What we collect, and what we don't.

Moveable is operated by Philipp Hartings, who is the data controller for the personal data described on this page. Moveable is not currently operated through a registered company.

Questions or requests about your personal data can be sent to hello@moveable.es.

Browsing and saving a shortlist do not send the shortlist to us. Completing the quiz sends the structured answers to our ranking route so it can calculate the result. That request is processed in memory and is not written to our database. There are two places where you can choose to give us information we retain:

Your quiz results by email. If you ask us to email your neighbourhood ranking, we store your email address and the answers you gave: whether you are looking for a room or a whole flat, your budget ceiling, the campus you chose, your maximum commute, your priorities, your deal-breakers, and the three neighbourhoods you matched with.

The waitlist. Your email address, and optionally your move date, institution, budget, and which of four listed services you would like help with.

Your consent record. After you confirm that the email address is yours, we record which purpose each box was for, whether you agreed, the version of the wording you were shown, and when. We record refusals as well as agreements, so “we never asked” can never be mistaken for “you said yes.”

Before confirmation. Submitting the form sends a one-time ownership link to the address you entered. Your email and answers are encrypted inside that link; our database stores only an irreversible token hash and its expiry, not a pending profile. The link expires after 30 minutes. Nothing is added to or changed in your profile or consent history unless you deliberately confirm on Moveable.

We do not use advertising identifiers, we do not build a device fingerprint, and we do not record your screen or your mouse movements. The current site does not ask for your home address, your landlord's details, documents, or payment information. An earlier apartment-checking prototype did accept addresses; its legacy records are covered by the same access, deletion, and retention rights described below.

Honesty requires one technical note here. Like almost every website, the analytics library does send standard technical details with each event: your browser and operating system version, your screen size, and the page that referred you. PostHog also sees your IP address on arrival and may add an approximate city, postal area, latitude, and longitude derived from it. We do not send GPS coordinates or retain the IP address in Moveable's database. None of this is joined to your email or your quiz answers, and no identifier follows you between visits.

Your saved shortlist, a local copy of your quiz answers, and your chosen campus are kept in your own browser's local storage. The shortlist never reaches us; quiz answers reach the ranking route as described above. Clearing your browser data removes the local copies, and on a shared computer the next person could see them - so clear them if that matters to you.

To stop automated abuse we do have to count requests per connection. Your IP address is used for that in the moment and then discarded: what is written down is a salted, irreversible hash, from which your address cannot be recovered. That store holds counters, not a visitor log.

To verify the address: necessary to provide the save feature you requested and to prevent someone else from changing a profile or recording consent using only your email address.

To send your results: your consent, GDPR Art. 6(1)(a). You give it with an unticked box you have to tick, and you can withdraw it at any time.

To improve which neighbourhoods we recommend: a separate, optional consent. Data used this way is aggregated first and stripped of your email address and your name before anyone can query it.

To keep the service available: our legitimate interest, GDPR Art. 6(1)(f), covering abuse prevention and basic, non-identifying usage counts. We judged this proportionate because it involves no profiling and no cross-site tracking, and because the alternative is a service that spammers can use to mail strangers.

To prove we had consent: our legal obligation under GDPR Art. 7(1), which is why the consent record exists.

We use PostHog (hosted in the EU) and Vercel Analytics, both configured so that nothing is written to your browser and no identifier follows you between visits: session recording is off, automatic event capture is off, heatmaps are off, and Do Not Track is respected. If you use an invitation link for the private Homes preview, Moveable sets one HttpOnly access cookie for up to 30 days. It contains a derived access token, not your identity, and is used only to open that preview.

Page views are recorded as the path only: the part after the domain, with any query string removed. Product events are limited to a fixed list of named actions with categorical values; rent appears only as a broad band, never an exact figure, and there is no field in which free text, an address or an email could be sent even by mistake. The analytics library's own URL fields are scrubbed to the same origin-and-path form before an event is sent.

We use a small number of service providers, each under a data processing agreement, each acting only on our instructions:

Vercel: hosting and delivery of the website. Supabase: the database holding the data described above, hosted in the EU. Resend: sending your ownership confirmation and, after verified consent, your results email. PostHog: cookieless product analytics, EU region.

Where a feature explains rental rules or drafts a message for you, we use Anthropic models, reached through the Vercel AI Gateway. Only the text needed for that specific task is sent, your email address and name are never included, and the content is not used to train anyone's models.

Two services deliver content rather than process data for us, and your browser talks to them directly when a page uses them: CARTO serves the base map tiles on neighbourhood pages, and Wikimedia serves the neighbourhood photographs. Like any server you fetch content from, each sees your IP address when your browser requests it. We send them nothing about you, and neither sets cookies on our pages.

Home cards can show the listing site's own thumbnail photograph. Your browser fetches each one directly from Idealista's image servers (img1.idealista.com to img9.idealista.com) as each card comes on screen. This means Idealista sees your IP address and which listings you scrolled past, not only the ones you open. We send no referrer with an image request and set no cookie for it. Where a thumbnail is unavailable or not permitted, the card draws our own placeholder and makes no third-party image request.

We do not sell personal data. We do not share it with advertisers, data brokers, landlords or letting agents. We never publish anything that identifies an individual landlord or tenant.

Quiz profiles and waitlist entries are kept for up to 24 months after your stated move date, or after we last heard from you if you did not give one, and are then deleted. If you withdraw consent or ask for deletion we act on it straight away rather than waiting for that period to expire.

Consent records are kept for as long as the profile they belong to, and are deleted with it. They cannot be edited after the fact - a change of mind is recorded as a new entry - because a record that could be rewritten would not prove anything.

Under the GDPR you can ask us for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and withdraw consent at any time. Withdrawing consent does not affect what we did before you withdrew it.

Email hello@moveable.es from the address you signed up with and say what you would like. We answer within one month. There is no charge, and you do not need to give a reason to have your data deleted.

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the country of your habitual residence, your place of work, or where you believe an infringement occurred.

Everything is served over HTTPS. The database enforces access at the row level and denies by default, and the credentials that can read personal data exist only on the server - they are never sent to your browser. Access to the database is limited to the operator.

No system is perfect. If you believe you have found a security problem, please tell us at hello@moveable.es - see also security.txt.

Moveable is intended for adults arranging their own housing. We do not knowingly collect data from anyone under 16. If you believe a child has given us their details, email us and we will delete them.

If we change what we collect or why, we update this page and the date at the top. Material changes to what you consented to mean asking you again rather than quietly re-interpreting the old answer.