Privacy policy

RentenAI is operated by RentenAI, registered in Estonia under company number **********, with its registered office at tallinn, estonia. In this notice, "we" and "us" mean that company, and "the platform" means the RentenAI software and the assistant that runs on it.

For any question about this notice, or about how data is handled, write to info@rentenai.com.

The platform is sold to property managers and landlords. It is used to communicate with their tenants, property owners and contractors, who never sign up for anything. Data protection law therefore treats us as playing two different roles depending on whose data it is, and your rights differ accordingly.

• Where you are a customer — the property manager or landlord who holds the account — we are the controller of your data. We decide what to collect in order to run the service and bill you for it. This notice is our notice to you.
• Where you are a tenant, property owner or contractor, the customer who manages your property is the controller. They chose to use the platform, they decide what is recorded about you, and they are responsible for telling you so. We are their processor: we handle your data on their instructions and for no purpose of our own.

If you are a tenant and you want your data corrected or deleted, the fastest route is to ask your property manager, because it is their instruction we act on. You can also write to us and we will pass the request to them and help them act on it.

• Account and identity: business name, country, the phone number you sign in with, and your name and email address where you give one. Sign-in is passwordless — a one-time code is sent by SMS, and no password is ever stored.
• Configuration: your property and room records, house rules, utility rates, contract templates, the assistant's name and tone, and the approval settings that decide what it may do without asking you.
• Usage and billing: the number of occupied rooms in the portfolio each month, which determines the price tier, and the record of what should have been charged for each period.
• Operational records: an audit trail of actions taken in the account, plus technical logs and error reports needed to keep the service running.

This data is recorded by our customer, not by us, and we process it on their instructions. Depending on what the customer enters and what is sent to the assistant, it can include:

• Identity and contact details: name, phone numbers, email address, Telegram username and account identifier, country, and preferred language.
• Identifiers that some lease templates require: a tax identification number, and a passport or national identity document number.
• Tenancy records: the room or apartment, rent, deposit, start and end dates, recorded absences, declared guests, and the generated lease document.
• Messages: the content of conversations with the assistant over WhatsApp, Telegram and email, including group conversations in an apartment chat.
• Attachments: photographs and files sent to the assistant, which in ordinary use include meter readings, payment receipts, and pictures of maintenance problems.
• Voice notes: the audio, and the text transcription made from it.
• Financial records: bills issued, amounts, payment dates, and the payment history derived from them.

This is the processing least visible from the outside, so we state it plainly.

Messages sent to the assistant are transmitted to third-party AI providers to be interpreted and answered. That includes the message text, the names of the people in the conversation, recent conversation history, and the property information needed to answer. Photographs and documents are transmitted to the same providers where they are relevant to the request — a meter photograph, or a receipt the assistant has been asked to read. Voice notes are transmitted to a speech-to-text provider and converted to text.

This content is not used to train AI models. Our agreements with these providers prohibit it.

The assistant identifies itself as an automated assistant the first time it speaks in a conversation. It drafts and proposes actions; which of those it may carry out on its own, and which require the customer's explicit approval, is a setting the customer controls.

The assistant can be wrong. It is a drafting and coordination tool, not a source of legal, financial or tax advice, and nothing it produces should be relied on without being checked.

• Performance of a contract: to provide the platform to our customers and to bill them for it.
• Legitimate interests: to keep the service secure and working, to prevent abuse, and to understand and improve how it is used. We weigh this against your interests and stop where yours outweigh ours.
• Legal obligation: to keep accounting records, and to answer lawful requests.

Where we act as a processor for tenant, owner or contractor data, the legal basis is the controller's to establish. In most cases it will be performance of the tenancy agreement, or the controller's legitimate interest in managing the property.

We use the following providers to run the platform. Each is bound by a contract limiting it to processing data on our instructions.

• Anthropic — interpreting messages and generating the assistant's replies.
• OpenAI — converting voice notes to text, and generating the numerical representations used to search past conversations.
• Neon — the primary database.
• Supabase — authentication for customer sign-in.
• Cloudflare R2 — storage of attachments, generated documents and message payloads.
• Upstash — the queues and short-lived buffers that move messages through the system.
• Resend — sending and receiving email.
• 360dialog and Meta Platforms — delivery of WhatsApp messages.
• Telegram — delivery of Telegram messages.
• Mapbox — turning an address into map coordinates, used to pick a nearby contractor.
• Google — calendar synchronisation, only where a customer connects their own Google account.
• Sentry — error monitoring. Message content, phone numbers, email addresses, tax numbers and bank details are stripped before a report is sent.
• Vercel and Railway — hosting of the application and its background workers.

The primary database is hosted in the European Union. Several providers above operate outside the European Economic Area, the AI providers in particular, which means some data is transferred there.

• Message content is permanently deleted 180 days after it is sent or received, along with the search index built from it. This runs automatically on every account.
• Property, tenancy, billing and contact records are kept while the account is open, because the service cannot function without them.
• When an account is closed, its records are marked deleted and stop being used or displayed. Sign-in is revoked and the messaging channel is disconnected immediately, so the assistant stops sending and receiving.
• The audit trail of actions taken in an account is never altered or removed, including the record of the closure itself. It exists so it is always possible to establish what was done and when.

Under the General Data Protection Regulation you may ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, ask for it in a portable form, and object to processing carried out on the basis of legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what was done beforehand.

To exercise any of these, write to info@rentenai.com. If you are a tenant, owner or contractor, see the second section above: we will act on your request, but for most of it we need the instruction of the property manager who holds the account, and we will contact them.

You may also complain to a data protection supervisory authority.

Access requires a one-time code sent to a registered phone number. Every record is bound to a single account, and queries are restricted to it. Messaging credentials are encrypted before storage. Traffic is encrypted in transit.

No system is perfectly secure. If a breach occurs that is likely to risk people's rights and freedoms, we will notify the supervisory authority within 72 hours and tell those affected without undue delay.

The platform is not intended for children, and accounts may only be held by adults acting in the course of a business. We do not knowingly process the data of anyone under 16. If you believe we have, write to us and we will delete it.

We will update this page when the way data is handled changes, and change the date at the top. Where a change materially affects our customers we will tell them directly rather than rely on this page alone.