Privacy policy

1. Data controller

• Owner: [Nombre y apellidos o razón social del titular]
• Tax ID: [NIF / CIF]
• Address: [Domicilio completo, código postal, ciudad]
• Email: [correo de contacto, p. ej. privacidad@rentisure.com]

2. What data we process

• Account details: name, email address and password (stored encrypted). If you sign in with Google or Apple, we receive your name, your email (or Apple’s private relay address) and an identifier for that account.
• If you are looking for a home: your presentation video (your image and voice), your presentation text, the areas you are searching, your preferences (type of home, rental type, bedrooms, bathrooms…) and your budget.
• If you offer a home: photos, description, features (type, floor, orientation, bedrooms, bathrooms, usable floor area, energy rating and rental type), area and price.
• If you list homes on behalf of third parties: your representative profile, that is, legal name, tax ID (NIF) and, if applicable, professional registration number and issuing authority.
• Record of acceptances: each time you accept a document or notice (when you sign up, activate your application or property, accept a match or save your representative profile) we store the document code, its version (for example PP2601), the date and time, your user and the item it refers to (your account, application, property or the match).
• Matches: the suggestions, each side’s answers, the history of what happened (created, accepted, rejected, reported, email sent) and a copy of how the application and the property looked when the match was created, including the budget and the price, which are never shown to anyone.
• Copies of a match’s videos and photos: if you replace or delete a video or photo that was part of a match, we keep a private copy linked to that match for the periods in section 6.
• Reports and blocks: the reason, description, date, who reports and what is reported, plus the status and our team’s notes; and, if we block an account, application, property or match, the reason for the block.
• Essential technical data: chosen language, technical session cookies and security logs (for example, the IP address at sign-in).

We do not ask for or process special categories of data (health, origin, religion, sexual orientation…). Please do not include them in your video or presentation, and do not include your budget, contact details or other people’s data either.

3. Why we use it and on what legal basis

• To provide the service: create your account, store your application or properties and suggest matches between applications and homes. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), namely the Terms and Conditions.
• To share your application (video, image, voice, description and housing preferences, never the price) with the owners, or their representatives, whose homes fit what you are looking for, and to show you a home only once its owner has accepted you. You expressly authorise this when you activate your application. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To introduce you by email once both sides accept: each of you receives the other’s email address so you can contact each other directly. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To identify people who list homes on behalf of third parties (representative profile). Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in applicants knowing that the person listing is authorised (Art. 6(1)(f) GDPR).
• To keep the record of acceptances, each match’s history, the match-time copy and the copies of videos and photos, so we can show what was accepted and what was shown, handle reports and claims and defend our rights or yours. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and the duty to be able to demonstrate compliance (Art. 5(2) GDPR).
• To handle reports of discrimination or violence and to block accounts, applications, properties or matches that break the Terms. Legal basis: legitimate interest in keeping the service safe and free from discrimination (Art. 6(1)(f) GDPR) and, where applicable, legal obligation (Art. 6(1)(c) GDPR).
• To send service emails: account confirmation and password recovery. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To protect the service and prevent fraud and abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• To comply with legal obligations and requests from authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not send advertising or sell your data. Suggestions are calculated automatically from area, features, rental type, budget and price, but people always decide: the owner decides whether to accept you, and you decide whether to accept the home. There are no automated decisions with legal effects on you (Art. 22 GDPR).

4. Who can see your data

• Owners and their representatives: when their home fits you, they see your name, video, presentation and what you are looking for. They never see your budget.
• People looking for a home: see a home’s photos, description, area and features only once its owner has accepted them. They never see the price the owner entered.
• Email address: only shared once both sides have accepted, in the introduction email. We do not share phone numbers or postal addresses.
• Representative profile: its details (legal name, tax ID, registration) are only seen by you and our team.
• Reports: the person reported is not told who reported them.
• Our team: accesses the data needed to handle reports, blocks, document versions and each match’s information, with a personal admin account.
• None of this is public. Videos and photos are kept in private storage, are only served to authorised people through temporary links that expire after one hour, do not appear in search engines, and the app offers no option to download them.

5. Providers who help us (processors)

We use providers who process data on our behalf, under contract and only on our instructions:

• Supabase: database, sign-in and storage of videos and photos. Servers in the European Union (Paris).
• Vercel: hosting of the website and the portal, and aggregated, cookie-free visit statistics (Vercel Web Analytics). May involve transfers to the US, covered by the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Dinahosting: sending service emails. Servers in Spain.
• Google and Apple: only if you choose to sign in with them; their own privacy policies then also apply. Apple and Google also distribute the mobile apps through their stores.

6. How long we keep it

Your account, application and properties: for as long as your account is active. You can delete it at any time in Settings → Delete account: your account, application, properties, videos, photos, matches and each match’s match-time copy are erased. Technical backups are overwritten within 7 days at most.

Copies of videos and photos linked to a match (they only exist if you replaced or deleted a file that was part of that match):

Record of acceptances, reports and blocks: kept even if you delete your account, because they are the evidence of what was accepted and what was reported, for as long as needed to handle possible claims and for the periods the law sets. During that time only our team can access them.

We only keep other data if a law requires us to, blocked, for the period it sets.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [correo de contacto, p. ej. privacidad@rentisure.com]. Many you can exercise yourself: edit your details in the app, or delete your account in Settings. We reply within one month.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Minimum age

Rentisure is only for people aged 18 or over. When you sign up you confirm that you are at least 18.

9. Security

Your data travels encrypted (HTTPS). Access rules live in the database itself: each person can only read what belongs to them, even if they query it directly. Videos and photos are private and served through temporary links. Passwords are stored encrypted and we never see them.

10. Cookies

We only use technical cookies the service needs to work. See the Cookie Policy.

11. Versions and changes

Each version of this policy has a code (this one’s is shown under the title) and we record which version each person accepted. If we change it in a significant way, we will let you know in the app or by email before the change applies.