SOBA PRIVACY POLICY

1. WHO WE ARE

SOBA is a room and roommate discovery platform operated by:

For the purposes of applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), NIURO d.o.o. is the controller of personal data processed through SOBA unless otherwise stated.

This Privacy Policy explains what information we collect, why we collect it, how we use it, with whom it may be shared, and the choices and rights available to you.

2. SCOPE

This Privacy Policy applies to:

• the SOBA mobile application;
• sobaapp.eu and related SOBA websites;
• SOBA customer support;
• account, subscription and security communications; and
• related SOBA services.

3. INFORMATION WE COLLECT

Depending on how you use SOBA, we may process the following categories of information.

Account information

This may include your email address, account role, display name, preferred language, account country or market, authentication status and account settings.

Profile information

This may include profile photographs, biography, age or other profile attributes you choose to provide, lifestyle or roommate preferences, and other information shown on your profile.

Listing information

Landlords may provide property photographs, listing titles, descriptions, city, approximate or selected location, price or budget information, property size, room information, availability, preferences and other property-related information.

Location information

SOBA may process a city, selected location and geographic coordinates associated with a selected search or listing location.

SOBA does not need to continuously track your physical location in order to provide its core matching functionality unless a specific feature explicitly requests permission to do so.

Matching and interaction information

We process actions such as likes, dislikes, stars, matches, listing context and other interactions required to operate the matching service.

Messages

Messages exchanged between matched users are processed and stored so that SOBA can provide the messaging service.

Please do not include unnecessary sensitive personal information in profiles, listings or messages.

Photos and uploaded content

We process images and other content you voluntarily upload to your profile or listings.

Device and technical information

We may process information such as device platform, app version, installation identifier, push notification token, IP address, security information and technical logs necessary to operate, secure and troubleshoot SOBA.

Subscription information

If you purchase a paid SOBA plan, we may process information such as:

• subscription plan;
• store and product identifier;
• transaction or subscription identifier;
• subscription status;
• purchase and expiration dates;
• renewal, cancellation, grace-period, refund or revocation status.

Mobile payments are processed by Apple or Google. SOBA does not receive your complete payment card details.

Analytics and diagnostics

If you explicitly opt in, SOBA may collect limited product analytics and sanitized crash diagnostics through Firebase.

Our custom analytics events are designed not to include names, email addresses, message contents, listing descriptions, photographs, precise addresses, authentication tokens or other user-generated content.

You can change your analytics and diagnostics preference in the app's privacy settings.

Customer support

If you contact us, we process the information you provide in your communication in order to respond to and resolve your request.

4. HOW WE USE INFORMATION

We use personal data where necessary to:

• create and manage your SOBA account;
• authenticate users and protect accounts;
• provide seeker, landlord, listing, matching and messaging functionality;
• show relevant listings and potential matches;
• maintain the context of likes, matches and conversations;
• send account verification, password reset and security communications;
• deliver push notifications you have enabled;
• manage subscriptions and paid entitlements;
• prevent fraud, abuse and unauthorized access;
• maintain, troubleshoot and improve SOBA;
• provide customer support;
• comply with legal obligations; and
• where you have consented, measure product usage and diagnose crashes.

5. LEGAL BASES FOR PROCESSING

Depending on the processing activity, we rely on one or more of the following legal bases:

Performance of a contract

We process information that is necessary to create and operate your SOBA account and provide the services you request.

Consent

We rely on consent for optional processing where required, including optional analytics or similar technologies.

You may withdraw consent at any time without affecting the lawfulness of processing that took place before withdrawal.

Legitimate interests

We may process limited information where necessary for legitimate interests such as maintaining service security, preventing fraud, protecting users, operating and improving the service, and defending legal claims, provided those interests are not overridden by your rights.

Legal obligations

We may process or retain information where required by accounting, tax, consumer protection, law-enforcement or other applicable legal obligations.

6. MATCHING AND RANKING

SOBA uses automated rules to help order and present listings or potential matches.

These may consider factors such as:

• location and distance;
• stated preferences;
• listing or profile eligibility;
• subscription-related priority or boost features; and
• other relevance signals.

These systems are intended to improve discovery and do not make decisions that produce legal or similarly significant effects on you.

SOBA does not guarantee that a recommended person or listing is suitable, available, accurate or safe.

7. SUBSCRIPTIONS AND PAYMENTS

Paid SOBA features may be purchased through the Apple App Store or Google Play.

SOBA may use RevenueCat to synchronize subscription state between the relevant store, SOBA and your account.

We process only the billing information needed to determine which SOBA plan and entitlements your account should receive.

Apple, Google and RevenueCat may process information under their own privacy terms.

8. ADVERTISING

The free version of SOBA may display advertising in the future.

Where advertising technologies require consent, SOBA will request the required choice before enabling personalized advertising or accessing advertising identifiers.

