Privacy Policy — RentSynk
This policy explains what personal data the RentSynk mobile app (iOS and Android) and the website at web.rentsynk.com (together, the "Service") collect, why, who sees it, how long we keep it, and your rights. One policy applies on the Apple App Store, Google Play and the web.
Who is responsible for your data: Mohammed Wasif Ul Haq, an individual based in Hyderabad, Telangana, India ("we", "us"). That makes us the "data controller" under the GDPR and the "data fiduciary" under India's Digital Personal Data Protection Act, 2023.
Contact and Grievance Officer: Mohammed Wasif Ul Haq, [email protected]
Contact and Grievance Officer: Mohammed Wasif Ul Haq, [email protected]
1. Information We Collect
1.1 Information you give us
| Data | Why | Required? |
|---|---|---|
| Phone number | Your account identity: sign-in by one-time code. It is also shown to people you deal with: your landlord or tenant, people who find you in the service directory, and people who tap Contact on your listing. | Yes |
| Name | Your profile, receipts and agreements. If you tap Contact on a listing, the poster sees your name, but not your number. | Yes |
| Rental and tenancy details | Properties, units, addresses, rent, deposits and lease dates, entered to manage tenancies. | For those features |
| Payment records and proofs | Amounts, dates, method, optional bank reference (UTR) numbers, and the screenshot or PDF you upload as proof. We never collect card numbers or bank log-ins, and we never move money. | For those features |
| Rental agreements | Agreement text and imported pages created, imported or signed through the app. | For those features |
| Service-provider profile | Your skills, service radius, an optional "about me", and your availability. | For that role |
| Property listings | Address, map pin, photos, price, description and property details. Listings are public to everyone signed in. | Optional |
| Reports | When you report someone: what you report (a provider, a listing or a phone number), the reason, your description, and an optional photo or PDF as evidence. Your phone number is stored with the report so we can contact you about it. It is never shown to the person you reported. | Optional |
| Blocks | Who you have blocked, so neither of you sees the other. | Optional |
| Terms acceptance | Which version of the Terms you accepted, and when. | Yes |
1.2 Location data
- When we collect it:
- when an owner pins a property or a poster pins a listing (a listing's pin is public);
- when you search near your current location;
- continuously, including in the background, for service providers who have switched Available on.
- Prominent disclosure: RentSynk collects location data to match service providers with people nearby, even when the app is closed or not in use. It does so only while you hold the Service role AND are switched to Available. Switching Available off, or signing out, stops collection.
- We store only the provider's latest position. Searchers never see it: they see only a distance, rounded to a whole kilometre from a position blurred to about 1 km.
- Location is always requested through your device's permission prompt, and you can revoke it in your device settings at any time.
1.3 Information collected automatically
- Device and push identifiers: a push notification token (Firebase Cloud Messaging) and a per-device session identifier. One phone can be signed in at a time.
- Web sign-in codes: when you sign in on the web, a 6-digit code is pushed to your phone. It is stored only as a one-way hash and stays valid for 5 minutes.
- App integrity signals: Firebase App Check (Play Integrity, App Attest/DeviceCheck, reCAPTCHA on the web), which confirms requests come from a genuine copy of the app.
- Advertising data: the free tier shows ads through Google AdMob. AdMob may collect device identifiers (Android Advertising ID, or Apple IDFA where you allow it), coarse location and interaction data to serve and measure ads. On iOS, personalised tracking happens only if you allow it in Apple's App Tracking Transparency prompt. See Google's advertising policy.
- Purchase data: Apple or Google processes any purchase. We and RevenueCat receive receipts and transaction identifiers, never card details.
- Activity dates: when you joined and when you last used the app (recorded at most hourly). These count active users.
- Server logs: timestamps, errors and IP addresses, used to keep the Service secure. They are kept on a rolling 180-day basis, as Indian cyber-security rules require.
1.4 Permissions we may request
| Permission | Why |
|---|---|
| Location (foreground; background only for Available providers) | Pinning a property or listing, searching nearby, matching providers |
| Photos / Files / Camera | Payment proofs, listing photos, agreement pages, report evidence |
| Notifications | Rent reminders, payments, invitations, report outcomes, moderation decisions |
| Phone (dialer) | Tap-to-call a provider or poster. This opens your dialer; we collect no call data |
We never read your contacts, SMS inbox, call logs or browsing history.
2. Why We Use It, and Our Legal Bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Running your account and the features you use: tenancies, ledgers, receipts, agreements, the directory, listings | Contract: we need it to provide the Service |
| Notifications about your tenancies, payments, invitations and reports | Contract; consent for push notifications on your device |
| Background location for Available providers | Consent, which you can withdraw by switching Available off |
| Safety and moderation: handling reports, blocks and restrictions, keeping a banned number out, and preventing fraud and abuse | Legitimate interests: keeping users safe and the Service trustworthy; legal obligation where the law requires it |
| Keeping moderation records, retaining data after account deletion, and answering lawful orders | Legal obligation, and the establishment or defence of legal claims |
| Service analytics: pseudonymous, city-level statistics about how RentSynk is used, such as how many owners or providers there are per city. The city is worked out on our own server from locations you already gave us (property and listing pins, an Available provider's position). These statistics never include a precise location, a name or a phone number | Legitimate interests: understanding and improving the Service |
| Ads in the free tier | Legitimate interests (contextual ads); consent for personalised ads where required, such as Apple's ATT prompt |
In India, we process your data on the basis of your consent, which you can withdraw at any time by deleting your account, and for the "legitimate uses" the DPDP Act allows, including compliance with law and court orders. We do not sell your personal data.
3. How We Protect It
- Sensitive fields are encrypted at rest with AES-256. That covers phone numbers, names, addresses, transaction references, agreement text and pages, and report descriptions and evidence.
