Privacy Policy

Rental Riches ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what we collect, why we collect it, how we use it, who we share it with, and the rights you have over your information.

1. Who we are

Rental Riches is a software-as-a-service product operated by Tanra Consulting LLC. If you have any questions about this policy or your data, contact us at tgarban@tanraconsulting.com.

2. Information we collect

a. Information you provide

• Account information — name, email address, password (stored hashed), avatar (optional), timezone, language, and any profile fields you fill in.
• Financial and operational data — everything you enter or upload about your rental business: properties, reservations, guest names, amounts, fees, payouts, expenses, expense categories, rental platforms, comments. We treat this as your data — see Section 5.
• Uploaded files — CSV imports, profile pictures, and any other attachments you upload to your account.
• Communications — the content of support tickets, contact-form submissions, and emails you send us.
• Payment information — when you subscribe to a paid plan, our payment processor (Stripe) collects your card or banking information. We do not store full card numbers on our servers; we receive only a token and limited metadata (last 4 digits, brand, expiration).

b. Information collected automatically

• Usage and device data — IP address, browser type, operating system, pages visited, timestamps, and similar diagnostic information.
• Cookies and similar technologies — we use cookies for authentication (keeping you logged in), CSRF protection (security), and remembering your preferences. We do not use third-party advertising or behavioral-tracking cookies.
• Server logs — request paths, status codes, response times, and error traces, used to keep the service running and diagnose problems.

3. How we use your information

• To provide, operate, and improve the service.
• To process payments and manage your subscription.
• To send transactional emails — sign-up confirmations, password resets, billing receipts, security alerts.
• To communicate with you about features, updates, and customer support.
• To protect the service from abuse, fraud, and security incidents.
• To comply with legal obligations and respond to lawful requests.

We do not sell your personal information. We do not rent it. We do not use your financial or operational data to train AI/ML models without your explicit, separate consent.

4. Who we share information with

We share your information only with the service providers we need to run the product, and only for the purpose of running it. These are our sub-processors today:

• Render — application hosting (Oregon, US).
• Supabase — managed PostgreSQL database hosting (US region).
• Amazon Web Services (S3) — object storage for uploaded files such as CSV imports and profile pictures.
• Amazon Web Services (SES) — transactional email delivery.
• Stripe — subscription billing and payment processing. See Stripe's own privacy policy at stripe.com/privacy.
• OpenAI — optional, only when you import a non-standard CSV and ask us to auto-detect the column mapping. We send the column headers and one sample row; we do not send guest names or financial amounts.

We may also disclose information if required by law, to enforce our Terms of Use, to protect the rights, property, or safety of Rental Riches, our users, or others, or in connection with a corporate transaction (merger, acquisition, sale of assets) — in which case we'll give affected users prior notice where legally possible.

5. Your data is yours

You own the operational data you enter into Rental Riches — your properties, reservations, expenses, and the records that flow from them. We hold it on your behalf to provide the service. You can export it at any time and you can delete your account at any time.

6. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — a copy of the personal information we hold about you.
• Correction — request that we fix inaccurate information.
• Deletion — request that we delete your account and associated personal information.
• Portability — receive your data in a structured, machine-readable format.
• Restriction / objection — ask us to limit how we use your information, or object to certain processing.
• Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting past processing.
• Complain to a regulator — you can lodge a complaint with your local data protection authority (e.g., in the EU/EEA) or California Attorney General (CCPA/CPRA).

To exercise any of these rights, contact tgarban@tanraconsulting.com. We aim to respond within 30 days.

7. Data retention

We retain your account information and the data you create for as long as your account is active. When you delete your account, we delete your personal information within 30 days, except where we're legally required to keep certain records (e.g., billing records may be retained up to 7 years for tax compliance) or where keeping it is necessary to resolve a dispute or enforce our agreements.

Backups roll on a 30-day cycle, after which deleted records are also expunged from backup storage.

8. Security

We protect your information using industry-standard practices: HTTPS-only transport, encrypted database storage at rest, hashed passwords, optional two-factor authentication on your account, CSRF protection on every form, restricted access to production systems, and regular security updates. No system is perfectly secure, but we take reasonable steps to keep your data safe and to notify you in the event of a breach affecting your personal information.

9. International transfers

Rental Riches is hosted in the United States. If you access the service from outside the US, your information will be transferred to, processed in, and stored in the US. By using the service, you consent to this transfer.

10. Children

Rental Riches is not intended for use by anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. If the changes are material, we'll notify you by email or via a prominent notice in the app at least 30 days before the changes take effect.

12. Contact

Privacy questions or requests can be sent to tgarban@tanraconsulting.com.