Rentals Inc.

Privacy Policy

Last updated: May 15, 2026

1. Introduction

At Rentals Inc., we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. Please read this policy carefully.

2. Information We Collect

We collect information that you provide directly to us, including:

  • Account Information: Name, email address, phone number, and password
  • Profile Information: Profile photo, bio, and preferences
  • Property Information: Details about properties you list or search for
  • Payment Information: Billing address and payment method details
  • Communications: Messages, reviews, and support inquiries
  • Third-Party Platform Data: When you connect accounts such as Instagram or Gmail, we receive data from those platforms. See Section 5 — Instagram and Meta Platform Data and Section 6 — Gmail and Google API Data for full details.

3. Automatically Collected Information

When you use our platform, we automatically collect certain information:

  • Device Information: IP address, browser type, and operating system
  • Usage Data: Pages viewed, time spent, and click patterns
  • Location Data: Approximate geographic location
  • Cookies: Small data files stored on your device

4. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process transactions and send related information
  • Send you technical notices and support messages
  • Respond to your comments and questions
  • Personalize your experience on our platform
  • Monitor and analyze trends and usage patterns
  • Detect, prevent, and address fraud and security issues
  • Comply with legal obligations

5. Instagram and Meta Platform Data

Our platform integrates with Instagram and Meta (Facebook) to help property managers receive and manage rental inquiries through social media. This section describes how we handle data received from Meta's APIs in accordance with Meta's Platform Terms and Developer Policies.

5a. Data We Receive from Instagram and Meta

When you connect your Instagram Business Account, we receive and store the following data from Meta:

  • Instagram Business Account profile information (username, display name, profile picture, follower and post counts)
  • Facebook Page information linked to your Instagram account
  • Instagram comments posted on your business posts
  • Instagram Direct Messages sent to your business account
  • OAuth access tokens required for API access (stored in encrypted form)

5b. How We Use Instagram and Meta Data

We use data received from Instagram and Meta for the following purposes:

  • To display your Instagram connection status and account details within our dashboard
  • To receive and process incoming Direct Messages and comments as potential rental leads
  • To extract structured lead information (such as budget, number of bedrooms, and preferred move-in date) from messages
  • To send replies to Instagram Direct Messages on your behalf
  • To publish content to your Instagram account when you request it

5c. How Instagram and Meta Data Is Stored and Secured

  • Access tokens are encrypted at rest using AES-256-GCM encryption
  • All data is transmitted over HTTPS (TLS)
  • Webhook payloads from Meta are verified using HMAC-SHA256 cryptographic signatures
  • Access to Instagram data is restricted to authenticated, authorized users within your organization

5d. Data Retention and Deletion

  • When you disconnect your Instagram account, access tokens are revoked and deleted immediately
  • Raw webhook log data (containing original Meta payloads) is deleted immediately upon disconnect
  • For active connections, raw webhook log data is automatically purged after 90 days
  • Raw platform payloads attached to leads are automatically removed after 90 days; your lead records and extracted insights are not affected
  • Instagram lead data (usernames, message text, comments) is retained for 30 days after disconnect to allow you to act on existing leads, then automatically anonymized — personally identifiable fields are removed, but de-identified business insights (such as budget and bedroom preferences) are retained
  • If Meta sends a data deletion request on your behalf (for example, when you remove the app from your Facebook settings), all associated data is deleted immediately
  • You may also request deletion at any time by emailing privacy@rentalsinc.com

5e. How to Request Deletion of Your Instagram Data

You can request deletion of your Instagram and Meta data through any of the following methods:

  1. Disconnect in the app: Go to Dashboard > Integrations > Instagram and click “Disconnect.” Your tokens are revoked immediately and lead data is anonymized within 30 days.
  2. Remove via Facebook: Go to your Facebook Settings > Apps and Websites, find Rentals Inc., and click “Remove.” This triggers automatic deletion of all your Instagram data from our systems.
  3. Email us: Send a deletion request to privacy@rentalsinc.com with the subject line “Instagram Data Deletion Request.”

All deletion requests are processed within 30 days. You will receive confirmation once your data has been removed or anonymized.

6. Gmail and Google API Data

When you connect a Google Account for our Gmail integration, we access Gmail through Google's OAuth 2.0 and Gmail API to help you capture and manage rental-related email leads inside our platform. This section describes what we access, why, how we protect it, and how you can revoke access or request deletion.

6a. Data We Receive from Gmail and Google

With your authorization, we may receive and process:

  • Google account identifiers and profile basics from Google's userinfo endpoints (such as Google user ID and the email address of the connected account)
  • OAuth access tokens and refresh tokens required to call the Gmail API (stored encrypted at rest)
  • Mailbox signals from Google Cloud Pub/Sub notifications (such as identifiers used to synchronize new mail)
  • For messages you choose to surface as leads or that our product processes under your configured workflow: metadata and content typically including sender and recipient addresses, subject lines, message bodies, timestamps, thread and message identifiers, labels (including read/unread state), and attachment metadata or content when displayed or fetched through the product

6b. How We Use Gmail and Google Data

We use this information only to provide and improve connected Gmail functionality for your team, including:

  • Receiving inbound email into our lead workflow (for example, rental inquiries in your inbox)
  • Showing email threads and composing or sending replies you initiate through the dashboard
  • Syncing read state (such as the UNREAD label when you opt into matching product actions)
  • Operating webhook and background jobs needed to refresh tokens or renew Gmail push subscriptions to your configured Google Cloud resources

6c. Limited Use — Google API Services User Data Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Gmail user data only to provide or improve security features related to Gmail connection and lead management flows you enable
  • We do not use Gmail content or credentials for personalized advertising outside the functionality you request
  • We do not sell Gmail user data, and human access is limited to permitted purposes (such as servicing your account when you authorize support, complying with legal obligations, or protecting security)

6d. How Gmail Data Is Stored and Secured

  • Gmail OAuth tokens are encrypted at rest using AES-256-GCM encryption
  • Traffic between your browser and our servers, and between our servers and Google APIs, uses HTTPS (TLS)
  • Lead and message-derived data visible in the dashboard is restricted to authenticated, authorized users in your organization as configured in the product

6e. Data Retention and Deletion Overview

  • When you disconnect Gmail in our app (see Section 6f), we revoke API access tokens where technically possible and remove stored Gmail OAuth credentials from our active integration record
  • We delete Gmail-associated webhook/log entries stored under your user as part of the disconnect flow so current notification payloads are not retained alongside the integration
  • Records you created in the product (such as leads, replies you sent via the dashboard, or internal notes) may persist for continuity of your CRM unless you delete them or request deletion. You may submit a Gmail-related deletion request following Section 6f

6f. How to Disconnect Gmail or Request Gmail Data Deletion

You control the Gmail integration and can revoke our access using any of these methods:

  1. Disconnect in the app: Go to Dashboard > Integrations > Gmail and use “Disconnect.” We attempt to revoke the active access token with Google, unregister the Gmail push subscription, remove stored Gmail OAuth credentials from our active connection record (access and refresh tokens), mark the integration inactive, and delete Gmail webhook log rows associated with your user.
  2. Revoke in your Google Account: Go to Google Account > Security > Third-party apps with account access, locate Rentals Inc. (or the app name shown on consent), and remove access. Revocation may not immediately purge historical product rows; email privacy@rentalsinc.com if you want prior lead content removed.
  3. Email us: Send a request to privacy@rentalsinc.com with subject line “Gmail Data Deletion Request” and the email address of the Gmail account you connected. We verify your identity and fulfill within a reasonable timeframe in line with our internal policies (typically within 30 days).

If you disconnect and later reconnect, Google may prompt you again to approve the requested scopes on the OAuth consent screen.

7. Information Sharing and Disclosure

We may share your information in the following circumstances:

  • With Your Consent: When you explicitly agree to share information
  • Service Providers: Third-party vendors who perform services on our behalf
  • Property Owners/Tenants: Information necessary for rental transactions
  • Meta/Instagram: When you use our Instagram integration, data flows between our platform and Meta's APIs to provide the connected features described in Section 5. We do not sell or share your Instagram data with any other third parties.
  • Google/Gmail: When you use our Gmail integration, data flows between our platform and Google's Gmail API (and optionally your Google Cloud Pub/Sub endpoint for push notifications configured for your tenancy) strictly to provide features described in Section 6. We do not sell Gmail user data to third parties.
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with mergers or acquisitions

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit and at rest
  • Regular security assessments and audits
  • Access controls and authentication requirements
  • Employee training on data protection

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

You have the following rights regarding your personal information:

  • Access: Request access to your personal data
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your personal data. For Instagram and Meta data specifically, please see Section 5e for detailed instructions. For Gmail, see Section 6f.
  • Objection: Object to processing of your information
  • Portability: Request a copy of your data in a portable format
  • Withdraw Consent: Withdraw consent for data processing

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. You can control cookies through your browser settings, but disabling them may affect functionality.

11. Children's Privacy

Our services are not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your country. By using our services, you consent to the transfer of your information to countries that may have different data protection laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last updated" date.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Rentals Inc. - Privacy Team

Email: privacy@rentalsinc.com

Support: support@rentalsinc.com

Data Protection Officer: dpo@rentalsinc.com

Back to Home