This Privacy Notice explains how Tenantly LLC (West Virginia, USA) ("we", "us", "our"), the operator of Tenantly ("the Service"), collects, uses, and shares personal data. We act as the data controller of the personal data we process about landlords (our customers) and applicants whose documents are submitted to the Service by those landlords.
1. Personal Data We Collect
- Account data — name, email address, hashed password or authentication identifier, and account settings.
- Applicant data submitted by landlords — applicant name, email, uploaded documents (bank statements, pay stubs, ID where provided), and the information extracted from those documents (income, deposits, expenses, NSFs, employer cadence, etc.).
- Background-check data — when an applicant consents to a background check, identity information they submit (name, date of birth, address, SSN) is transmitted to our consumer-reporting partner. We do not retain raw SSN values after submission.
- Usage and device data — IP address, browser, device identifiers, pages viewed, actions taken, and timestamps.
- Support communications — messages you send us.
- Payment data — collected directly by Paddle, our Merchant of Record. We receive only limited transaction metadata (e.g. plan, status, last 4 digits). We never store full card numbers.
2. How We Use Personal Data
- Provide the Service — create accounts, process uploaded documents, generate risk reports, send secure upload links to applicants (contract performance).
- Security and fraud prevention — detect abuse, enforce limits, investigate incidents (legitimate interests).
- Product improvement — aggregated, de-identified analytics to improve accuracy and reliability (legitimate interests).
- Customer support — respond to your messages (legitimate interests / contract performance).
- Legal compliance — comply with tax, accounting, and other legal obligations (legal obligation).
3. Who We Share Data With
- Hosting and infrastructure providers — to store and serve the Service.
- AI model providers — to perform document analysis on your behalf. Documents are sent solely to generate the risk report requested by you.
- TransUnion SmartMove — when an applicant requests and consents to a background check, applicant-submitted identity information is shared with TransUnion SmartMove to produce the report.
- Paddle — our Merchant of Record. Paddle processes payments, handles subscription management, calculates and remits sales tax, and issues invoices. Paddle is an independent data controller for the payment data it collects.
- Professional advisers — legal and accounting advisers, where reasonably necessary.
- Authorities — where we are required to do so by law.
4. International Transfers
Personal data may be processed outside the country in which you reside. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) with our processors.
5. Retention
We retain account and application data for as long as your account is active and for a reasonable period afterwards to comply with legal and accounting obligations. Uploaded applicant documents can be deleted at any time from your dashboard and are deleted when the corresponding application is deleted. We delete or anonymize personal data when it is no longer needed.
6. Your Rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to or withdraw consent for certain processing. To exercise these rights, contact us using the details below. You may also have the right to complain to your local data-protection authority.
7. Security
We use appropriate technical and organizational measures to protect personal data — including encrypted storage, scoped access controls, token-gated applicant upload links, and audit logs. No system is 100% secure, but we work continuously to reduce risk.
8. Cookies
We use a small number of strictly necessary cookies and similar local storage to keep you signed in and to operate the Service. We do not use third-party advertising cookies. You can clear cookies in your browser settings; doing so will sign you out.
9. Children
The Service is not intended for children under 18 and we do not knowingly collect personal data from children.
10. Changes
We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email.
11. Contact
Controller: Tenantly LLC (West Virginia, USA). For privacy questions or to exercise your rights, contact us through the support channels listed in the Service. See also our Terms and Refund Policy.