Privacy Policy

Rentory (referred to as “we”, “us”, or “our”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, the legal basis for doing so, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

When you use Rentory, we collect the following types of information:

• Account information — your name, email address, and password when you create an account.
• Profile information — display name, bio, and avatar that you choose to provide.
• Property and tenancy data — property listings, tenancy records, and associated details submitted by landlords and tenants.
• Reviews and ratings — property reviews, landlord reviews, tenant reviews, and replies you submit.
• Verification documents — identity documents uploaded for account verification purposes.
• Usage data — pages visited, features used, and interactions with the platform, collected automatically via cookies and similar technologies.

2. How We Use Your Information & Our Legal Basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out how we use your information and the legal basis we rely on for each activity.

3. Information Sharing

We share your information in the following circumstances:

• Public reviews — once revealed, reviews and ratings are visible to other users of the platform.
• Messaging relay — messages are delivered to the intended recipient. Your personal contact details are never shared unless you choose to include them in your message.
• Service providers — we work with trusted third-party providers who process data only on our behalf and under our instruction. These currently include:
  • Supabase — database hosting and authentication (EU/US)
  • Email delivery provider — transactional email notifications
  • Analytics provider — anonymised usage analytics
  All providers are bound by data processing agreements. We will update this list as our providers change.
• Legal obligations — we may disclose information if required by law, regulation, or legal process.

We do not sell your personal information to third parties.

4. Data Retention

We retain your personal data only for as long as necessary. Our retention periods are:

• Account and profile information — held for the duration of your account, plus 30 days after deletion to allow for recovery requests.
• Reviews and ratings — retained indefinitely as part of the public record of the platform, unless successfully disputed or a deletion request is granted.
• Verification documents — deleted within 7 days of successful verification. We do not retain identity documents beyond this period.
• Messages — Retained for the duration of your account, then deleted when your account is closed
• Usage data and logs — retained for up to 12 months.
• Legal or compliance records — retained for up to 7 years where required by law.

5. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, secure authentication, and role-based access controls. Verification documents are stored in a restricted-access environment and are accessible only to authorised personnel. While no system is completely secure, we are committed to protecting your information and will promptly notify you and the ICO of any data breach where required by law.

6. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete information via your account settings or by contacting us.
• Erasure — request deletion of your account and associated personal data, subject to legal retention obligations.
• Portability — request your data in a portable, machine-readable format.
• Restriction — ask us to restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent — where processing is based on consent (e.g. marketing), you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us using the details in Section 10. We will respond within one month.

7. Cookies

We use cookies and similar technologies for:

• Essential cookies — required for authentication, security, and core platform functionality. These cannot be disabled.
• Analytics cookies — help us understand how users interact with Rentory so we can improve the experience. These are only set with your consent.

When you first visit Rentory, you will be asked to accept or decline non-essential cookies. You can update your cookie preferences at any time via the cookie settings link in the footer, or through your browser settings.

8. Children’s Privacy

Rentory is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or through a notice on the platform. Your continued use of Rentory after changes are posted constitutes acceptance of the updated policy. The version number and date at the top of this page will always reflect the latest revision.

10. Contact Us & Your Right to Complain

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how your data is handled, please contact us:

General support: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.