Privacy Policy

Rentu (“Rentu,” “we,” “us”) is a rent estimation service for US residential property. The service is operated by Sebastian Esteban Ferrero, an individual operating as a persona física under Mexican law, from Mexico. Sebastian Esteban Ferrero is the data controller responsible for your personal data.

For any privacy question or to exercise your rights, contact us at privacy@rentu.xyz or by post at: Huixquilucan, Estado de México, México.

This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have. It applies to rentu.xyz and the Rentu service.

a) Information you give us

• Account details — your email address, and a name or profile information if you sign in with Google or choose to add it.
• Sign-in credentials — Rentu uses passwordless magic-link sign-in and Google sign-in. Where email-and-password sign-in is used, your password is stored, salted and hashed, by our authentication provider (Supabase). We never see or store your plain-text password.
• Brand-logo uploads — if you are on a paid plan and upload a logo for branded PDF exports, we store that image to render it on your reports.
• Property addresses and search queries — the addresses, ZIP codes, bedroom counts, and property details you enter to generate a rent estimate.
• Chat messages — the questions you send in the “ask about this report” panel and the AI's replies.
• Support correspondence — the content of emails you send us and our replies.

b) Information we collect automatically

• Technical data — IP address, browser and device type, operating system, and approximate region, recorded in standard server logs.
• Usage events — which pages and features you use, reports generated, and error diagnostics, used to operate and improve the service.
• Cookieless analytics — aggregate page-view and usage statistics collected without cookies and without tracking you across other websites.

c) Information from third-party data sources

Rent estimates are built from third-party property and market datasets. This data describes markets and properties — it is generally not personal data about you — but you should know where our numbers come from:

• Zillow — the Zillow Observed Rent Index (ZORI).
• HUD — Small Area Fair Market Rents (SAFMR), published by the US Department of Housing and Urban Development.
• US Census Bureau — American Community Survey (ACS) median-rent figures.
• Rentcast — active rental-listing data. We send a ZIP code and bedroom count to Rentcast to retrieve comparable listings; we do not send your identity.

• To provide the service — creating your account, running estimates, saving reports and chats, processing your plan. Legal basis: performance of a contract with you.
• To improve and secure the product — debugging, abuse and fraud prevention, understanding which features work. Legal basis: our legitimate interests in running a reliable, safe service, balanced against your rights.
• For analytics — measuring aggregate usage to guide the roadmap. Legal basis: your consent where required, otherwise our legitimate interest in privacy-preserving, cookieless measurement.
• To meet legal obligations — tax, accounting, and responding to lawful requests. Legal basis: compliance with a legal obligation.

Some of the inputs you provide are processed by our AI subprocessor, Anthropic (the Claude API), to generate analysis. This includes the text you paste or type for listing extraction, the property context used to generate a report, and the messages you send in the report chat. Your chat messages and the AI's replies are transmitted to Anthropic to produce a response.

Anthropic processes this data as our subprocessor under its commercial terms and does not use Rentu's API inputs or outputs to train its models. We store chat messages so you can return to a conversation; see retention below.

We use only strictly-necessary cookies (authentication session and an anonymous usage counter) and cookieless analytics. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list.

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share data only with vendors that help us run the service (“subprocessors”), each bound by a data-processing agreement and permitted to use your data only on our instructions.

Our current subprocessors include Anthropic, Supabase, Vercel, Hugging Face, Polar, Resend, Cloudflare, Mapbox, and Google. See the full list with purpose and region on our Subprocessors page.

Payments. Subscriptions are handled by Polar, which acts as our Merchant of Record. Polar processes your payment details directly. We never receive or store your full card number.

We may also disclose data if required by law, to enforce our terms, or to protect the rights, safety, and property of Rentu, our users, or the public.

Rentu is operated from Mexico, and most of our subprocessors are located in the United States. Your data may therefore be processed in the US and other countries whose data-protection laws may differ from those in your country.

Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses, and the EU-US / UK / Swiss Data Privacy Framework where the receiving provider is certified.

• Account data — kept for the life of your account and deleted within 90 days after you close it (longer only where law requires, e.g. billing records).
• Server logs and analytics — retained for up to 24 months, then deleted or aggregated.
• Chat messages — retained for the lifetime of the associated report and deleted when the report or your account is deleted.
• Report snapshots — kept while the report exists in your account; for shared reports, tied to the share-link lifecycle and removed when you revoke the link or delete the report.

When you delete your account we remove your personal data from our live systems. Transaction records required for tax and legal compliance are retained by our payment processor (Polar, our Merchant of Record) for the period the law requires — we do not control that retention.

Residual copies of deleted data may persist in encrypted backups for up to 90 days before they are overwritten on our providers' standard backup rotation, after which they are no longer recoverable.

Depending on where you live, you may have the right to:

• Access — get a copy of the data we hold about you.
• Deletion — ask us to erase your data.
• Rectification — correct inaccurate or incomplete data.
• Portability — receive your data in a portable, machine-readable format.
• Objection / restriction — object to or limit processing based on our legitimate interests.

You can do much of this yourself: download your data and delete your account from Settings. For anything else, email privacy@rentu.xyz. We will verify your request and respond within 30 days (or 45 days for CPRA requests, where we may extend once with notice). You can complain to your local data-protection authority, but we hope you will contact us first.

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, access, correct, delete, and port your personal information, and to limit certain uses. Residents of other states with comparable laws have similar rights.

In the past 12 months we have collected these categories of personal information: identifiers (e.g. email, IP address), account and profile data, internet/usage activity, and any content you submit (addresses, queries, chat). We collect it for the business purposes described above and share it only with the service providers listed on our Subprocessors page.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

We honour Global Privacy Control (GPC) browser signals as a valid opt-out of sale/sharing. We do not discriminate against you for exercising any privacy right. To exercise these rights, email privacy@rentu.xyz or use Settings.

If you are in the EEA or the UK, you have the rights set out above under the GDPR and UK GDPR, including access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal effects (Rentu does not make such decisions about you). Our legal bases are described under “Why we use your data” above. The data controller is Sebastian Esteban Ferrero; contact privacy@rentu.xyz. You may also lodge a complaint with your national supervisory authority.

If you are in Canada, we handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). We collect, use, and disclose your information only for the purposes described here, with your consent (express or implied) where required, and you may request access to or correction of your information by contacting privacy@rentu.xyz. You may also contact the Office of the Privacy Commissioner of Canada.

For users in Mexico, this Privacy Policy serves as our aviso de privacidad under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). It identifies us as the data controller (responsable), the data we collect, and the purposes of processing.

You may exercise your ARCO rights — Access, Rectification, Cancellation, and Opposition — and withdraw consent at any time by contacting privacy@rentu.xyz. We will respond within the timeframes set by the LFPDPPP.

Rentu is intended for adults making housing and real-estate decisions. The service is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal information from anyone under 13, or under 16 in jurisdictions that set that threshold. If you believe a child has provided us with personal data, contact privacy@rentu.xyz and we will delete it promptly.

We protect your data with encryption in transit (HTTPS), access controls, hashed credentials, and reputable infrastructure providers. No system is perfectly secure, but we work to keep your data safe and to notify you and the relevant authorities of a breach where the law requires.

We may update this policy from time to time. If we make material changes, we will update the effective date below and, where appropriate, notify you by email. This version is effective as of June 16, 2026.

Privacy questions: privacy@rentu.xyz. General support: support@rentu.xyz. Post: Huixquilucan, Estado de México, México.