1. Scope and controller identity
StanzaMia is a student housing marketplace that supports public browsing, account registration, listings, roommate matching, messaging, trust and safety review, payments, contracts, and support workflows.
For the processing described in this policy, StanzaMia acts as the data controller for the website and the marketplace services made available through the platform.
2. Information we collect
The categories of information we collect depend on how you use the product and which workflow steps you choose to enter.
- Account and profile information such as name, email address, password credentials, account role, profile photo, biography, university, city, and onboarding answers.
- Marketplace information such as listing details, amenities, prices, availability, photos, neighborhood-level location data, application status, and landlord profile information.
- Verification and trust information such as identity submissions, student-status evidence, uploaded files, dispute materials, moderation signals, and review outcomes.
- Communications and workflow activity such as messages, visit planning data, deal room events, contract-related inputs, support requests, and audit records linked to sensitive actions.
- Payment and transaction information such as hold-payment status, processor identifiers, billing country, refund status, and limited payment metadata provided by payment processors like Stripe.
- Technical and service information such as IP address, browser type, session cookies, security cookies, language preference, device diagnostics, and server-side event logs.
3. How we use personal information
We use personal information to operate the marketplace, keep the platform secure, meet legal obligations, and provide the workflows a user requests.
- Create and manage accounts, listings, profiles, roommate preferences, and marketplace pages.
- Enable messaging, applications, visit scheduling, deal room progression, payments, support, and contract-related workflows.
- Detect fraud, review verification submissions, moderate unsafe behavior, investigate disputes, and enforce platform rules.
- Provide transactional notices, customer support, service diagnostics, incident response, and platform reliability improvements.
- Measure product usage and site performance only where optional analytics consent has been granted.
4. Legal bases and cookie choices
Depending on the workflow, we rely on one or more legal bases such as performance of a contract or requested service, legitimate interests in operating and protecting the marketplace, compliance with legal obligations, and consent where required.
Strictly necessary cookies support authentication, session continuity, language consistency, fraud prevention, and core site security. Optional analytics cookies are used only after opt-in and can be withdrawn later from the footer, cookie banner, or account privacy settings.
- Contract or pre-contract basis for registration, account access, listing workflows, applications, payments, and contract coordination requested by the user.
- Legitimate interests for marketplace integrity, abuse prevention, security monitoring, dispute handling, and product operations that are reasonably expected in a housing platform.
- Legal obligations for accounting, tax, law-enforcement cooperation, payment compliance, and recordkeeping where the law requires retention or disclosure.
- Consent for analytics technologies that are not essential to run the service.
6. International transfers and security
Some service providers may process data outside the country where a user is located. Where cross-border transfers apply, we aim to use contractual, organizational, or provider-level safeguards appropriate to the transfer scenario.
We apply access controls, logging, verification workflows, document protections, and platform security measures designed to reduce unauthorized access, although no system can guarantee absolute security.
7. Retention and account deactivation
We keep information for as long as needed to provide the service, maintain records, resolve disputes, enforce agreements, and satisfy legal, accounting, tax, security, or audit obligations.
If an account is deactivated, some records may remain for a limited retention period to support fraud prevention, chargeback handling, legal defense, contract evidence, dispute history, or regulatory compliance. When retention is no longer justified, data is deleted, anonymized, or pseudonymized where practical.
8. Your rights and choices
Depending on the law that applies to you, you may have rights to access, correct, delete, restrict, object to, or port personal information. You may also withdraw consent where processing depends on consent, including analytics consent.
Some account information can be updated directly in product settings. For manual requests such as data export, deletion, correction, or privacy complaints, contact us using the address below and provide enough information for us to verify the request safely.
If applicable law gives you that right, you may also lodge a complaint with the supervisory authority that oversees data protection in your jurisdiction.
9. Contact and policy changes
If we make material changes to this policy, we may update the date above and provide additional notice where required.
Questions about privacy, data rights, or this policy should be sent to the contact address below.