Privacy policy

RoomSwapping acts as the data controller for the personal information you provide when using the platform. The controller is:

RoomSwapping<br/>A simplified joint-stock company (société par actions simplifiée) with share capital of €1,000<br/>Registered with the Paris Trade and Companies Register (RCS) under number 106 194 012<br/>Registered office: 47 rue Vivienne, 75002 Paris, France<br/>Legal representative: Ava TON THAT, President

For privacy-related requests, contact us at [email protected] or via the Contact page.

We collect only the information reasonably necessary to operate, secure, and improve the platform. Categories of data may include:

• Account and identity data: email address, authentication information handled through our identity provider, display name, profile photo, language preferences, and selected account role.
• Verification data: identity documents, selfies, student verification documents, or similar information where verification features are used.
• Listings and user content: room descriptions, photos, pricing, availability, house rules, reviews, and profile information.
• Bookings and communications: booking details, exchange information, messages exchanged through the platform, and dispute-related evidence.
• Payment-related data: booking amounts, payout status, fees, refunds, and transaction identifiers. Payment card details are processed directly by Stripe and are not stored by RoomSwapping.
• Technical and security data: IP address, browser type, device information, session information, cookies, logs, and anti-fraud or abuse-prevention signals.
• Optional information: biography, interests, spoken languages, lifestyle preferences, or introduction videos that you choose to share.

• To create, manage, and secure user accounts
• To verify identity, student status, or eligibility for specific features
• To facilitate bookings, room exchanges, messaging, payments, refunds, and dispute resolution
• To personalise listings and improve matching between guests and hosts
• To detect fraud, abuse, suspicious activity, fake content, or platform misuse
• To send transactional communications such as booking confirmations, password resets, moderation notices, or support responses
• To comply with legal, tax, accounting, regulatory, or law-enforcement obligations
• To improve the reliability, safety, and performance of the platform
• To attribute sign-ups and marketplace activity to a partner (e.g. a student association or university) when you join using their partner code, for internal acquisition reporting — partner reporting is aggregated and partners do not receive your personal data

If you are located in the EEA or the UK, we rely on the following legal bases:

• Performance of a contract — to provide the platform and related services you requested.
• Legitimate interests — to secure the platform, prevent fraud, moderate content, improve features, and operate the service efficiently.
• Legal obligation — to comply with applicable legal, financial, tax, or regulatory requirements.
• Consent — where legally required, for optional features or communications that rely on consent.

We do not sell personal data. We may share data only with:

• Other users where necessary to facilitate bookings, exchanges, messaging, reviews, or profile visibility.
• Service providers and processors acting on our behalf under contractual safeguards.
• Authorities or regulators where required by law, legal process, or legitimate safety concerns.
• Successors or acquirers in the event of a merger, financing, restructuring, acquisition, or sale of assets.

• Stripe — hosted payment processing (Stripe-hosted Checkout) and host payouts. Card details are entered on Stripe's hosted pages, never on RoomSwapping.
• Railway / Tigris — infrastructure hosting and object storage.
• Resend — transactional email delivery only (no marketing or newsletter emails).
• Anthropic (Claude) — optional AI-assisted listing import and assistance features.
• Playwright — server-side page rendering used by the listing-import feature.
• Meta Platforms (Facebook) — advertising measurement via the Meta Pixel (browser-side) and the Conversions API (server-side), only after you accept marketing cookies.

These providers may process data according to their own legal obligations and privacy policies. We do not sell personal data, and we use external uptime monitoring that does not set cookies on your device or receive your personal data.

Most platform data is processed within the European Union. Some service providers may process data in other jurisdictions, including the United States. Where required, RoomSwapping relies on Standard Contractual Clauses or equivalent legal safeguards for international data transfers.

• Account data: retained while your account remains active and deleted or anonymised within a reasonable period after account deletion unless legal obligations require longer retention.
• Bookings and payments: generally retained for legal, tax, accounting, and dispute-management purposes.
• Verification documents: retained only as long as reasonably necessary for verification, fraud prevention, or legal compliance.
• Messages and reviews: retained while necessary for platform operations, trust and safety, or dispute handling.
• Security logs: retained for a limited duration unless longer retention is required for security or legal reasons.

We implement reasonable technical and organisational measures designed to protect personal data, including encrypted connections, access controls, authentication safeguards, logging, and infrastructure security measures.

However, no online platform or electronic storage system can guarantee absolute security. Users remain responsible for maintaining the confidentiality of their credentials and devices.

Depending on your location and applicable law, you may have rights including:

• Access to your personal data
• Correction of inaccurate data
• Deletion of certain data
• Restriction or objection to certain processing activities
• Data portability
• Withdrawal of consent where processing relies on consent
• Complaint to a competent supervisory authority

Requests may be submitted via the Contact page or by emailing [email protected].

RoomSwapping is intended for adults aged 18 or older. We do not knowingly collect personal data from minors. If you believe that a minor has created an account, please contact us so appropriate action can be taken.

We may update this Privacy policy from time to time to reflect legal, operational, technical, or platform changes. Material updates may be notified through the platform, by email, or through other appropriate communication channels.

For privacy-related questions or requests, contact [email protected] or use the Contact page.