2BFound Privacy Policy

1. About 2BFound

2BFound is a people-first shared-living platform for adults.

The service allows users to create profiles, discover other people, create or join Cases, communicate about shared-living expectations, explore accommodation Listings and connect with Hosts and Business Hosts.

The information we process depends on how you use the service and the features you choose to use.

2. Information we collect

3. Special category information

Some information users may choose to provide, particularly information about sexual orientation, constitutes special category personal data under UK data protection law.

Providing this information is optional.

Where 2BFound asks you to provide sexual orientation or other optional special category information, we rely on your explicit consent where required under applicable data protection law.

Where explicit consent is used, we ask you to take a clear affirmative action confirming that you consent to 2BFound processing the relevant special category information for the purposes explained when that information is collected and in this Privacy Policy.

You may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where consent is withdrawn, we will stop processing the relevant special category information on the basis of that consent and delete or otherwise cease using it unless another lawful basis and applicable legal condition permits or requires us to retain it.

2BFound does not intentionally infer a user’s sexual orientation from LGBTQ-friendly preferences, interactions or behaviour.

Providing optional profile information is voluntary unless we clearly tell you that particular information is required for a specific feature.

4. How we use personal information

We use personal information where necessary to operate and protect 2BFound, including to:

• create and manage accounts;
• authenticate users;
• create and display profiles;
• enable discovery of people, Cases and Listings;
• enable Case creation and participation;
• provide individual and group messaging;
• enable Hosts and Business Hosts to create and manage Listings;
• process requests, invitations and memberships;
• provide location-search functionality;
• send service and account communications;
• deliver push notifications where enabled;
• process purchases and maintain applicable entitlements;
• provide customer support;
• investigate reports and complaints;
• enable blocking and moderation functions;
• enforce our Terms of Use and Community Guidelines;
• prevent fraud, abuse and security incidents;
• maintain and troubleshoot our systems;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims.

5. Lawful bases for processing

Under UK data protection law, we rely on different lawful bases depending on why information is processed.

6. Information visible to other users

2BFound is a social shared-living platform.

Information you choose to publish as part of a Profile, Case or Listing may therefore be visible to other users.

Messages are shared with the users participating in the relevant individual or group conversation.

You should not publish information through 2BFound that you do not want the intended audience of that feature to see.

7. Service providers and sharing

We use third-party providers and technical infrastructure to operate 2BFound.

Depending on the features you use and the services available to you, these may include providers supporting:

• cloud infrastructure;
• database and object storage;
• email delivery;
• push notifications;
• location search;
• payment processing;
• real-time messaging;
• application delivery and technical services.

Services used in connection with relevant 2BFound functionality may include Google Places, Stripe, Expo, Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM).

Our infrastructure also uses services supporting database storage, object storage, caching, WebSocket communications and email delivery.

We only provide service providers with personal information reasonably necessary for the services they perform on our behalf or otherwise as permitted by applicable law.

We may also disclose information where reasonably necessary to:

• comply with applicable law;
• respond to a lawful request;
• protect the rights or safety of users or others;
• investigate fraud, abuse or security incidents;
• establish, exercise or defend legal claims.

We do not sell personal information to advertisers.

8. International transfers

Some service providers used by 2BFound may process personal information outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we use an appropriate lawful mechanism, which may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved Standard Contractual Clauses; or
• another lawful transfer mechanism available under UK data protection law.

You may contact us using the details in Section 23 to request further information about the safeguards used for international transfers, including information about how to obtain a copy of relevant safeguards where applicable.

9. Push notifications

If you enable notifications, we may use a device push token to send notifications relating to the service, including account activity, communication or other relevant product activity.

Push notifications may be delivered using Apple Push Notification service or Firebase Cloud Messaging.

You can change notification permissions through your device settings.

10. Mobile permissions

Depending on the device and features you use, 2BFound may request access to functions such as:

• your photo or media library, when you choose to upload images;
• notifications, when you choose to receive push notifications.

Permissions can be managed through your device settings.

We aim to request only permissions reasonably necessary for functions available in the production application.

11. Reports, blocking and moderation

2BFound processes information relating to reports, blocks and enforcement where necessary to operate and protect the community.

This may include:

• the identity of the reporting user;
• the account or content being reported;
• the reason for a report;
• additional information supplied with a report;
• block relationships;
• moderation decisions;
• enforcement history.

We may review relevant content and account activity where reasonably necessary to investigate suspected violations of our Terms of Use or Community Guidelines.

12. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, misuse, loss, alteration and disclosure.

These measures may include:

• authenticated access;
• secure session management;
• access controls;
• protected network communications;
• infrastructure and application security measures;
• monitoring and administrative controls.

No online service can guarantee absolute security.

Users should also take reasonable precautions to protect access to their email accounts and devices.

13. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate operational, security and legal purposes.

We determine retention periods by considering:

• whether your 2BFound account remains active;
• whether the information is required to provide a feature you use;
• the nature and sensitivity of the information;
• security and fraud-prevention requirements;
• whether a complaint, dispute or investigation remains open;
• applicable legal, tax, accounting or regulatory obligations;
• the need to establish, exercise or defend legal claims.

Profile, Case and Listing information is generally retained while the relevant account or content remains active unless it is removed earlier.

Messages and interaction records may be retained while necessary to provide communication functionality, maintain conversation history, protect user safety, investigate reports or resolve disputes.

Payment and transaction records may be retained where necessary for accounting, fraud-prevention, consumer-protection or legal obligations.

When information is no longer required, we delete or anonymise it where reasonably practicable.

Copies may remain temporarily in secure backups until they are overwritten through our normal backup cycle.

14. Account and data deletion

You may request deletion of your 2BFound account and associated personal information using the account-deletion method provided through 2BFound.

We also provide a web-based method for requesting account deletion so that a deletion request can be initiated without access to the mobile application.

When an account-deletion request is completed, personal information associated with the account is deleted or anonymised except where particular information must be retained for a legitimate reason such as:

• compliance with law;
• fraud or security prevention;
• unresolved disputes or complaints;
• enforcement of our Terms;
• accounting or regulatory obligations;
• establishment, exercise or defence of legal claims.

Information retained for these purposes will not be retained longer than reasonably necessary for the relevant purpose.

Deleting an account may not automatically remove information that another user has independently provided or that must remain as part of another user’s legitimate record, provided that your personal information is removed or anonymised where appropriate.

15. Website cookies and analytics

The 2BFound website is separate from the mobile application and may use cookies and website analytics technologies.

Our website may use services including Google Tag Manager, Google Analytics 4 and Vercel Analytics.

These website analytics services are not currently implemented as analytics SDKs within the 2BFound mobile application.

Further information about website cookies and analytics is available through our Cookie Policy.

16. Mobile analytics and advertising tracking

The current 2BFound mobile application does not include Firebase Analytics, Crashlytics, Sentry or an advertising attribution SDK.

We do not currently use IDFA or Android Advertising ID for behavioural advertising or cross-app advertising tracking.

If these practices change materially, this Privacy Policy and the relevant App Store and Google Play privacy disclosures will be updated.

17. Information obtained from other users

In some circumstances, another user may provide information relating to you, for example when they:

• invite you to participate in a Case;
• communicate with you;
• report your account or content;
• interact with your Profile, Case or Listing.

We process this information only where reasonably necessary to provide the relevant service, investigate reports, protect users or operate the platform.

18. Automated decision-making

2BFound provides discovery, communication and organisational tools.

We do not use solely automated decision-making that produces legal effects or similarly significant effects for users.

2BFound does not make the final decision about who you should live with, which Case you should join or which accommodation you should choose.

19. Your data protection rights

Depending on the circumstances and the lawful basis for processing, UK data protection law may give you rights including the right to:

• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent.

Some rights are subject to legal conditions and exceptions.

20. Complaints

If you have concerns about how 2BFound uses your personal information, please contact us first using the details below so that we have an opportunity to address your concern.

You also have the right to complain to the Information Commissioner’s Office (ICO), the United Kingdom’s independent data protection regulator.

Information about your rights and how to contact the ICO is available at ico.org.uk.

21. Children

2BFound is intended only for people aged 18 or over.

We do not knowingly provide 2BFound accounts to children.

If we become aware that an account is being used by a person who is not eligible to use the service, we may restrict or remove that account and take appropriate steps regarding the associated personal information.

22. Changes to this Privacy Policy

We may update this Privacy Policy where necessary because of changes to:

• the 2BFound service;
• our technology or providers;
• our data practices;
• legal or regulatory requirements.

Where a change is material, we may notify users through the application, website, email or another appropriate method.

The current version of this Privacy Policy will display its effective date and last-updated date.

23. Contact

For privacy questions, requests, withdrawal of consent or concerns, you can contact:

Email: privacy@2bfound.co.uk