- Phone lookups use a keyed one-way hash, not the number itself.
- All traffic uses HTTPS/TLS. Every request is authenticated, and access is checked on the server for every record.
- Payment proofs are encrypted and deleted as soon as the owner confirms or rejects the payment, or after 7 days if they never decide.
- Photos are re-encoded on upload, which strips their GPS and camera metadata. This applies to listing photos and report evidence.
- Listing photos are not encrypted, because listings are public by design.
No system is perfectly secure. If a breach puts your data at risk, we will notify you and the authorities as the law requires.
4. Who We Share It With
- Other users, as the features require:
- your landlord or tenant sees your name, phone number and the records of your tenancy;
- people searching the directory see a provider's name, phone number, skills, description, rating and rounded distance;
- everyone signed in sees a listing;
- a poster's number goes to whoever taps Contact, and the poster receives that person's name.
- Reporters are confidential. We never tell a reported person who reported them, unless a court or the law requires us to.
- Service providers that process data for us:
- Google Firebase (sign-in, push notifications, app integrity);
- Google AdMob (ads);
- RevenueCat (purchases);
- Mapbox (maps and address search);
- Microsoft Azure and Cloudflare (hosting).
- Authorities, as set out in Section 5.
- A buyer of the Service, if it is ever transferred, with this policy's protections intact.
5. Law Enforcement and Legal Requests
- Valid legal process only. We disclose user data to an authority only under a valid legal instrument, for example:
- in India: a notice under section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, an order under the IT Act, 2000, or a request under Rule 3(1)(j) of the IT Rules, 2021, which we answer within 72 hours;
- in the US: a subpoena, court order or warrant;
- in the EU: an order under Articles 9 or 10 of the Digital Services Act.
- Emergencies. We may disclose without a formal order when we believe in good faith that it is necessary to prevent death or serious physical harm.
- Threats to life or safety. When information suggests a crime threatening someone's life or safety, we inform the police where the law requires it, for example under Article 18 of the Digital Services Act.
- Telling you. We tell you about a request for your data unless the law, the order or an emergency prevents it.
- Ordinary reports stay internal. They are not shared with third parties except as described here.
6. How Long We Keep It
| Data | Kept for |
|---|---|
| Account and profile, including sign-up and last-active dates | While your account exists |
| Phone number and name after you delete your account | 180 days, encrypted and access-restricted, then erased (IT Rules 2021, rule 3(1)(h)) |
| Payment proofs | Until the owner decides, or 7 days at most |
| Rent ledgers, receipts, signed agreements | As long as the records are needed by either party. After your account is deleted, anonymised |
| A provider's location | Only the latest position, while Available |
| Listings and their photos | 60 days live (renewable), deleted 30 days after expiry, or sooner if you delete them |
| Report evidence | 180 days after the decision (IT Rules 2021, rule 3(1)(g)), then erased |
| Reports (including the reporter's phone number) and the moderation log | 3 years after the decision, the usual limitation period for legal claims, then deleted |
| A phone-number restriction | Until it is lifted. We keep the number encrypted, plus a one-way hash of it, to stop the same number from re-registering |
| Blocks | Until you unblock, or either account is deleted |
| Server logs | A rolling 180 days |
Open reports are kept until they are decided. When a court or authority lawfully asks us to preserve specific data, we keep it for as long as the request requires.
7. Deleting Your Account
- In the app: Settings → Delete Account. Deletion is immediate.
- On the web, without the app: web.rentsynk.com/legal/delete-account. Verify your number, then confirm.
- Deleted at once: your profile, sign-in, push tokens, service-provider profile and location, listings, blocks and notifications.
- Held, then erased: your phone number and name, encrypted, for 180 days, because Indian law requires it.
- Kept:
- shared rental records, anonymised;
- reports made by you or about you, for the periods above, so that a safety complaint can still be handled;
- any restriction on your number.
For any data request, email [email protected].
8. Your Rights
- Everyone: you can ask to see, correct or delete your data, or ask any question about it, at [email protected]. We acknowledge within 24 hours and answer within 30 days. Exercising a right never costs you anything or counts against you.
- EU and UK (GDPR): you also have the right to:
- restrict processing;
- object to processing based on legitimate interests;
- data portability;
- withdraw consent at any time;
- complain to the data protection authority where you live.
- India (DPDP Act, 2023): you have the right to:
- a summary of the data we process and who we share it with;
- correction, completion, updating and erasure;
- grievance redressal, answered within 90 days at most;
- nominate someone to exercise your rights if you die or become incapacitated.
- United States: we do not sell personal information. If your state's privacy law gives you access or deletion rights, you can use them through the same email.
9. Automated Measures
Some safety steps happen automatically, as interim measures:
- a listing reported by three different users is hidden until we review it;
- a provider reported by three different users is paused until we review it;
- a listing reported for sexual content is hidden on the first report.
A person makes every final decision. We make no decision with legal or similarly significant effects about you based solely on automated processing.
10. Children
The Service is for people 18 and older, the age needed to make rental agreements. We do not knowingly collect data from anyone younger. If you believe a minor has given us data, email [email protected] and we will delete it.
11. International Transfers
We operate from India, and our providers run data centres in several countries, including India, the EU and the US. If you use RentSynk from another country, your data is collected by us in India. Our providers process it under their contracts with us, using safeguards such as standard contractual clauses where the law requires them.
12. Changes
We will tell you in the app before a significant change to this policy takes effect, and update the date above. For a material change, we will ask you to review and accept it.
13. Contact and Grievance Officer
Mohammed Wasif Ul Haq (RentSynk), Hyderabad, Telangana, India
Grievance Officer: Mohammed Wasif Ul Haq
Email: [email protected]