls). If a destination is not recognized as adequate by Chilean law, the transfer is based on those contractual safeguards and, for analytics, your consent.

You may request access, rectification, erasure, objection, temporary blocking while a request is pending, and portability of your personal data, as provided by Law 21.719. Write to [email protected] with the subject “Personal data rights request”. We will reply within the legal term. You can correct your name, bio, and WhatsApp from your account. You may also lodge a complaint with the Agency for the Protection of Personal Data (Agencia de Protección de Datos Personales) if we refuse or do not answer in time.

We keep account and listing data while the account is active. If you request deletion, we erase or anonymize personal data within 30 days, except records we must keep for legal or accounting duties (for example payments) for the applicable statutory period. Analytics data, if consented, follows Google’s retention settings.

We apply encryption in transit (HTTPS), database access policies (RLS), hashed passwords, and least-privilege access. No method is 100% risk-free; we review measures as technology and our size allow (Law 21.719 art. 14 quinquies and 14 septies).

If a security breach reasonably risks your rights, we will notify the Agency without undue delay and keep an internal record of the event, as required by Law 21.719. Where the law so requires (sensitive data or similar), we will also inform affected users in clear language.

Roomate is for adults. You must be 18 or older to create an account. We do not knowingly process data of children under 14. If you believe a minor registered, write to us and we will delete the account.

We do not make legally significant automated decisions or profiling that produces legal effects about you. Listing ranking on the home page is recency-based, not a personal score.

Use the contact page or the email above. Say which right you exercise and enough information to identify your account (registered email). If we need more data to verify identity, we will ask. You may withdraw analytics consent from the cookie banner or cookie policy without closing your account.

We may update this policy. The version and date below always apply. Material changes will be published on this page.