Privacy Policy

RentalsProof is operated by Nawfal Mrani, an individual conducting business under that name. Business contact address: 11268 Vista Sorrento Parkway, San Diego, CA 92130, United States. Privacy and support contact: [email protected].

The service reviews material for people considering United States rentals. It is not a landlord, property manager, credit bureau or tenant-screening service. This Policy covers information we handle through rentalsproof.com and related service communications, not the independent practices of a listing platform or someone to whom you choose to send a report.

Account and contact information: your email, account identifier, profile details you provide, authentication information, account activity and support correspondence. Supabase handles account authentication. Never send your password to support.

Submitted material: listing links, page text, messages, screenshots, lease PDFs, filenames and file metadata. This may include property addresses, advertiser names, contact details, rent, fees, signatures or other people’s information that appears in the material. We also retain extracted text, structured listing details, scan status and generated reports when needed to provide the service.

Order information: the selected product, price, currency, payment status, payment-provider references, delivery email, receipt or refund information, pass activation and usage. For fraud, support and dispute handling, we can retain limited checkout evidence such as the checkout time, IP address, browser request information, agreement version and Stripe-provided payment-method fingerprint. Card and other payment details entered in Stripe Checkout are collected by Stripe; RentalsProof does not store your full payment-card number or security code.

Technical and journey information: network and security systems can receive your IP address, request time, requested page, browser or device information, referring information and error details. Our first-party journey records can include page and product events, page paths, referring domain, broad device category, country and approximate city or region when supplied by the network provider, campaign parameters such as UTM source/medium/campaign, and random session identifiers. The session identifier is not generated from hardware characteristics. If you choose Allow analytics, a random visitor identifier can persist in browser storage to connect visits over time; without that permission, visitor continuity is limited to the current browser tab/session. Page paths can contain service identifiers, so these records should not be treated as guaranteed anonymous data.

Agreement records, where collected, can include the document version, a document fingerprint, the action taken, the server-recorded time and the associated account or order. Optional marketing records are separate and can include the email address, consent wording/version, source, status and time of opt-in or opt-out. A visible link or notice alone is not proof that a separate acceptance record has been created. Agreement evidence is not consent to marketing.

We receive information directly from you, from pages you ask us to retrieve, from use of the website, and from service providers such as authentication and payment services. A page retrieved from a listing link may contain information you did not type yourself. You can instead supply relevant text or screenshots where offered.

We use this information to check submitted material, create and deliver reports, maintain account history, provide downloads and pass access, process orders, prevent duplicate charges, understand acquisition and where users leave the purchase journey, improve the website, respond to support and privacy requests, investigate errors, address fraud or payment disputes, secure the service and comply with applicable obligations. We use an email for promotional messages only when a separate marketing opt-in has been recorded.

Automated software and AI organize and review the submitted material. A report is informational; we do not use it to decide whether a person qualifies for housing, employment, credit or insurance. Human review of every report is not included. Authorized people may access information as needed for support, security, maintenance or legal obligations.

We do not contact a landlord or manager to produce your report, publish your private submission as advertising, or treat a report as an independent identity or ownership verification. Fetching a listing link still sends a network request to the website hosting it.

Supabase provides database, account authentication and private file-storage services. It receives the account, submission, order, report and operational information needed for those functions. Our application runs on Contabo-hosted infrastructure; Cloudflare helps deliver and protect website traffic. These infrastructure providers can process network requests and technical information.

OpenAI processes relevant submitted or extracted text and, when needed, screenshot images to produce the automated review. Firecrawl may receive a submitted listing URL and return page content when that extraction service is enabled. For public listing sites that block our server, Jina Reader may receive the submitted public listing URL and return readable public page content as an extraction fallback. Our server also retrieves public pages directly where available. We do not provide these services with your account password or payment-card security code as report input.

When an authorized staff member uses our AI-assisted support tool, they send support-message text to OpenAI to help draft a reply. This can include personal details contained in that message. The tool produces a draft for staff review; it does not itself send the reply, issue a refund or change your account. The AI data-handling and provider-retention limits in section 5 also apply to this support use.

Stripe processes checkout, payment confirmation, fraud prevention, refunds and disputes. It receives order and contact information as needed, as well as the payment information you enter in its checkout. RentalsProof can receive and retain Stripe identifiers associated with the transaction, including a Stripe-provided card fingerprint where available, without receiving or storing the full card number or security code. Stripe can process certain information for its own payment, security and legal purposes under its privacy policy.

When you arrive from an OpenAI ad, the link can contain an opaque OpenAI attribution reference. If you complete a purchase, our server can send OpenAI Ads that original reference together with a stable order-event identifier, purchase amount and currency, and our checkout-confirmation URL so we can measure whether the ad led to a sale. We do not send the renter email, listing or lease content, or payment-card data in this conversion event.

