Privacy Policy

Last updated: May 26, 2026

AllByRent stores the minimum data necessary to operate. Sensitive data — identity documents, payment cards, bank accounts — is handled exclusively by Stripe and Stripe Identity. We never see or store it.

1. Who We Are

AllByRent ("we," "us," "our") operates the AllByRent platform — a peer-to-peer rental network accessible at allbyrent.com and as a Progressive Web App. For privacy inquiries, contact us at privacy@allbyrent.com.

2. What Data We Collect

We collect only what is necessary to provide our services:

Data Type	Stored By	What AllByRent Stores
Password	Supabase Auth (hashed)	Never
Identity documents / selfie	Stripe Identity	Verification status only
Credit / debit card	Stripe	stripe_customer_id only
Bank account	Stripe Connect	stripe_connect_account_id only
Phone number	Supabase Auth	Verified status only
Email address	Supabase Auth	For notifications
Profile photo	Supabase Storage	Yes — user-uploaded
Item photos	Supabase Storage	Yes — listing photos
Transaction history	AllByRent DB	Yes — anonymized records
QR scan logs	AllByRent DB	Yes — timestamps only
Chat messages	Supabase Realtime	Yes — encrypted
Device language	AllByRent DB	Yes — for localization

3. How We Use Your Data

To operate the platform and process transactions
To verify identity and prevent fraud
To send transaction notifications and reminders
To resolve disputes and support insurance claims
To improve the platform and personalize your experience
To comply with legal obligations

4. Third-Party Services

AllByRent integrates with the following third-party services, each with their own privacy policies:

Supabase — authentication, database, file storage, real-time messaging. Privacy Policy
Stripe — payment processing, identity verification, payouts. Privacy Policy
Safely API — rental insurance. Subject to Safely's terms and policies.
Anthropic (Claude API) — AI companion (Mr. Rentano). Conversation context is sent per request and not stored by AllByRent. Privacy Policy
PhotoRoom API — background removal for listing photos. Images processed transiently.
Nominatim (OpenStreetMap) — city search and geocoding. No personal data transmitted.

5. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

With the other party in a transaction (name, verified status, contact info after booking confirmation)
With Safely API to process insurance claims (transaction records, QR timestamps, photos)
With Stripe for payment processing and identity verification
With law enforcement when required by law or valid legal process
In the event of a merger, acquisition, or sale of assets

6. Data Retention

We retain your data for as long as your account is active. When you delete your account:

All listings, photos, and personal data are deleted within 30 days
Transaction history may be retained in anonymized form for legal and financial compliance
Active rentals must be completed or cancelled before deletion is allowed
Stripe Connect account is disconnected and pending payouts are processed first

7. Your Rights (GDPR / CCPA)

Depending on your location, you may have the following rights:

Access — request a copy of your personal data
Correction — update inaccurate information
Deletion — request deletion of your account and data (completed within 30 days)
Portability — receive your data in a structured, machine-readable format
Objection — object to certain processing activities
Opt-out of sale — we do not sell data, so this right is automatically satisfied

To exercise any of these rights, contact us at privacy@allbyrent.com. We will respond within 30 days.

8. Cookies and Tracking

AllByRent uses minimal cookies necessary for authentication (JWT session tokens stored securely on your device). We do not use advertising cookies, third-party tracking pixels, or behavioral analytics. We do not display ads.

9. Children's Privacy

AllByRent is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will delete it promptly.

10. Security

We implement industry-standard security measures including HTTPS encryption, hashed passwords via Supabase Auth, JWT session management, and role-based access controls. Sensitive data is never stored on AllByRent servers — it lives with Stripe and Supabase. Despite these measures, no system is 100% secure. We encourage you to use a strong, unique password and to sign out of shared devices.

11. International Transfers

AllByRent operates primarily in the United States. If you access the Platform from outside the US, your data may be transferred to and processed in the United States. By using AllByRent, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The date at the top of this page reflects the most recent update.

13. Contact

Privacy questions or requests: privacy@allbyrent.com

General inquiries: hello@allbyrent.com