Privacy Policy

Rentory (referred to as “we”, “us”, or “our”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, the legal basis for doing so, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

When you use Rentory, we collect the following types of information:

• Account information — your name, email address, and password when you create an account.
• Profile information — display name, bio, and avatar that you choose to provide.
• Property and tenancy data — property listings, tenancy records, and associated details submitted by landlords and tenants.
• Reviews and ratings — property reviews, landlord reviews, tenant reviews, and replies you submit.
• Verification documents — identity documents uploaded for account verification purposes.
• Usage data — pages visited, features used, and interactions with the platform, collected automatically via cookies and similar technologies.

2. How We Use Your Information & Our Legal Basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out how we use your information and the legal basis we rely on for each activity. Where the basis is “Contract”, it applies to people who hold a Rentory account. Where we hold information about someone who does not, the basis is stated explicitly and Section 3 explains it in full.

3. We Hold No Information About People Without an Account

Rentory does not collect or store personal data about anyone who has not signed up. A landlord cannot enter your name, your email address or any other detail about you, and there is no feature that would let them. If you have never used Rentory, we hold nothing about you.

This is deliberate, and it shapes how the product works. A landlord who wants a tenancy on Rentory creates a record of the letting — the property, the dates, and how many tenants they expect — which names nobody. They then share a link through their own channel, such as a message or their own email. Everyone on a tenancy is there because they chose to join it themselves.

One consequence is worth stating plainly: a landlord cannot review a tenant who has not joined. We would rather lose that review than hold a record about someone who never asked to be here.

If you think a record concerns you. Because we hold nothing about non-users, there is normally nothing to object to. If you believe someone has joined a tenancy they were not part of, or that a review describes you wrongly, contact us and we will look into it. You can also complain to the Information Commissioner’s Office at any time.

A landlord saying you lived somewhere does not make it true. We label unconfirmed tenancies as self-reported until both sides confirm them.

4. Information Sharing

We share your information in the following circumstances:

• Public reviews — once revealed, reviews and ratings are visible to other users of the platform.
• Messaging relay — messages are delivered to the intended recipient. Your personal contact details are never shared unless you choose to include them in your message.
• Service providers — we work with trusted third-party providers who process data only on our behalf and under our instruction. These currently include:
  • Supabase — database hosting and authentication. Our production database is hosted in London (eu-west-2).
  • Resend — transactional email delivery
  • PostHog — product analytics and session recording, hosted in the EU. Recording only happens if you consent; see Section 8
  All providers are bound by data processing agreements. We will update this list as our providers change.
• Legal obligations — we may disclose information if required by law, regulation, or legal process.

We do not sell your personal information to third parties.

5. Data Retention

We retain your personal data only for as long as necessary. Our retention periods are:

• Account and profile information — held for the duration of your account, plus 30 days after deletion to allow for recovery requests.
• Reviews and ratings — once published, retained indefinitely as part of the public record of the platform, unless successfully disputed or a deletion request is granted. A review written before the other side has replied is held privately until it is published or, if a report about it is being investigated, for as long as that takes.
• Tenancy records — a tenancy names only the people who joined it. It is kept for as long as the reviews attached to it, since a review is meaningless without the letting it describes.
• Verification documents — deleted within 7 days of successful verification. We do not retain identity documents beyond this period.
• Messages — Retained for the duration of your account, then deleted when your account is closed
• Usage data and logs — retained for up to 12 months.
• Legal or compliance records — retained for up to 7 years where required by law.

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, secure authentication, and role-based access controls. Verification documents are stored in a restricted-access environment and are accessible only to authorised personnel. While no system is completely secure, we are committed to protecting your information and will promptly notify you and the ICO of any data breach where required by law.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete information via your account settings or by contacting us.
• Erasure — request deletion of your account and associated personal data, subject to legal retention obligations.
• Portability — request your data in a portable, machine-readable format.
• Restriction — ask us to restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent — where processing is based on consent (e.g. marketing), you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within one month. If you have received an email from us about a tenancy and do not have a Rentory account, you can exercise all of these rights directly from the link in that email. You do not need to create an account, and we will not ask you to.

8. Cookies, Analytics and Session Recording

We store three kinds of thing on your device, and we ask before the third.

• Essential storage — required for signing in, security, and remembering choices such as this one. These cannot be switched off, because the site does not work without them.
• Counting visits — we count page views and visitors even if you decline below. This uses an identifier our analytics provider works out on its own servers from a code that changes every day. Nothing is stored on your device, and you cannot be recognised from one day to the next.
• Session recording and analytics — only with your consent. If you agree, we record a replay of your visit, which captures your clicks, the pages you move between, and the text you type into the site, including text you type and then delete. We also recognise you when you return, so we can see how a visit today connects to one last week, and we may show you a short feedback question.

We use recordings to find what is broken or confusing, not to build a profile of you for advertising. We do not sell them and we do not share them with advertisers. Recordings are deleted after 30 days. Passwords, email addresses and phone numbers are hidden from every recording before it reaches us, and your IP address is anonymised.

A note about reviews. If you consent and then write a review, the recording will contain what you wrote, including any wording you changed your mind about. If you would rather that did not exist, decline below and the site will still work normally.

We ask on your first visit. You can change your mind at any time using the Cookie preferences link at the bottom of any page, which brings the question back. You can also clear this site's storage in your browser settings, which has the same effect.

9. Children’s Privacy

Rentory is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or through a notice on the platform. Your continued use of Rentory after changes are posted constitutes acceptance of the updated policy. The version number and date at the top of this page will always reflect the latest revision.

11. Contact Us & Your Right to Complain

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how your data is handled, please contact us:

General support: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.