Privacy Policy

Who we are

flat.social is operated by Borkowski Consulting Ltd, a company registered in England and Wales under company number 09958565, with its registered office at 2 Cambridge Mansions, 13 Bromells Road, Clapham, London, SW4 0BN, United Kingdom. In this policy "we", "us" and "our" mean Borkowski Consulting Ltd.

We are the data controller for the personal data described in this policy, with one exception. When a host collects data from their attendees through the Services, for example answers to interactive slides or forms they set up, the host is the controller of that data and we process it on their behalf under the data processing terms in our Terms and Conditions. You can reach us about anything privacy related at [email protected].

The short version

• We do not record your calls. Audio, video and screen shares are relayed between participants through our own media servers in real time. We do not store, transcribe or analyse them.
• We do not use your data to train AI, and we do not run any AI on your conversations.
• We do not sell your personal data and we do not run advertising or ad tracking on flat.social.
• We keep what we need to run the service: your account, the content you create in a flat such as chat messages and whiteboard notes, and statistics about how rooms are used.
• You can delete your account yourself from your profile settings, and it removes your data as described below.

The rest of this policy gives the detail.

Table of contents

1. What data we collect
2. Why we use it and our legal basis
3. Who we share it with
4. Where your data is stored
5. How long we keep it
6. Calls, video and screen sharing
7. What hosts and other participants can see
8. Analytics, error reporting and cookies
9. Social logins
10. Your rights
11. Children
12. Changes to this policy
13. Contact us

1. What data we collect

Account data

When you create an account we store your email address, your name, your username, your avatar image if you upload one, the sign-in method you used, and the dates you created your account and last signed in. If you sign in with Google or Facebook we receive your name, email address and profile picture from that provider.

Guest data

You can join a flat as a guest without creating an account, if the host allows it. For guests we create a random identifier that is not linked to a name or email address, and store the display name you choose. The identifier persists in your browser so that you keep the same name between visits. The display name is kept in your own browser and sent to us when you join a room. We do not collect an email address from guests.

Content you create in a flat

Flats contain content created by their participants. Depending on what you use, this includes chat messages and direct messages, sticky notes on whiteboards, answers to interactive slides, comments on in-world billboards, and images you upload such as avatars, logos, whiteboard images and slide images. Each item is stored together with your display name and identifier so it can be shown to the right people.

Session statistics

While you are in a room we record when you joined and left, which room you were in, how long your camera, microphone and screen share were on, roughly how long you spoke, how many messages and reactions you sent, and in-room activity such as distance moved. We also record the country you connected from. These statistics power the Insights feature for hosts, described in section 7, and help us understand how rooms are used.

Billing data

If you buy a plan or a day pass, payment is handled by Stripe. We store the identifiers Stripe gives us, your plan, the number of seats, and the dates of your subscription or pass. We never see or store your full card number.

Technical data

When you use flat.social we automatically receive your IP address, browser and device type, operating system, language preference, the page you came from, and timestamps of requests. This is needed to deliver the service, keep it secure and prevent abuse.

Invitations

When you invite someone by email we store their email address, who invited them, and whether the invitation was accepted. We use it only to send the invitation and to add them to your flat if they accept.

Feedback and support

When you send feedback or contact us we keep the message and your contact details so we can reply.

Data we do not ask for

We do not ask for sensitive personal data such as health, biometric, financial or government identification data, and our terms prohibit sharing it through the service. If you put such data into a message or an upload anyway, it is stored like any other content, so please do not. We do not collect data about you from data brokers, public databases or marketing partners.

2. Why we use it and our legal basis

Under UK and EU data protection law we need a legal basis for each way we use your data.

We do not make automated decisions about you that have legal or similarly significant effects.

3. Who we share it with

We use a small number of service providers to run flat.social. They process data on our instructions and cannot use it for their own purposes, with one exception: Stripe also acts as an independent controller for payment fraud prevention and its own legal obligations, under Stripe's privacy policy.

We also share data when you ask us to, for example when you invite someone by email, and when the law requires it, for example in response to a valid legal request. If flat.social is ever sold or merged, your data would be transferred to the new owner under the same protections.

We do not share your data with advertisers and we do not sell it.

4. Where your data is stored

Our servers are located in the United Kingdom, the European Union and the United States. Our media servers that relay calls are placed in these regions so that calls stay fast for participants wherever they are.

When personal data is transferred outside the United Kingdom or the European Economic Area, the transfer is covered by the data processing terms we have with each provider. These use the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or the provider's certification under the EU-US Data Privacy Framework and its UK extension where the provider holds one. You can ask us which mechanism covers a specific provider.

