LEGAL

Privacy Policy

Effective October 5, 2026

This policy explains what personal data Rentametrix Inc. ("Rentametrix", "we", "us") collects, why we collect it, who we share it with and how long we keep it. It covers the marketing site at www.rentametrix.ai, the application at app.rentametrix.ai, the documentation site, the Rentametrix API and the AI tool connections (MCP) that run on it.

Rentametrix is a business product for student-housing operators. It is not directed at consumers or at anyone under 18.

1. Who we are

Rentametrix Inc. is the data controller for the personal data described in this policy, except for customer data (section 4), where our customer is the controller and we process it on their instructions.

Questions, access requests and deletion requests go to support@rentametrix.com.

2. Data we collect from you directly

• Account and sign-in data. When you create an account or sign in we receive your name, email address and, if you sign in with an identity provider such as Google or Microsoft, the profile picture and unique account id that provider returns. Sign-in is handled by Auth0 on our behalf.
• Contact form data. When you request a walkthrough we collect your name, work email, company and anything you type in the message field. We email it to our team and reply from that address.
• Support correspondence. Anything you send to support@rentametrix.com, including attachments.
• Usage data. The questions you ask in chat, the reports you run, the tools your AI client calls and the time, IP address and user agent of each request. We keep this to answer your questions, to debug, to audit access and to improve the product.

3. Sign in with Google

If you choose Google to sign in, we ask Google only for your basic profile: name, email address and profile picture. We use it to create your account, to identify you on later sign-ins and to show your name inside the product. We do not request access to your Gmail, Google Drive, Calendar or any other Google service through sign-in.

We do not sell Google user data, use it for advertising, or share it with anyone other than the service providers in section 6 who need it to run sign-in and the application. Removing Rentametrix from your Google account permissions page ends our access. You can also ask us to delete your account at any time.

Rentametrix's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

4. Customer data we process for operators

Operators connect Rentametrix to their own systems. The data that flows in belongs to the operator and we process it only to provide the service they signed up for.

• Property management systems. Leases, units, floor plans, rents, charges and resident records from systems such as Entrata and AppFolio, under credentials the operator supplies.
• Lease trackers. Spreadsheets, including Google Sheets, that the operator shares with a Rentametrix service account. We read the ranges the operator points us at and, where configured, write summary figures back.
• Market research. Public rents, specials and availability collected from competitor websites and listing sites. This is property-level data, not personal data.

Resident names, emails and phone numbers are the most sensitive data we hold. By default no user sees them: lease records are shown by unit, bed and lease id, and resident fields are masked before any report, export or AI model sees them. A named operator user can be granted resident read access only by Rentametrix staff, with a written reason, and every grant and revocation is audited. Partner keys can never carry that access.

5. AI models

Chat answers, reports and AI tool calls use large language models from providers such as Anthropic and OpenAI. We send the model the question and the data the tool returned for it. Resident fields are masked before the model sees them unless the user holds resident read access. We use providers under terms that do not allow them to train on our customers' data.

6. Who we share data with

We do not sell personal data. We share it only with service providers that process it on our instructions:

• Auth0 (Okta) for sign-in and session management.
• Microsoft Azure for hosting the API and databases.
• Vercel for hosting the web sites and the application.
• Anthropic and OpenAI for AI model responses (section 5).
• Resend for transactional email, including the contact form.
• Sentry and a self-hosted log server for error monitoring and request logs.
• Stripe for billing, where a customer pays by card.

We also share data with an operator's own PMS and spreadsheet providers when they connect them, and with law enforcement or regulators when the law requires it. If Rentametrix is acquired or merged, data transfers with the business under this policy.

7. Cookies

The marketing site sets no analytics or advertising cookies. Signed-in areas set the session cookies needed to keep you logged in; they are HttpOnly, Secure and expire when the session ends or you log out. We do not use third-party tracking pixels.

8. How long we keep data

• Account data: for the life of your account and 90 days after it closes.
• Customer data, including resident records: for the life of the customer relationship and 90 days after offboarding, then purged. Earlier deletion on a customer's or a resident's request.
• Raw integration payloads kept for debugging: 30 days.
• Access and audit logs: one year.
• Contact form and support email: as long as needed to handle the request, then as ordinary business correspondence.

9. Security

Data is encrypted in transit and at rest. Secrets live in a managed key vault, not in code. Access to production data is limited to named staff and is logged. Resident data is masked by default as described in section 4. If we learn of a breach affecting your data we will notify affected customers without undue delay.

10. Your rights

You can ask us to show you the personal data we hold about you, correct it, export it or delete it. Email support@rentametrix.com and we will answer within 30 days. If you are a resident of a property that uses Rentametrix, your operator is the controller of your records; we will forward your request to them and help them fulfil it. Where local law gives you further rights, including the right to complain to a supervisory authority, those rights apply.

11. International transfers

Rentametrix is based in the United States and processes data there. Customers outside the United States should expect their data to be transferred to and stored in the United States.

12. Changes

When we change this policy we update the effective date at the top of this page. For material changes we also email account holders. Continued use after the effective date means you accept the updated policy.

13. Contact

Rentametrix Inc.
support@rentametrix.com