Privacy Policy

1. Introduction

This Privacy Policy ("Policy") explains how FlatGrad ("Company," "we," "us," or "our") collects, uses, shares, sells, retains, and protects information when you access or use our website, mobile applications, platforms, and related services (collectively, the "Platform").

By using the Platform, you acknowledge that you have read, understood, and agree to the terms of this Policy. If you do not agree, you must immediately discontinue use.

2. Definitions

• Personal Data: Information that identifies or can reasonably identify a natural person (e.g., name, email, phone number, device ID).
• Non-Personal Data: Aggregated, anonymized, or de-identified data not linked to a specific user.
• Processing: Any operation performed on data (collection, storage, profiling, sharing, sale).
• Sale: Disclosure of Personal Data in exchange for monetary or other valuable consideration (per CCPA).
• Cookies/Trackers: Files, scripts, or technologies used for analytics, personalization, advertising, and functionality.

3. Categories of Data We Collect

We collect the following categories of information on the FlatGrad platform:

• Account Information – Name, username, password, email, profile details, verified university-issued email address.
• Student Verification – University email address and domain for marketplace eligibility verification.
• Contact Information – Phone number, mailing address, location (campus/city).
• Listing Information – Housing posts, ticket listings, item descriptions, photos, prices, availability.
• Transaction Data – Buyer/seller identities, listing details, communication history, dispute reports.
• Uploaded Content – Photos, images, descriptions you post on listings or in your profile.
• Messaging Data – Messages between users, conversation history, reported suspicious communications.
• User Reports – Reports of fraud, abuse, or policy violations, and information submitted in support requests.
• Technical Data – IP address, device IDs, browser type, operating system, cookies.
• Usage Data – Login times, searches, browse history, interactions on the platform, feature usage.

4. How We Collect Data

• Directly: When you sign up, fill forms, upload, transact, or contact us.
• Automatically: Through cookies, analytics, and similar technologies.
• Combined: We may link data across devices, sessions, and sources.

5. Use of Data

We use collected data to:

• Operate and maintain the FlatGrad marketplace platform.
• Verify ownership of a university-issued email address to determine platform eligibility.
• Facilitate listings and connect buyers and sellers.
• Enable messaging and communication between users.
• Process and display housing posts, ticket listings, and items.
• Detect, prevent, and respond to fraud, abuse, scams, and illegal conduct.
• Moderate accounts, suspend violators, and enforce Community Guidelines.
• Investigate user reports of fraud or misconduct.
• Secure the platform with encryption and access controls.
• Improve platform features and user experience.
• Comply with legal obligations and law enforcement requests.
• Retain data only as long as reasonably necessary for the purposes above.

6. Sharing & Disclosure

We may share data with:

• Service Providers – Cloud hosting, analytics, security, and technical infrastructure providers.
• Law Enforcement – When legally required by subpoena, warrant, or court order to protect rights or safety.
• Other Users – Seller/buyer information visible in transactions; your listings and profile information as you choose to display.
• Corporate Transactions – In case of merger, acquisition, or restructuring.

Payment Processing. If FlatGrad introduces payment functionality in the future, payment information will be processed exclusively through trusted third-party payment processors. FlatGrad will not directly handle credit card or banking data.

We Do Not Sell Data. FlatGrad does not sell, trade, or monetize personal data to data brokers or advertisers. We do not purchase data from external data vendors.

7. Data Retention & Deletion

Account Deletion. You may request deletion of your account and associated data by emailing team@flatgrad.comwith subject line "Account Deletion Request." We will process your request within 30 days unless legally required to retain the data.

Retention Periods. FlatGrad retains information only for as long as reasonably necessary to:

• Comply with legal obligations, including tax and regulatory requirements.
• Resolve disputes and enforce the Terms of Service.
• Prevent fraud and repeated abuse.
• Protect the security and integrity of the Platform.
• Maintain account history as needed by users.