Declining personalized advertising consent will not remove your core privacy rights.

Paid plans may include an ad-free experience where this is stated as part of the plan benefits.

If advertising practices materially change, this Privacy Policy and the relevant consent controls will be updated before the change becomes effective.

9. PUSH NOTIFICATIONS

If you enable push notifications, SOBA may send notifications relating to activity such as new messages and new matches.

Push notification registration uses a device token and installation identifier.

Notification text may be localized according to your SOBA language preference.

You can control notification permissions through your device and SOBA settings.

10. EMAIL COMMUNICATIONS

We send essential transactional messages such as:

• email verification;
• password reset;
• account or security-related communications; and
• service communications necessary to operate your account.

These are not marketing messages.

If SOBA later introduces marketing emails, they will include appropriate preference and unsubscribe controls where required.

11. SERVICE PROVIDERS

We use trusted service providers to operate SOBA.

Depending on the feature, these may include:

Railway

Backend application hosting.

Neon

PostgreSQL database infrastructure.

Cloudflare

Object and image storage through Cloudflare R2 and related infrastructure.

Resend

Transactional account and security emails.

Google Firebase

Push notifications and, with user consent where applicable, analytics and crash diagnostics.

RevenueCat

Subscription and entitlement synchronization.

Apple

App distribution and Apple in-app purchases.

Google

App distribution, Google Play Billing and related services.

Zoho

SOBA support email infrastructure.

Some providers act as processors on our behalf, while others may act as independent controllers for parts of their services.

12. INTERNATIONAL DATA TRANSFERS

Some service providers may process information outside Slovenia or the European Economic Area.

Where required by applicable law, international transfers are protected through appropriate safeguards such as adequacy decisions, Standard Contractual Clauses or other legally recognized transfer mechanisms.

13. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy.

Retention depends on the type of information and may include:

• account and profile information while your account remains active;
• listings, matches and messages while necessary to provide SOBA and maintain legitimate account history;
• security and technical records for a limited period necessary to prevent abuse and investigate incidents;
• billing and transaction records for periods required by applicable accounting, tax and consumer laws;
• support communications for as long as necessary to resolve requests and maintain appropriate records; and
• backups until they are replaced through normal backup rotation.

When information is no longer required, it is deleted, anonymized or otherwise removed in accordance with our retention processes, unless continued retention is legally required.

14. ACCOUNT DELETION

You may request deletion of your SOBA account through the app where available or by contacting:

support@sobaapp.eu

Deleting a SOBA account does not necessarily cancel an Apple App Store or Google Play subscription.

If you have an active subscription, you should separately manage or cancel it through the store through which you purchased it.

Some information may remain temporarily in backups or be retained where required for legal, security, fraud-prevention or accounting purposes.

15. YOUR DATA PROTECTION RIGHTS

Subject to applicable law, you may have the right to:

• receive information about how your data is used;
• access your personal data;
• correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict certain processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• object to direct marketing; and
• withdraw consent where processing is based on consent.

To exercise your rights, contact:

support@sobaapp.eu

We may need to verify your identity before completing certain requests.

You may also lodge a complaint with the competent data protection supervisory authority, including the Slovenian Information Commissioner, or the supervisory authority in your country of residence.

16. SECURITY

We use technical and organizational safeguards intended to protect SOBA and personal information.

These include measures such as authentication controls, access restrictions, encrypted connections, secure password handling, limited token lifetimes, server-side authorization and other security protections.

However, no internet service can guarantee absolute security.

You are responsible for protecting your account credentials and should notify us if you believe your account has been compromised.

17. CHILDREN

SOBA is intended for adults who are legally capable of entering into housing-related arrangements.

SOBA is not intended for children under 18.

If we learn that an account was created in violation of this requirement, we may suspend or delete it.

18. COOKIES AND WEBSITE TECHNOLOGIES

The current SOBA pre-launch website is designed to use only technologies necessary to operate the website and remember essential preferences.

We do not currently require non-essential advertising or analytics cookies on the SOBA coming-soon website.

If website analytics, advertising pixels or other non-essential cookies are introduced, we will request consent where legally required before activating them.

Users will be able to accept or reject non-essential technologies without losing access to the basic website.

The SOBA mobile application may use local device storage for functions such as authentication state, language, privacy preferences and installation state. These app technologies are not browser cookies.

19. THIRD-PARTY LINKS

SOBA may contain links to websites, stores or services operated by third parties.

Their processing of personal information is governed by their own privacy policies.

20. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy as SOBA develops or legal requirements change.

If a change is material, we will provide reasonable notice through the app, website or another appropriate channel.

The latest version will always be available at:

https://sobaapp.eu/privacy

21. CONTACT

Questions, requests or privacy concerns can be sent to: