Privacy Policy

Effective date: 2026-05-04 Last updated: 2026-09-16

---

1. Who we are and what this policy covers

Rentibly, LLC ("Rentibly", "we", "us", "our"), a Delaware limited liability company at 131 Continental Dr, Suite 305, Newark, DE 19713, United States, provides a property-management platform for short-term and vacation-rental operators.

This policy explains how we handle personal data across:

• Rentibly Hub — the operator application (hub.rentibly.app)
• Rentibly Connect — team messaging, calls and meetings
• Guest, owner, operations and support portals
• Hosted direct-booking websites published for our customers
• The Rentibly public API and the Rentibly mobile applications
• Our marketing website at rentibly.com

1.1 Two very different roles — please read this first

Almost every question about our handling of data turns on which of two roles we are in.

We are a CONTROLLER for data about our own customers. When a property manager signs up, we decide how to handle their account details, billing records, support conversations and product usage. That is our decision, so we are the controller, and this policy governs it.

We are a PROCESSOR for the data our customers put into the platform. Guest records, bookings, owner statements, conversations, identity documents, financial records — all of it belongs to the operator who uploaded it. They decide what to collect, why, how long to keep it and who to share it with. We only act on their instructions, under a written Data Processing Addendum.

If you are a guest, a property owner, a vendor, or anyone else whose data an operator holds in Rentibly: we are not the right first contact. The operator you booked with, or whose property you own, is the controller of your data and decides what happens to it. Their privacy notice applies, and your rights are exercised against them. Contact them first. If you cannot reach them, write to privacy@rentibly.com and we will help you identify the right party — but we cannot access, change or delete an operator's records on your instruction alone.

Our marketing website visitors and anyone who contacts us directly are covered by this policy, with us as controller.

---

2. Personal data we collect

2.1 As controller — about our customers and their staff

2.2 As processor — data our customers put into the platform

We process this on the operator's instruction, and it may include: guest identity data (name, email, phone, date of birth, nationality, passport and national-identity document numbers and scans); booking and stay records; payment records and tokens; property-owner and vendor records including bank details; message content across email, WhatsApp, SMS, OTA channels, in-app chat, voice and video; operational records, tasks, incidents and photographs; electronically signed agreements; and the operator's own financial records.

Special-category and identity data. Identity-document scans are stored in a private, access-controlled bucket, encrypted at rest, and are never served publicly. Operators are contractually required to collect such data only where they have a lawful basis — commonly a tourism-authority or regulatory reporting obligation.

2.3 Website and hosted-site visitors

On rentibly.com (our marketing site) we collect standard request data — IP address, user agent, referrer, pages viewed — and any details you submit through a contact or waitlist form.

On hosted booking websites published for our operators, we capture first-party analytics on the operator's behalf: an opaque random session identifier stored in an rb_hsv cookie (30-day lifetime), coarse location (country, region, city) derived from the request, device class and browser, page path, referrer, UTM parameters, and IP address.

IP addresses are masked at the point of capture — the final octet for IPv4, the final 64 bits for IPv6 — and the unmasked address is never written to storage. An operator may switch masking off for their own site, in which case their privacy notice should say so; it is on by default and stays on unless they change it.

Raw hosted-site analytics events are deleted after 90 days; only non-identifying daily aggregates are kept beyond that.

Consent. Where an operator's tenant is in the EU, EEA or UK — or where the operator elects it anywhere — a consent banner is shown and analytics are not recorded unless consent is given. Operators can disable analytics entirely for their sites.

No cookie is set before consent is given, and no analytics event is recorded before consent is given. Both apply to every capture path, including contact-form submissions. Where consent is refused, the session cookie is removed.

2.4 What we do not collect

• Card numbers, CVV or full expiry dates. Card entry happens entirely inside our payment provider's hosted fields. We store only provider tokens and non-sensitive metadata. A search of our entire database schema returns no column capable of holding a card number.
• Virtual card numbers from booking channels. We deliberately do not retrieve them, even where a channel offers them.
• Data about children. The Service is a business tool. We do not knowingly collect data from anyone under 18, and operators must not use it to do so.

---

3. Why we process it, and on what legal basis

As controller:

Where we rely on legitimate interests we have carried out a balancing assessment and concluded our interest is not overridden by your rights. You may object at any time (§7).

Where we act as processor, the operator determines the purpose and the legal basis. We are not in a position to tell you what it is.

---

4. Who we share it with

We do not sell personal data. We do not share it for cross-context behavioural advertising. We have not sold or shared personal data in the preceding twelve months, within the meaning of the CCPA/CPRA.

We share personal data only with:

Sub-processors — service providers who process on our behalf under written contract, bound to act only on our instructions, to maintain confidentiality, and to apply appropriate security. The complete, current list is published at rentibly.com/legal/sub-processors and includes, by category:

Error reporting. When something goes wrong in the platform, a diagnostic report is sent to our error-tracking provider (Sentry). It contains a user identifier, a tenant identifier, the account's role, the address of the page or request that failed, and the technical stack trace. It does not contain your email address, your IP address, cookies, or the contents of your request, and database queries are stripped of their content before the report is sent. These reports are processed in the European Union (Frankfurt) and are not transferred outside it.

Third-party services you connect. When an operator connects a channel, portal, payment provider, calendar, smart lock or messaging provider, data flows to that provider under their privacy policy and at the operator's direction. We are not responsible for their processing. Current integrations include Airbnb, Booking.com, Vrbo, Expedia, NextPax, Bayut, Property Finder, Dubizzle, PriceLabs, Google, Microsoft, Stripe, Seam and TTLock.

Professional advisers — lawyers, auditors and accountants, under confidentiality.

Authorities — where required by valid legal process. We will notify the affected customer unless legally prohibited, and we will challenge requests we consider overbroad or unlawful.

A successor — in a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply and to advance notice where required.

---

5. Where your data is processed

All customer data is stored in the European Union, in Amazon Web Services' eu-central-1 region (Frankfurt, Germany). This is our only production data region. We do not currently offer alternative regions; if that changes we will update this policy and notify affected customers in advance.

AI processing. When an AI feature runs (for example the AI assistant or a drafted guest reply), the request is sent to Claude models on Amazon Bedrock using AWS cross-region inference, which may process it in any AWS commercial region, including outside the EU. Bedrock does not store the request or the response and does not use them for training; the stored record stays in Frankfurt.

Some sub-processors are established outside the EEA and the UK, principally in the United States and India. Where personal data is transferred to them, we rely on:

• the European Commission's Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum, supplemented by transfer-impact assessments where appropriate; or
• an adequacy decision where one covers the recipient; or
• the EU-US Data Privacy Framework where the recipient is certified.

A copy of the relevant transfer mechanism is available on request from privacy@rentibly.com.

---

6. How long we keep it

Customer Data is retained for as long as the operator chooses. This is the part people most often expect us to decide, and we deliberately do not. Retention of guest records, identity documents and financial records is a legal judgement about the operator's business — their regulator, their tourism authority, their insurer — and a platform that quietly enforced its own opinion would be destroying evidence someone was relying on.

We therefore never delete an operator's data on a schedule of our own. Not for storage cost, not for tidiness, not in the name of compliance. Every code path in our platform capable of destroying stored data is registered against the specific operator action or data-subject request that authorises it, and our build fails if an unregistered one is added. There is no "retention" trigger in that registry to reach for.

The one automatic expiry, stated so the rule above reads as exactly true: where an object has already been deleted or replaced by an operator, the superseded version is purged from versioned storage after 30 days.

---

7. Your rights

Depending on where you are, you may have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to processing, including a general right to object where we rely on legitimate interests, and an unconditional right to object to direct marketing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out; and
• complain to a supervisory authority.

Californian residents additionally have the rights to know, delete, correct, opt out of sale or sharing (we do neither), limit the use of sensitive personal information, and not to be discriminated against for exercising any of them.

UAE residents have equivalent rights under Federal Decree-Law No. 45 of 2021 (PDPL).

7.1 How to exercise them

If we are the controller — you are a customer, a member of a customer's team, or a website visitor — write to privacy@rentibly.com. We will respond within one month (extendable by two further months for complex requests, with notice). We may need to verify your identity first.

If we are the processor — you are a guest, owner or vendor whose data an operator holds — contact the operator. We will forward a request we receive directly to the relevant operator and will assist them in responding, but we act on their instruction. See §1.1.

7.2 What we have built to make this real

We mention this because a right you cannot actually exercise is not a right.

• Access and portability are automated. An operator can produce a complete, labelled bundle for any contact in their system — a machine-readable data.json, plain-English CSVs, and the underlying documents and attachments — from a declared registry of exactly which tables and columns are in scope. Anything withheld is listed as withheld, with the reason.
• Erasure is automated, and it is thorough. An erasure request anonymises the individual across all 41 relationships that reference a contact record, each with a declared disposition and legal basis. Transactional records that carry a statutory retention obligation survive, attached to a contact who is no longer anybody — which is what Recital 26 GDPR contemplates.
• Profiling is disclosed. Where we hold assessments about a person — sentiment scores, lead status, VIP flags — those appear in the access bundle. They are exactly the fields a person is entitled to see.
• Every export and erasure is logged with the actor, the time and the scope, so an operator can demonstrate accountability under Art. 5(2).

