Privacy Policy

Information Collected

We collect the information you provide for accounts, rental inquiries, listings, tours, applications and support. This includes names, email addresses, phone numbers, addresses, rental preferences, messages and follow-up notes. Applicant and guarantor records can include date of birth, employment, income, credit range, voucher information and named references. Professional workspaces can also hold company, agent, listing, communication and billing records. Account and record identifiers connect these details to the relevant person, inquiry or transaction.

Sensitive Documents

Public lead forms ask for contact details, financial ranges and application readiness; they do not request SSNs or uploads of identity or financial documents. Authenticated application workflows accept photo identification, pay stubs, bank statements, tax returns, reference letters and other applicant-provided documents. Authorized users can also upload screening reports. Files are stored in private Supabase storage, linked to their application records, and accessed through the application workflow. They are separate from the optional AI rental-search feature, which does not automatically receive these documents. Screening-report access expires according to the report record, and expired files are queued for cleanup; ordinary application documents have a different lifecycle.

Consent and Notices

Lead forms capture general contact consent and provide access to the Terms of Use, Privacy Policy, NY Fair Housing Notice, and Agency Disclosure before submission. A separate, optional, unchecked checkbox records express written consent only for recurring marketing SMS messages. That marketing consent is separate from consent for calls, emails, and transactional or service communications, and it is not required to submit a form or obtain services. Mobile information and SMS consent are not sold or shared with third parties or affiliates for marketing or promotional purposes. Users may reply STOP to opt out or HELP for help.

Service Providers and Recipients

Supabase provides account authentication, database records and private application-file storage. Backblaze B2 stores profile images, and authorized listing-media workflows can use Google Drive. Lead forms also forward submitted fields to n8n Cloud for routing, including the financial ranges and employment details supplied on application forms. When configured, Zoho CRM receives contact, listing and message details, including application summaries; professional connectors can also use Zoho Cliq. Inquiries and tour details are shared with the responsible real estate professionals. Configured communication services include Resend for email, Green API for WhatsApp and Twilio for SMS and call connections. Billing workflows can use Stripe for checkout and subscription processing. These service and recipient copies are separate from the optional AI-search transfer described below. Their retention and downstream processing depend on the service and applicable arrangements; the specific cleanup periods below do not apply to every recipient or record.

Google Analytics and Page Activity

Our pages load Google Analytics to measure page visits, listing views, form activity, tour requests and campaign attribution. Google Analytics uses browser and device information, approximate geography and browser cookies or similar identifiers to distinguish visits and sessions. Conversion events can include lead or tour-request identifiers that we can connect to the related contact or transaction record; leaving names and email addresses out of those events does not make the identifiers anonymous. Page information can include the current URL and search terms in manual-search links. Google Analytics cookies and event records have their own settings and retention periods, separate from the 180-day saved-match preference described below. Optional AI-sharing controls do not turn off page analytics. Google's processing also depends on the configured service settings and terms.

• - Retention: Our current Google Analytics settings use a 2-month event-data period and a 14-month user-data period. Google also applies the user-data period to key-event data. New activity restarts the retention period for the user's identifier, so it can remain longer while they continue using the site. Eligible data is removed through Google's monthly deletion process. These periods do not limit standard aggregated reports and are separate from browser cookie lifetimes and other service records.
• - Additional sharing: Our Analytics account enables Google to use Analytics data to improve Google products and services, use aggregated and de-identified measurement data for modeling and business insights, access data for technical support, and provide recommendations for our business. These enabled settings allow uses beyond measuring activity on RentWithMe, subject to Google's applicable settings and terms.

Saved Data on Your Device

The browser or app webview stores sign-in information. We have retired local copies of submitted renter, landlord, contact, tour and application forms, listing inquiries and apartment-finder searches. Current pages attempt to remove those specific old copies without reading or assigning them to the signed-in account. If storage access is denied, those old copies may remain until you remove them. Showing-request receipts now stay only in the current tab's memory for up to 30 minutes and clear when you hide the tab or app, reload or leave the site, change account/session, or clear them on the Tours page. You can download a receipt separately. Requests saved to an authenticated account remain on the server; older guest requests are not attached by matching an email address. The Tours page can clear current-visit receipts and the retired form copies without deleting server requests, saved sign-in or opaque account-deletion receipts. Saved or compared listing choices, accessibility settings and other workspace preferences still use device storage. Broader browser or device site-data controls can remove those preferences, saved sign-in and local deletion receipts, so keep any receipt you need to follow a pending request. The AI draft and suggestion have the separate memory-only lifecycle described below.

Operational Records and Logs

We keep communication, consent, routing and security records to operate and support the service. These can contain account and contact identifiers, message details, and, for screening consent, the request's IP address and browser information. Operational logs can also contain contact details from integration processing. The specific 30-day periods below cover the named cleanup records and AI request metadata. They do not describe the lifetime of all account, application, communication, integration or provider logs. The account-deletion section explains the cleanup process and the shared or unresolved records that require different treatment.