5. How long we keep it

When a host deletes a flat, it is removed from the service immediately and its content is no longer accessible to anyone. The underlying data is permanently erased when the host asks us to, or when the host deletes their account. Email [email protected] if you want a deleted flat erased straight away.

When you delete your account, the flats you own alone are deleted with everything in them. If a flat has other owners or role holders, you must hand it over or remove them before the account can be deleted, so that other people's flats do not disappear. If that blocks you, email [email protected] and we will delete your account and data for you.

6. Calls, video and screen sharing

Audio, video and screen shares are transmitted through media servers we operate. They are encrypted in transit. They are not recorded, stored, transcribed or analysed by us, and they are not used to train any model. When a room ends, nothing from the call remains on our servers other than the session statistics described in section 1.

If a host or participant records a call using their own software, that recording is outside our control and the person recording is responsible for it.

7. What hosts and other participants can see

flat.social is a shared space, so some of your data is visible to the people in it.

• Other participants in a flat can see your display name, your avatar, which room you are in, and anything you say, write or share in that room.
• Members of a flat can see the member list with names, avatars and roles. Email addresses are not shown to other members.
• Hosts with the Insights permission can see aggregated statistics about their flat, such as attendance, peak numbers and average time spent. Insights are designed so that individual people are not singled out. Hosts cannot read direct messages between other people.
• Public pages. A flat's name, description, logo and cover image may be shown on a public landing page, and a host can embed a live "people online" counter on their own website. Images you upload are served from a public content network so that they load quickly, so do not upload anything you would not want to be viewable by anyone with the link.

The host of a flat sets its own rules and is responsible for how they run their events. If you have questions about how a particular host uses the space, please ask them.

8. Analytics, error reporting and cookies

Product analytics

We use Mixpanel, hosted in the European Union, to understand how flat.social is used, for example which features are popular and where people get stuck. For signed-in users, analytics are linked to your account and include your email address and name so we can look into problems you report. Guests are tracked under a random identifier, without a name or email address. Mixpanel honours your browser's Do Not Track setting.

We also use Google Analytics on flat.social. We do not send your email address, name or username to Google Analytics; it receives a pseudonymous identifier only.

Error reporting

We use Sentry, hosted in the European Union, to find and fix errors. Error reports can include your account identifier, the page you were on and technical details about your browser. For a small sample of sessions, and for sessions where an error occurred, Sentry also records a replay of what happened on your screen inside flat.social so we can reproduce the problem. Replays capture the interface, not your camera or microphone, and are deleted after 90 days at most.

Cookies and similar storage

We use the following cookies and browser storage:

If you are in the United Kingdom, the European Economic Area or Switzerland, analytics cookies are set only after you accept them in the cookie banner, and you can change your choice at any time through the "Cookie settings" link in the footer or the Privacy section of your profile settings in the app. Elsewhere analytics run by default and the same controls let you switch them off. Session replay for error reporting follows the same choice. We use your approximate location, from the country your connection comes from, only to decide whether to show the banner. Analytics cookies are not required for flat.social to work, and we do not use advertising cookies.

9. Social logins

You can sign in with Google or Facebook. When you do, we receive your name, email address and profile picture from that provider and use them to create and sign you into your account. We do not receive your friends list or post on your behalf. How Google or Facebook use your data is governed by their own privacy policies.

10. Your rights

You have the right to:

• access the personal data we hold about you;
• correct it if it is wrong. You can edit your name, username and avatar in your profile settings;
• delete it. You can delete your account and its data from your profile settings at any time, or ask us to do it for you;
• receive a copy of the data you gave us in a portable format;
• restrict or object to certain processing, including processing based on our legitimate interests;
• withdraw consent where we rely on it, for example for analytics cookies.

To exercise any of these rights, email [email protected]. We will respond within one month. We may need to verify your identity first.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office at ico.org.uk or, if you live in the European Economic Area, to your local data protection authority. We would appreciate the chance to resolve the issue first.

11. Children

flat.social is not for anyone under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account or joined a flat, please email [email protected] and we will remove the data.

12. Changes to this policy

We may update this policy as the service changes. The date at the top shows when it was last updated. If we make a material change, we will email account holders and show a notice in the app before the change takes effect.

13. Contact us

Borkowski Consulting Ltd
2 Cambridge Mansions, 13 Bromells Road
Clapham, London, SW4 0BN
United Kingdom
Company number 09958565

Email: [email protected]