Namecheap Private Email is used for transactional report and purchase email and support correspondence. Authentication messages are handled through Supabase Auth and its configured email-delivery service. Email providers receive the recipient address and message content, which can include a listing title or address, order details and a private report link. Protect your mailbox and avoid forwarding private links unintentionally.

Sentry is used for error and limited performance monitoring where configured. The application applies redaction to sensitive fields and does not enable Session Replay. Diagnostics can still contain technical identifiers and error information; redaction is a safeguard, not a guarantee that every accidental inclusion is impossible. Optional usage-analytics integrations are described in section 6.

We disclose information to authorized service providers for the functions above, to advisors where reasonably necessary, or where required by law or reasonably necessary to protect rights, security or address fraud. In a genuine business transfer, relevant information may be transferred subject to applicable law and privacy protections. We do not authorize an unrelated new use simply by updating this Policy.

We do not sell personal information or disclose it to advertising partners for cross-context behavioral advertising. Providing data to a payment, hosting or report-processing provider for the stated service is different from selling your lease or listing submission. You control any separate sharing of a report with a roommate, advisor or other recipient.

Relevant material leaves the RentalsProof application when an AI request is sent. It can contain personal information that is visible in your submission. Redact unrelated names, signatures, account numbers, identity documents and other unnecessary sensitive details before sending a file or text.

OpenAI states that its API data is not used to train its models by default unless the organization opts in. This is the provider’s published default, not a promise of zero retention or independent verification of every account-level setting. Its documentation distinguishes abuse-monitoring logs from stored application state; endpoint behavior, account settings and legal requirements can affect retention.

Deleting information from RentalsProof does not automatically delete every provider-held record. Where applicable, we use available provider processes for a valid request and explain relevant limits. We do not promise immediate deletion, an unverified no-training account configuration, or a zero-data-retention arrangement.

Our dedicated AI operations table is designed for limited information such as model, duration, usage counts, status and an abbreviated scan reference, rather than the underlying prompt, lease, screenshot or model response. That design does not mean the report itself or all provider logs contain no personal information.

Authentication uses cookies or comparable browser storage to maintain a session. A separate secure scan-access cookie is used to authorize access to a scan; its current validity period is four hours. Security or payment providers may use their own cookies and similar technologies when their functions are used. Blocking required cookies can prevent login, checkout or private access from working.

The optional Send to RentalsProof capture feature keeps captured listing text in this tab’s session storage so it can populate the form. The application removes that value when it reads it and rejects captures more than 15 minutes old. That age check is not a background deletion timer: an unread value can remain until the browser clears the tab’s storage. Clearing browser storage does not delete a submission already sent to our server.

Our first-party journey measurement uses a random session identifier in browser session storage so we can connect events within a visit and identify where a session stopped. This is not a hardware or device fingerprint. If you select Allow analytics, we also store a separate random visitor identifier in local storage so visits can be connected over time. If you select No thanks, that persistent visitor identifier is not created and any existing one is removed. Basic same-session measurement and security/payment logging can still occur because they support operation, fraud prevention and service improvement.

With your current analytics permission, Google Analytics can receive a Google-tag client identifier, a session identifier when available, and purchase measurements including a transaction reference, product category, amount and currency. Browser purchase measurement and optional server-side delivery use the same transaction reference to reduce duplicate counting. We do not include your email, rental address, listing or lease content, or payment-card details in these purchase measurements. Advertising personalization and advertising user-data consent remain denied in this integration. A previous choice covering only first-party visitor continuity is not reused as permission for this Google measurement.

Use Analytics preferences on this Privacy Policy page to change your choice. Withdrawing permission stops future optional purchase measurement from this browser and requests cancellation of pending server delivery associated with its session. It cannot recall data already sent to a provider. Our server does not capture new Google attribution identifiers while server delivery is disabled; when enabled, its delivery window is bounded and stale attribution identifiers are cleared by the worker. A provider accepting a request is not proof that it appears in its reports. Separate first-party operational records and necessary payment records remain governed by the purposes and retention criteria above.

The website also supports optional Plausible or Umami analytics scripts when configured. Such a provider can receive page or event and technical request information. For OpenAI Ads campaigns, we can preserve the opaque `oppref` value supplied on the ad-click URL and use it in a server-side confirmed-purchase event as described in section 4. This measurement does not require us to send listing content or payment-card data to the ads system. This Policy does not claim that cookieless or server-side measurement removes every privacy obligation; we apply consent or opt-out controls where legally required.