After Account Deletion. FlatGrad may retain limited information from deleted or suspended accounts when reasonably necessary to investigate fraud, prevent repeat violations of Community Guidelines, enforce the Terms of Service, or comply with legal obligations. Anonymized and aggregated data may be retained for analytics and platform improvement. Backup copies may persist temporarily beyond deletion.

8. Cookies & Tracking

FlatGrad uses cookies and similar technologies for:

• Essential – Authentication, login, account security, fraud prevention.
• Functional – Saving user preferences, language, region, personalization.
• Security – Session management, CSRF protection, abuse detection.
• Analytics – Performance monitoring, user behavior analysis, platform improvements.

For complete cookie information, please review our Cookie Policy.

9. Security Measures

FlatGrad implements reasonable administrative, technical, and organizational safeguards to protect your data:

• HTTPS/TLS encryption for all data in transit.
• Secure cloud infrastructure with access controls.
• Encrypted password storage using industry-standard hashing.
• Regular security monitoring and abuse detection.
• Secure authentication and session management.
• Regular reviews and updates of security practices.

Security Limitations. No internet transmission or electronic storage system is guaranteed to be 100% secure. You are responsible for safeguarding your account credentials, maintaining device security, and keeping your password confidential. Report unauthorized access immediately to team@flatgrad.com.

10. Children's Data

FlatGrad is intended for students 18 years or older, or younger users with parental consent. We do not knowingly collect data from children under 13 (or under 16 in certain jurisdictions). If we discover such data, it will be deleted immediately.

11. International Data Transfers

By using FlatGrad outside the U.S., you consent to transfer and processing of your data in the United States and other jurisdictions where FlatGrad operates. Where required by applicable law, FlatGrad implements appropriate safeguards for international transfers of personal information.

12. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

• Right to Access – Request a copy of the data FlatGrad holds about you.
• Right to Correct – Request correction of inaccurate or incomplete data.
• Right to Delete – Request deletion of your account and personal data (subject to legal retention).
• Right to Data Portability – Request your data in a portable format.
• Right to Restrict Processing – Request limitation on how your data is used.
• Right to Withdraw Consent – Withdraw consent for processing (where applicable).

Submit Requests: To exercise privacy rights, email team@flatgrad.comwith subject line "Privacy Rights Request." Include your name, email, and description of your request. We respond within 30 days (or as required by law).

13. User Responsibility

You are responsible for ensuring the accuracy and completeness of the information you provide to FlatGrad. Do not upload, share, or store unnecessary sensitive personal information (such as social security numbers, financial account details, or government IDs) on the Platform.

FlatGrad may remove or restrict access to content that violates this Privacy Policy, the Terms of Service, Community Guidelines, or applicable law. Users are responsible for understanding and complying with all applicable laws and regulations in their jurisdiction.

14. GDPR & International Compliance

For users in the European Union and United Kingdom:

• Legal basis for processing: consent, contract performance, legal obligation, or legitimate interests.
• Right to lodge a complaint with your local data protection supervisory authority.
• Where required by applicable law, data transfers are protected by appropriate safeguards.

For privacy inquiries from EU/UK users, contact team@flatgrad.com.

15. California Consumer Privacy Rights (CCPA/CPRA & Similar Laws)

California and other state residents with similar privacy laws have the right to:

• Know what categories of personal information FlatGrad collects.
• Delete personal information (subject to exceptions).
• Opt-out if FlatGrad were to sell data (FlatGrad does not sell data).
• Exercise rights without discrimination.

16. Third-Party Links & Services

FlatGrad may link to or integrate with third-party services. These services have their own privacy policies. FlatGrad is not responsible for third-party privacy practices or data handling.

17. Changes to This Policy

FlatGrad may update this Privacy Policy at any time. Material changes will be posted with 30 days' notice. Continued use of the Platform constitutes acceptance of updated policies.

18. Contact Us

For privacy questions, requests, or concerns, contact:

Privacy Questions
Email: team@flatgrad.com
We respond to privacy requests within 30 days or as required by applicable law.

© 2026 FlatGrad. All rights reserved.