What we collect, and what we don't.

Moveable is operated by Philipp Hartings, who is the data controller for the personal data described on this page. Moveable is not currently operated through a registered company.

Questions or requests about your personal data can be sent to hello@moveable.es.

Browsing and saving a shortlist do not upload your shortlist. Completing the quiz creates one record with a random run identifier and timestamp, even if you skip email. Without research consent this completion record contains no answers, email or listing interactions.

Your quiz results by email. If you ask us to email your neighbourhood ranking, we store your email address and the answers you gave: whether you are looking for a room or a whole flat, your budget ceiling, the campus you chose, your maximum commute, your priorities, your deal-breakers, and the three neighbourhoods you matched with.

Legacy waitlist records. Your email address, and optionally your move date, institution, budget, and which of four listed services you would like help with.

Your consent record. After you confirm that the email address is yours, we record which purpose each box was for, whether you agreed, the version of the wording you were shown, and when. We record refusals as well as agreements, so “we never asked” can never be mistaken for “you said yes.”

Before confirmation. Requesting a saved-results link stores your email, answers, consent choices and server-calculated matches as an encrypted payload. We store only a hash of the private link token. The first deliberate open confirms ownership before a profile or marketing consent is created or changed. The same link can restore this quiz for 180 days; reopening an older link does not overwrite a newer profile or replay its consent choices. Anyone holding the link can open its saved results, so keep it private. Older confirmation links continue to use the previous 30-minute, one-time flow.

We do not use advertising identifiers, we do not build a device fingerprint, and we do not record your screen or your mouse movements. The current site does not ask for your home address, your landlord's details, documents, or payment information. An earlier apartment-checking prototype did accept addresses; its legacy records are covered by the same access, deletion, and retention rights described below.

Honesty requires one technical note here. Like almost every website, the analytics library does send standard technical details with each event: your browser and operating system version, your screen size, and the page that referred you. PostHog also sees your IP address on arrival and may add an approximate city, postal area, latitude, and longitude derived from it. We do not send GPS coordinates or retain the IP address in Moveable's database. These third-party analytics events are not joined to your email or quiz answers. The separate optional research feature described below uses a persistent quiz identifier.

Your saved shortlist, a local copy of your quiz answers, and your chosen campus are kept in your own browser's local storage. The full shortlist stays local. With research consent, individual listing views, saves and clicks reach us with the quiz identifier. Clearing your browser data removes the local copies, and on a shared computer the next person could see them - so clear them if that matters to you.

To stop automated abuse we do have to count requests per connection. Your IP address is used for that in the moment and then discarded: what is written down is a salted, irreversible hash, from which your address cannot be recovered. That store holds counters, not a visitor log.

To verify the address: necessary to provide the save feature you requested and to prevent someone else from changing a profile or recording consent using only your email address.

To save and restore your results: providing the feature you requested when you press the email-link button. Receiving occasional product updates is a separate optional choice; neither updates nor research is required for the saved link.

To improve which neighbourhoods we recommend: a separate, optional consent. We keep each opted-in quiz’s answers, server-calculated result, listing impressions, details opened, saves, outbound clicks, returns from email and structured feedback. These records use a random quiz identifier, not an email, and are stored in our private database rather than sent to PostHog. They are pseudonymous, not anonymous. Only the operator can access them.

To keep the service available: our legitimate interest, GDPR Art. 6(1)(f), covering abuse prevention and basic, non-identifying usage counts. We judged this proportionate because it involves no profiling and no cross-site tracking, and because the alternative is a service that spammers can use to mail strangers.

To prove we had consent: our legal obligation under GDPR Art. 7(1), which is why the consent record exists.

We use PostHog (hosted in the EU) and Vercel Analytics, both configured so that nothing is written to your browser and no identifier follows you between visits: session recording is off, automatic event capture is off, heatmaps are off, and Do Not Track is respected. If you use an invitation link for the private Homes preview, Moveable sets one HttpOnly access cookie for up to 30 days. It contains a derived access token, not your identity, and is used only to open that preview.

Page views are recorded as the path only: the part after the domain, with any query string removed. Product events are limited to a fixed list of named actions with categorical values; rent appears only as a broad band, never an exact figure, and there is no field in which free text, an address or an email could be sent even by mistake. The analytics library's own URL fields are scrubbed to the same origin-and-path form before an event is sent.

We use a small number of service providers, each under a data processing agreement, each acting only on our instructions:

Vercel: hosting and delivery of the website. Supabase: the database holding the data described above, hosted in the EU. Resend: sending your personal results link, or legacy ownership and results emails. PostHog: cookieless product analytics, EU region.

Where a feature explains rental rules or drafts a message for you, we use Anthropic models, reached through the Vercel AI Gateway. Only the text needed for that specific task is sent, your email address and name are never included, and the content is not used to train anyone's models.

Two services deliver content rather than process data for us, and your browser talks to them directly when a page uses them: CARTO serves the base map tiles on neighbourhood pages, and Wikimedia serves the neighbourhood photographs. Like any server you fetch content from, each sees your IP address when your browser requests it. We send them nothing about you, and neither sets cookies on our pages.

Home cards can show the listing site's own thumbnail photograph. Your browser fetches each one directly from Idealista's image servers (img1.idealista.com to img9.idealista.com) as each card comes on screen. This means Idealista sees your IP address and which listings you scrolled past, not only the ones you open. We send no referrer with an image request and set no cookie for it. Where a thumbnail is unavailable or not permitted, the card draws our own placeholder and makes no third-party image request.

We do not sell personal data. We do not share it with advertisers, data brokers, landlords or letting agents. We never publish anything that identifies an individual landlord or tenant.

Minimal quiz completion records (a random run ID and completion time, without answers or email) are retained to count completed quizzes accurately and prevent duplicate recording. Saved links and their encrypted payloads expire after 180 days. Quiz research details and interactions are removed after 180 days by a daily cleanup job. Research can be stopped sooner with the control below.

Quiz profiles and waitlist entries are kept for up to 24 months after your stated move date, or after we last heard from you if you did not give one, and are then deleted. If you withdraw consent or ask for deletion we act on it straight away rather than waiting for that period to expire.

Consent records are kept for as long as the profile they belong to, and are deleted with it. They cannot be edited after the fact - a change of mind is recorded as a new entry - because a record that could be rewritten would not prove anything.

This stops research for the quiz currently linked on this device and removes that quiz’s research answers and interactions. It does not delete your saved email link or local shortlist. For other quizzes, email-link deletion or marketing withdrawal, contact us below.

Under the GDPR you can ask us for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and withdraw consent at any time. Withdrawing consent does not affect what we did before you withdrew it.

Email hello@moveable.es from the address you signed up with and say what you would like. We answer within one month. There is no charge, and you do not need to give a reason to have your data deleted.

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the country of your habitual residence, your place of work, or where you believe an infringement occurred.

Everything is served over HTTPS. The database enforces access at the row level and denies by default, and the credentials that can read personal data exist only on the server - they are never sent to your browser. Access to the database is limited to the operator.

No system is perfect. If you believe you have found a security problem, please tell us at hello@moveable.es - see also security.txt.

Moveable is intended for adults arranging their own housing. We do not knowingly collect data from anyone under 16. If you believe a child has given us their details, email us and we will delete them.

If we change what we collect or why, we update this page and the date at the top. Material changes to what you consented to mean asking you again rather than quietly re-interpreting the old answer.