Privacy Policy

• Account details. Your email address; a password, stored only as a hash by our authentication provider; and whether your rental properties are in the United States, as you tell us when you sign up. If you sign in with Google, the name and email address Google shares with us.
• Waitlist. If your rental properties are outside the United States, your email address and the country you name, so we can tell you when RentStory supports it. You can ask us to remove it at any time.
• Portfolio data you enter. Property addresses, units, purchase prices, loan terms, taxes and insurance, market and contract rents, expenses, and tenant names and balances as you record them.
• Documents you upload. Owner statements from your property manager, as PDFs or images, and the ledger rows we extract from them.
• Billing details. Handled by Stripe. We store your Stripe customer and subscription identifiers, your plan, and the dates you have paid through. We never see or store card numbers.
• Technical data. Our hosting provider keeps short-lived server logs (IP address, browser, timestamps) for security and debugging. We measure page traffic and page speed using our hosting provider’s own privacy-preserving tools: they set no cookies, follow no one between sites, build no profile, and keep no identifier about you beyond the day. Page addresses that name one of your properties or documents have the identifier stripped out before anything is sent. We run no advertising trackers.
• Diagnostics, inside the application and on its signup page only. We use PostHog to see how the application behaves for you: the pages you visit, errors it hits, and DOM event tracking. None of this runs on the marketing site, or at all if your browser sends a Do Not Track or Global Privacy Control signal.

• To run the product: compute your cash flow, reconcile statements against your ledger, and produce reports.
• To read uploaded statements into ledger rows using an AI model (see the next section).
• To bill you and to send transactional email: account confirmation, password resets, receipts, and payment problems.
• To notify ourselves when a new account is created, so we can help new customers get set up.
• To keep the service secure and to fix problems.
• If a Google or Meta ad brought you here, to tell that ad platform, by the ad’s click identifier, that the click led to a confirmed signup and, later, to a paid subscription and its price.

We do not sell personal information, and we do not use your data to train AI models, ours or anyone else’s.

When you upload an owner statement, its contents are sent to Anthropic’s API, which reads the document and returns structured ledger rows. Under Anthropic’s commercial terms, content sent to its API is not used to train its models. You review the extracted rows before they are committed to your ledger, and the original file stays in private storage that only your account can read.

Owner statements and your own entries can include tenant names, rent charges, and balances. You are responsible for having the right to upload and record that information. We process it only on your behalf and only to provide the service to you. We never contact tenants and never share tenant information with anyone other than the service providers below.

These companies process data for us so the product can run. All of them are located in the United States, which is where your data is stored and processed. If you use RentStory from outside the United States, you are sending your data there.

• Supabase: database, authentication, and file storage. Your data is stored in its US East region.
• Vercel: hosting for the website and the application, and the page-traffic and page-speed measurement described above.
• PostHog: the application diagnostics described above, from inside the application and its signup page.
• Stripe: payments, subscriptions, invoices, and sales tax.
• Anthropic: AI extraction of uploaded statements.
• RentCast: property details and market-rent estimates. We send it the property address you enter.
• Resend: transactional email.
• Pushover: sends us an internal notification, containing your email address, when a new account is created or you join the waitlist.
• Google: sign-in, if you choose to sign in with Google. We request only your email address and basic profile.
• Google Ads and Meta: if one of their ads brought you here, the ad’s click identifier, whether you confirmed your signup or subscribed, and for a subscription its plan and yearly price (for Meta, also your browser’s user-agent string). Never your email, your name, or the contents of your portfolio.

We may also disclose information if the law requires it, or to protect the rights and safety of our customers or the service. If RentStory is ever acquired or merged, your data would transfer to the new owner under this policy, and we would tell you first.

We may produce aggregated, de-identified statistics from across the service, such as typical maintenance costs per unit in a region. Those never identify you, your properties, or your tenants.

We use the cookies needed to keep you signed in, and one more of our own: it remembers which link or ad campaign first brought you to RentStory, for up to 90 days, and is attached to your account when you sign up. If your browser sends Do Not Track or Global Privacy Control, it keeps the campaign name but not the ad’s click identifier, so nothing is reported back to the ad platform. Our traffic measurement and application diagnostics set no cookies at all and are served from our own domain, so there is no third-party cookie here for a browser’s Do Not Track signal to switch off. Traffic measurement treats everyone as if that signal were on; application diagnostics honour it, and Global Privacy Control, by not running.

We keep your data for as long as your account exists. To delete your account, email info@rentstory.co from the address on the account. We will remove your account, portfolio, and uploaded documents within 30 days, and they will roll out of backups within a further 30 days. Billing records are retained as long as tax and accounting law requires, typically seven years.

• Access and export. Portfolio includes export of your ledger. On any plan, email us and we will provide a copy of your data.
• Correction. You can edit anything you have entered directly in the product.
• Deletion. Described above.
• Email. Transactional email is part of the service. We do not send marketing email.

If you live in a state with privacy legislation, such as California or Colorado, you can exercise those rights by emailing us. We do not sell personal information. The one disclosure that could count as sharing for advertising is the ad conversion described above, and a browser that sends Global Privacy Control or Do Not Track opts out of it automatically. To opt out otherwise, email us.

Data is encrypted in transit and at rest by our providers. Each account’s data is isolated at the database layer with row-level security, uploaded statements live in a private bucket, and internal credentials are scoped to the least access needed. No system is perfectly secure. If a breach ever affects your data, we will tell you promptly by email, and we will notify regulators where the law requires it. If you believe your account has been compromised, email info@rentstory.co.

RentStory is for adults managing rental property. We do not knowingly collect information from anyone under 18.

We will post any changes here and update the date at the top. If a change materially affects how we handle your data, we will email you before it takes effect.

Questions about this policy or your data: info@rentstory.co.