7.3 Complaints

If you are in the EEA, the UK or Switzerland you may complain to your local supervisory authority. [If we appoint an Art. 27 representative, insert their name and address here — a Delaware entity offering services to EU data subjects will generally need one.] In the UK, the Information Commissioner's Office (ico.org.uk). In the UAE, the UAE Data Office.

We would rather hear from you first: privacy@rentibly.com.

---

8. Security

We maintain technical and organisational measures appropriate to the risk. In concrete terms:

• Encryption in transit (TLS 1.2 minimum, enforced at the edge) and at rest (AES-256). Payment-provider credentials and MFA secrets are additionally encrypted at the application layer with AES-256-GCM.
• Mandatory multi-factor authentication for every user of the operator application. Not optional, not a setting — enforced before any resource is reachable.
• Tenant isolation at two layers: every query is automatically scoped to the requesting tenant in the application, and PostgreSQL row-level security policies enforce the same boundary in the database under a non-superuser role.
• Least privilege: granular role-based permissions, an audit log of user-initiated actions, and support access that is read-only, time-limited, revocable and logged.
• Brute-force protection on authentication, per account and per network.
• Continuous scanning: every code change is gated on secret detection, static analysis, dependency vulnerability scanning and infrastructure misconfiguration scanning, with a daily re-scan for newly disclosed vulnerabilities.
• Monitoring and alerting across the infrastructure, with automated rollback of failed deployments.
• Payment data is out of scope by design. No card data reaches our servers.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please write to security@rentibly.com. We will acknowledge within two business days, will not pursue legal action against good-faith research conducted without harming data or availability, and will credit you if you would like.

8.1 If something goes wrong

We will notify affected customers of a personal-data breach without undue delay and within 72 hours of becoming aware, with the information available at that time, so that they can meet their own notification obligations as controllers. Where we are the controller and a breach is likely to result in a high risk to your rights, we will notify you directly.

---

9. Cookies and similar technologies

On our marketing site and the operator application, we use:

On hosted booking websites, the rb_hsv first-party analytics cookie (opaque random identifier, 30 days) and the rb_consent cookie recording a visitor's choice. See §2.3 — including the two pending items there.

We do not use third-party advertising or cross-site tracking cookies, and we do not participate in advertising networks.

Most browsers let you block or delete cookies. Blocking strictly necessary cookies will break sign-in.

A fuller cookie table is published at rentibly.com/legal/cookies.

---

10. Google user data — Calendar Connect

This section is required by the Google API Services User Data Policy and is reproduced in full.

If you connect your Google account via Settings → Calendar Connect, Rentibly requests access to your Google Calendar events (the calendar.events scope) and your basic profile (email address and name). Rentibly uses this access solely to:

• create, update and cancel calendar events for meetings you schedule in Rentibly, so invitations are sent from your own email address;
• display your Google Calendar events alongside your Rentibly meetings in the Rentibly Connect calendar, including an event's details (title, time, location, description and guest responses) when you open it;
• check your availability when you schedule a meeting, to warn you about conflicts; and
• let you manage your own Google events from within Rentibly — create, edit, move, resize and delete — with Google notifying your guests exactly as if you had made the change in Google Calendar.

Rentibly does not store your Google Calendar event content on its servers — events are fetched from Google when you view your calendar and discarded after display. The only Google-derived data Rentibly stores is: your OAuth tokens, encrypted at rest (AES-256-GCM); the email address of the connected account; the RSVP responses of guests on events Rentibly itself created, to show meeting attendance inside Rentibly; and opaque Google event identifiers when you apply a personal colour tag to an event.

Rentibly does not share Google user data with third parties and does not use it for advertising. Google user data is never transmitted to any AI or machine-learning service (first- or third-party) and is never used to create, train or improve any AI or machine-learning model.

You can revoke access at any time from your Rentibly settings (Disconnect) or at myaccount.google.com/permissions; on disconnect, stored tokens are deleted.

Rentibly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

---

11. Artificial intelligence

Some features use AI models supplied by our sub-processors (§4) to draft suggestions, summarise, transcribe, classify and extract.

• We do not use your data to train models. Not ours, not our providers'. Our AI sub-processors are contractually bound not to train on data submitted through the Service.
• We reduce what is sent. Guest message content is passed through a redaction layer that removes card-like numbers and identity-document patterns before it reaches a model, and the number of redactions is recorded for audit.
• AI output is advisory. We do not make decisions producing legal or similarly significant effects about an individual by automated means alone. Scores and suggestions are shown to a person who decides.
• You can see what happened. AI usage is recorded per tenant and is visible to the operator.

---

12. Changes to this policy

We may update this policy. For material changes we will give at least 30 days' notice by email or in-product before the change takes effect, and we will update the "Last updated" date. Previous versions are available on request.

---

13. Contact

Rentibly, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

---

Effective 2026-05-04.