Billing Recovery and Cancellation

Billing records include your account email and identifiers, plan and pricing details, Stripe customer and subscription references, and request and confirmation records used to prevent duplicate billing and recover interrupted operations. Completed or cancelled billing operations become eligible for cleanup after 30 days and remain longer while a related account-deletion receipt exists. Unresolved operations retain the information needed for recovery. If your account has billing activity, deletion also checks for open checkouts and recurring subscriptions, requests their cancellation and removal of the related Stripe customer, and waits for confirmation before removing the account. Billing cancellation has a separate status on your deletion receipt. Its confirmation record remains while that receipt exists and for at least 30 days after confirmation. These cleanup steps do not establish deletion of every payment or invoice record retained by Stripe.

Optional AI Rental Search

Local search does not require AI sharing. Before an optional AI search, RentWithMe asks you to review and allow sharing with Badichi Intelligence and Google Gemini API. Recording permission does not send a search: you then choose Use AI for each search. Only the search text you submit is sent; profile data, leads, contact details, income, documents, precise location and chat history are not automatically attached. New drafts and AI suggestions stay in current-view memory and are lost on reload. Permission and limited request metadata are stored without the raw query or result; request metadata expires after 30 days or is removed with your account. Suggestions do not change criteria until you apply them. Applying sends the selected criteria to RentWithMe to rank listings; it does not send another AI request. Remember is a separate choice that stores selected criteria in a browser cookie for up to 180 days, including on shared devices. Your browser sends this cookie to RentWithMe with site requests, and our server uses it to load matches from those saved criteria. The cookie contains no raw AI search text, explanation or AI permission. You can clear remembered preferences in the matches workspace. This feature does not send prompts or results to RentWithMe learning logs or model-training feedback. The configured Google Gemini API project uses the Free Tier; Google states that Free Tier content may be used to improve its products. Do not include sensitive or confidential information in an AI rental-search request. Google processes Gemini API requests under the terms that apply to the configured Free Tier project, including its data-use and abuse-monitoring practices. Turn sharing off from My Profile > AI privacy. Withdrawal stops new send claims; a send already in flight may finish, and data already sent cannot be recalled. Legacy search links may already contain text in browser history or server requests; new homepage drafts use a query-free memory handoff.

Device Location

Near Me requests one device location only after you tap Use my location. Precise location is optional. Coordinates are sent to RentWithMe in the search request body to rank published properties and kept in page memory for retry or a wider search until you hide or leave the page. We do not write them to your account, profile, analytics or advertising records. Request processing still involves our hosting infrastructure. Manual search terms appear in the results-page URL, which our normal page analytics can receive. Interactive maps offer a separate optional device-area action; the selected provider (Google Maps, Apple Maps when configured, or OpenStreetMap) receives the displayed map area and normal map request information. Property maps otherwise use listed property locations, not your current location. You can decline location and search by city, address, neighborhood or postcode, choose a borough, or pan a map. We do not start continuous or background location tracking; returning to the page requires another tap to request location.

Mobile Applications

The RentWithMe.ai and RentWithMe.ai Pro mobile applications present this same website inside the app, so the practices described in this policy apply there as well. Any permission the app requests — location, camera, or photo access for a profile picture or listing media — is requested at the moment the related feature is used, and can be refused without losing access to the rest of the app.

Deleting Your Account

You can request account deletion from Account settings, including for a pending or blocked account, or use the contact form. A saved request immediately disables access to that account. Account records and verified personal files, including avatars, application documents and screening reports, are cleaned up through a retryable process. Keep the private receipt to check whether account removal or file cleanup is still pending; completion is shown only after the tracked cleanup is verified. Detailed completed file-cleanup records are removed after 30 days. Receipts remain available while automatic cleanup or retry is pending and for at least 30 days after account cleanup and the last Apple outcome, including a manual recovery notice. Pending requests retain the information needed to finish cleanup. Minimal nonreversible identifiers are retained indefinitely to prevent reuse of deleted accounts and retired storage locations, to prevent older Apple sign-in sessions from becoming valid again after a revocation event, and to preserve an unresolved Apple capture outcome without retaining its credentials. Shared transaction records, including executed leases, remain available to their other parties. Older records without verified account ownership require a separate ownership review. The deletion page separately confirms or offers a retry for clearing this device’s saved sign-in, while preserving another account signed in on the same browser. Sign in with Apple permission has a separate status. We encrypt Apple sign-in input during validation and captured credentials on the server, and retry validation or revocation independently of account and file cleanup. Recovery validates only the originally verified Apple subject and never blindly revokes unvalidated input. After three provider-validation attempts, a missing response or unknown rotation requires manual recovery; unvalidated input is then erased. Credential ciphertext is erased after revocation is confirmed; completed credential records and finished or manual capture metadata are removed after 30 days. A minimal digest preserves an unresolved capture outcome so it cannot later be reported as confirmed revocation. Signed Apple notifications are verified, invalidate older sessions when permission is revoked, and update email forwarding preferences. Notification receipts are retained for 31 days. If a revocable credential is unavailable, including for older sign-ins, open your Apple Account’s Sign in with Apple settings, select this app or developer and stop using Sign in with Apple for it. Account deletion is still processed while revocation is pending or those manual steps remain.