Privacy Policy

1. What we collect

RentReel collects only the data you give us, in service of the product:

• Account info: your email address and a password hash (we never store your password in plaintext)
• Your financial data: the transactions, property setup, and settings you enter or import via CSV
• Browser metadata: standard request data (IP, user agent, timestamp) for security logging via our hosting provider (Cloudflare) and database provider (Supabase)

We do not collect: your bank credentials, or your CSVs as files (only the parsed transaction rows).

Marketing analytics on rentreel.co: Our public marketing pages (rentreel.co and its sub-pages, including this privacy policy) load the Meta Pixel only after you click Accept on the consent banner — if you decline, no Meta code loads and no data is shared with Meta. We do not currently use Google Analytics. The app itself (app.rentreel.co) does not load any advertising or behavioral-analytics tools once you sign in — only Cloudflare's privacy-preserving Web Analytics runs there. See §4 for the full sub-processor list.

First-party page measurement: Separate from the consent-gated Meta Pixel, our marketing pages send a small first-party measurement event (page viewed, referrer, timestamp) to our own database so we can count visits and see which pages people read. This is our own infrastructure — no advertising network or third party receives it, it is not joined to your app account or financial data, and it contains no cookies or cross-site identifiers. We treat it as essential site telemetry, similar to a server log.

2. Where your data lives

Your transaction and account data is stored in Supabase (Postgres) hosted on AWS US-East. Your account is protected by Row-Level Security (RLS) at the database level — other RentReel users cannot read or modify your data, regardless of any client-side bug.

Your CSVs are parsed in your browser. Only the resulting transaction records leave your device — the original CSV file never does.

3. How we use your data

• To make the product work (display your books, sync across your devices)
• To send transactional email (password resets, account confirmations)
• To investigate security incidents and respond to subpoenas if legally required

We do not use your data for: advertising, training AI models, sharing with affiliates, or selling to third parties — ever.

4. Third parties (sub-processors)

We use the following service providers, each of which receives only the data necessary to fulfill its role:

• Supabase Inc. (database + auth) — stores your encrypted account and data. AWS US-East. SOC 2 Type 2 certified.
• Cloudflare, Inc. (hosting, CDN, Workers, edge compute) — serves the app, logs request metadata (IP, user-agent, timing). SOC 2 Type 2 certified.
• Stripe Inc. (billing for all paid tiers) — processes payment, stores card data on PCI-compliant infrastructure. We never see full card numbers.
• Anthropic PBC (Pro+ Tax users only, on-demand) — when you upload a mortgage/insurance/tax document and use the auto-extract feature, the document contents are sent to Anthropic's Claude API for structured data extraction. Per Anthropic's commercial terms, submitted data is not used to train models and is retained only long enough to process the request. Documents are NOT sent to Anthropic for any purpose other than the specific extraction you initiated.
• Meta Platforms, Inc. (public marketing pages only) — the Meta Pixel loads on rentreel.co and its sub-pages so we can measure ad performance. Meta receives standard web-analytics events (page URL, referrer, timestamp, hashed IP/user-agent) — never your transaction data. The Pixel does NOT load inside the app at app.rentreel.co.
• Google LLC (fonts) — our pages load the Outfit and JetBrains Mono typefaces from Google Fonts, which means your browser sends its IP address to Google's font servers when a page loads. No analytics data is shared with Google; we do not use Google Analytics.
• Script & library CDNs — the app loads open-source libraries (Chart.js via cdnjs/Cloudflare, SheetJS via sheetjs.com, supabase-js via jsDelivr). These CDNs see your IP address as part of serving the file, like any web host. No account or financial data is sent to them.
• YouTube (privacy-enhanced mode) — where a demo video is embedded we use youtube-nocookie.com, YouTube's reduced-tracking embed.

We do not transmit your transaction data (bank exports, PMS reservations, cleaning logs, mileage) to any third party for any purpose other than storage / serving. AI-assisted document extraction is limited to the specific document you upload for extraction — never your full dataset.

5. Your rights

• Access: view all your data inside the app at any time
• Portability: Settings → Export JSON Backup gives you your entire data in a portable file
• Deletion: Settings → Account → Wipe My Data deletes all your data. Account → Delete Account is a full GDPR/CCPA hard-delete: it removes your workspace, personal workspace, and authentication record from our database in a single atomic transaction, with no manual intervention required
• Correction: edit any transaction, category, or setting directly in the app
• Objection / restriction: contact us to restrict processing in specific ways
• CCPA — "Do Not Sell or Share My Personal Information": RentReel does not sell your personal information and does not share it for cross-context behavioral advertising. If you are a California resident and want to formally submit a Do-Not-Sell/Share request under the CCPA, email legal@rentreel.co with the subject "CCPA Do Not Sell/Share" — we'll process within 15 business days.
• GDPR (EU/UK residents): our lawful basis for processing is (a) contract performance — we need your data to deliver the bookkeeping service you signed up for; and (b) legitimate interest — for security logging, fraud prevention, and product analytics on public marketing pages. Where consent is required (e.g., non-essential cookies on our marketing site — see §4), we obtain it through the consent banner. You can withdraw consent, request a copy of your data, request erasure, or lodge a complaint with your local data-protection authority at any time.

Data retention windows

• Workspace data (transactions, properties, uploads): retained while your account is active. Deleted from active systems within 30 days of account deletion; purged from encrypted backups within 90 days.
• Authentication records (email, hashed password): purged on account deletion via the atomic hard-delete RPC. No lingering auth rows.
• AI-extracted documents (mortgage/insurance/tax PDFs sent to Anthropic): the document contents are retained by Anthropic only long enough to process the extraction request, per Anthropic's zero-retention commercial terms. The extracted fields remain in your workspace under your control.
• Billing records (Stripe): retained 7 years per US tax and financial-records requirements, even after account deletion, in Stripe's PCI-compliant environment.
• Security logs (Cloudflare request logs): retained 30 days for abuse investigation, then purged.
• Support correspondence: retained 2 years, then purged unless legally required.

6. Children

RentReel is a business product for adults. We do not knowingly collect data from anyone under 18.

7. Affiliate & referral disclosures

Some links on our marketing site (rentreel.co) and inside the app go to third-party services — currently insurance (Steadily) and any property-management software you choose to connect. Where a company has a marketing-referral relationship with us, we mark that link as a partner link and disclose the relationship on the same page (e.g., our /integrations page). You never pay more because you clicked our link, and the marketing-referral relationship does not change our review or recommendation of the product. RentReel is not a licensed insurance agent, broker, or producer — we do not sell insurance and do not receive commissions on any insurance policy. If you'd prefer to reach a partner directly, you can always type their URL yourself — none of RentReel's core bookkeeping features are gated behind partner signups.

Insurance-partner referrals in particular are limited to real-estate investors and property owners; RentReel does not refer tenants or owner-occupied primary residences to Steadily or any insurance partner.

8. Changes to this policy

If we materially change how we handle your data, we'll email account holders at least 30 days before the change takes effect. The current version of this policy lives at /privacy.html.

9. Contact

Questions, requests, or complaints: email support@rentreel.co. We aim to respond within 5 business days.

Mailing address: RentReel LLC (a Wyoming limited liability company) · Uhrichsville, OH (full address available on request)