Privacy Policy

1. What we collect

RentReel collects only the data you give us, in service of the product:

• Account info: your email address and a password hash (we never store your password in plaintext)
• Your financial data: the transactions, property setup, and settings you enter or import via CSV
• Browser metadata: standard request data (IP, user agent, timestamp) for security logging via our hosting provider (Cloudflare) and database provider (Supabase)

We do not collect: your bank credentials, your CSVs as files (only the parsed transaction rows), behavioral analytics, advertising identifiers, or third-party cookies.

2. Where your data lives

Your transaction and account data is stored in Supabase (Postgres) hosted on AWS US-East. Your account is protected by Row-Level Security (RLS) at the database level — other RentReel users cannot read or modify your data, regardless of any client-side bug.

Your CSVs are parsed in your browser. Only the resulting transaction records leave your device — the original CSV file never does.

3. How we use your data

• To make the product work (display your books, sync across your devices)
• To send transactional email (password resets, account confirmations)
• To investigate security incidents and respond to subpoenas if legally required

We do not use your data for: advertising, training AI models, sharing with affiliates, or selling to third parties — ever.

4. Third parties (sub-processors)

We use the following service providers, each of which receives only the data necessary to fulfill its role:

• Supabase Inc. (database + auth) — stores your encrypted account and data. AWS US-East. SOC 2 Type 2 certified.
• Cloudflare, Inc. (hosting, CDN, Workers, edge compute) — serves the app, logs request metadata (IP, user-agent, timing). SOC 2 Type 2 certified.
• Stripe Inc. (billing, Pro-tier users only) — processes payment, stores card data on PCI-compliant infrastructure. We never see full card numbers.
• Anthropic PBC (Pro+ Tax users only, on-demand) — when you upload a mortgage/insurance/tax document and use the auto-extract feature, the document contents are sent to Anthropic's Claude API for structured data extraction. Per Anthropic's commercial terms, submitted data is not used to train models and is retained only long enough to process the request. Documents are NOT sent to Anthropic for any purpose other than the specific extraction you initiated.

We do not transmit your transaction data (bank exports, PMS reservations, cleaning logs, mileage) to any third party for any purpose other than storage / serving. AI-assisted document extraction is limited to the specific document you upload for extraction — never your full dataset.

5. Your rights

• Access: view all your data inside the app at any time
• Portability: Settings → Export JSON Backup gives you your entire data in a portable file
• Deletion: Settings → Account → Wipe My Data deletes all your data. Account → Delete Account is a full GDPR/CCPA hard-delete: it removes your workspace, personal workspace, and authentication record from our database in a single atomic transaction, with no manual intervention required
• Correction: edit any transaction, category, or setting directly in the app
• Objection / restriction: contact us to restrict processing in specific ways

6. Children

RentReel is a business product for adults. We do not knowingly collect data from anyone under 18.

7. Changes to this policy

If we materially change how we handle your data, we'll email account holders at least 30 days before the change takes effect. The current version of this policy lives at /privacy.html.

8. Contact

Questions, requests, or complaints: email [email protected]. We aim to respond within 5 business days.

Mailing address: Joy Family Holdings LLC (a Wyoming limited liability company) · Uhrichsville, OH (full address available on request)