The current application does not change its essential operation or first-party event counting in response to the legacy Do Not Track browser signal. Global Privacy Control is a different preference signal: we do not sell or share information for cross-context behavioral advertising, so there is no such current activity for that signal to switch off. This statement does not waive any obligation to honor a legally applicable opt-out signal. Security, authentication and payment providers can process information across the services they operate under their own policies; we do not authorize advertising partners to track you across unrelated sites through this website.

Retention is purpose-based, not one universal period. We consider whether information is still needed to deliver a paid service or requested account history, address a specific support or security issue, or meet an applicable accounting, dispute or legal obligation. The categories below explain the criteria. We do not promise permanent report availability or automatic deletion after an arbitrary number of days.

The current application does not apply a universal automatic purge to all submissions and reports. Eligible deletion is handled through the request and operational review process; data can remain in the application until that process is completed. A guest report link normally expires 14 days after generation. Link expiry, a failed scan, the end of a 30-day pass, logging out or closing a browser does not itself delete the stored data.

When an active legal or security issue requires preservation, we keep only the relevant information for that purpose and reassess it when the issue ends. We distinguish necessary payment or agreement evidence from the full rental documents. Provider and backup copies may follow different cycles, as explained below.

Email [email protected] from the address associated with your account or purchase. Explain whether you want a copy, a correction, removal of a particular submission or report, or account closure. Include an order reference if you have one. You do not need an account to request help with a guest purchase.

We verify that a request relates to you before disclosing or changing private information. Verification is proportionate to the request; we normally use the existing email, authenticated account or order information. Do not send a password, full card number or identity document as routine proof. An authorized agent may submit a request, subject to reasonable proof of authority and any verification required by law.

We review the account, associated submissions and reports, stored files, correspondence and relevant provider records within the request’s scope. Account deletion and file deletion are separate steps. We explain any information that must be retained, the reason, and any effect on a still-active service. Download reports you need before requesting removal.

A deletion request does not automatically issue a refund, reverse a card transaction or erase records we must keep. The Terms govern service and refund remedies without limiting your privacy rights. We respond within applicable legal deadlines and explain any permitted extension or inability to fulfill part of a request. We do not require withdrawal of an honest review or complaint.

Depending on your location and the law that applies, you may have rights to access, correct, delete or obtain a copy of information; object to or limit certain processing; or appeal a refusal. California rights can include opting out of sale or sharing and limiting qualifying uses of sensitive information where the applicable law covers the business and processing. We do not assume every law applies to every request, and we do not take away rights that do apply. Contact us to request review of a response or raise a concern with the appropriate regulator.

We do not discriminate against you for exercising an applicable privacy right. A service that genuinely needs information may no longer be deliverable after that information is removed; we explain that practical effect rather than treating the request as misconduct.

We use measures such as encrypted connections, private storage, account and report-access controls, rate limits and monitoring. Access is limited according to operational responsibilities. No website, email system or storage provider is immune to error or unauthorized access, and these measures are not a guarantee of absolute security.

A guest report link can grant access without a password. Treat it as private. People with access to your email, shared device or forwarded link may be able to read the report. Copies you download or share are outside our application’s deletion controls.

RentalsProof is operated from the United States and uses distributed service providers. Information may be processed in the United States and other countries where those providers and authorized personnel operate. We do not promise that all data remains in one country. Where applicable law requires safeguards for a transfer, those requirements apply; using the website does not waive them.

The paid service and accounts are intended for adults aged 18 or older, not children. Do not submit children’s information or unnecessary health, financial-account, government-identifier or other sensitive material. We do not knowingly solicit personal information from children under 13. Contact us if such information was submitted so we can assess and remove it as required.

Only submit material you are authorized to share for this purpose. A lease or message can contain someone else’s personal information even when you are entitled to review it. Redact irrelevant details. Our product does not require your Social Security number, bank login or a copy of your identity document.

We publish the effective date and a versioned text copy of this Policy. The preceding published wording is also available. For a material change, we provide appropriate notice, such as a prominent site notice or an email where relevant, and seek consent where required before a new use that requires it.

Posting a revised Policy does not retroactively authorize an incompatible use of information already collected or remove an accrued legal right. The Terms remain a separate agreement. An acknowledgement of this Policy is not an automatic marketing subscription.

Privacy requests, support and questions: [email protected]. Operator: Nawfal Mrani, doing business as RentalsProof. Business contact address: 11268 Vista Sorrento Parkway, San Diego, CA 92130, United States.

Provider policies explain the providers’ own practices and do not replace our responsibilities. Links below are for reference and are not an instruction to send your lease, password or payment credentials to another service. Start with our privacy contact for requests concerning information we control.