RENT apps privacy notice

About this notice

This notice explains what the RENT mobile apps collect, why, who can see it, and what you can do about it. It covers two apps:

• RENT, listed in the app stores as RENT: Stays & Venues. Guests use it to find and book stays and event venues, and to arrange viewings of residences in Dubai.
• RENT Owner. Hosts use it to list and manage their places and venues.

Inside the apps, listings are grouped into stays, event spaces (venues) and Danube (residences in Dubai). The text message that carries your sign-in code, and PayPal’s payment page, show the name RENT.

The apps are operated by SPACE-IZ Ltd, registered in the United Kingdom with company number 12709068, at Level 39, One Canada Square, Canary Wharf, London, E14 5AB. SPACE-IZ is the data controller.

Our general privacy policy sets out how we handle data across all SPACE-IZ services, including our lawful bases and international transfers. It continues to apply. This notice adds the detail specific to the RENT apps. Where the two differ on something about the apps, this notice applies.

A separate account in each app

RENT and RENT Owner have separate accounts, each identified by your mobile number. If you use both apps with the same number, you have two accounts: each has its own profile, identity checks, settings, messages and notifications, and deleting one does not delete the other.

Signing in

You sign in with your mobile number. There is no password. We send a one-time code to your number by text message, and you enter it in the app. The texts are sent by Twilio, our SMS provider.

We keep only a scrambled (hashed) copy of each code, and only until it is used or expires a few minutes later. To stop abuse, we count how many codes are requested for each number and from each IP address, and limit both.

What the RENT app collects

RENT, the guest app, collects:

• Your profile: your name, and anything else you choose to add. That can be your gender, date of birth, home address (country, state, city, street address, house number and postcode), the languages you speak and a profile photo.
• Your email address, if you add one. We confirm it by sending a code to it.
• Identity verification, if you choose to verify your ID. See Identity verification below.
• Your bookings: which listing, the dates or hours, the number of guests, the price, whether the host accepted, and the reason you give if you cancel.
• Viewing requests for residences in Dubai: the date and time you choose and the contact details you enter (name, phone number, email address and country or region), plus any message you write. These go to the host as a chat message; see Who sees your information.
• Messages you exchange with hosts in the app’s chat.
• Reviews: the star rating and any text you leave after a completed booking.
• Reports you make about a listing, a photo, a review, a chat message or another user, with the reason and any note you add (a report about a chat message keeps a copy of that message), and the people you block.
• Your wishlist of saved listings.
• Payment records; see Payments and payouts.

The listings you have recently viewed and your recent searches are kept on your phone only. They are not sent to us.

What the RENT Owner app collects

RENT Owner, the host app, collects:

• Your profile: your full name, a profile photo, your email address (which we confirm by sending a code to it), the languages you speak and your gender. Hosts need a name and a profile photo before they can publish a listing, because guests see them on the listing.
• Identity verification, which every host must complete before publishing a listing. See Identity verification below.
• Your bank details, so that we can pay you: the account holder’s name, the bank and branch name, the account number, an IFSC code (for Indian accounts) or an IBAN, and optionally a SWIFT/BIC code. The account number is encrypted before it is stored; the app shows only its last four digits.
• Your listings: the address and map position, photos, name and description, property type, rooms and capacity, amenities, highlights, house rules, safety information, prices (weekday, weekend, daily or hourly) and, for venues, opening hours. Listings of residences in Dubai can also include project details, a virtual tour link and a PDF brochure.
• Your bookings and earnings: the requests you receive, your answers to them, what you have earned and the payouts we have sent you.
• Messages you exchange with guests, your public replies to reviews, and any reviews you report.

When you type an Indian IFSC code, the app looks up the bank and branch with Razorpay’s public IFSC lookup service. Only the code is sent; no other details go with it.

Identity verification

Guests can choose to verify their identity, from Profile → Verified ID in the RENT app. They upload a photo of a government ID and, optionally, a selfie.

Hosts must verify their identity before they can publish a listing. In RENT Owner, they choose a document type (Aadhaar card, passport or national ID), upload a photo of the document, and add a photo of themselves.

These images are encrypted before they are stored, and they can only be decrypted by our own servers. We show them only to you and to members of our team who have permission to review identities. A person on our team checks them. We do not run facial recognition or any other automated matching on them, and we do not send them to identity-checking companies.

Payments and payouts

Guests pay through PayPal. When you pay, PayPal’s own page opens, and you log in to PayPal or enter your card details there. We never see or store your card number or your PayPal password. PayPal handles what you give it on its page under its own privacy notice.

We send PayPal the amount, a booking reference and the listing’s name. We keep a record of each payment:

• the amount and currency, and what it was for;
• PayPal’s references for the order, the hold on your money, the payment and any refund;
• its status and dates; and
• the kind of payment method you chose on PayPal’s page (for example PayPal or card). We do not keep the card details themselves.

When we refund a payment, we record the amount, the reason and PayPal’s refund reference.

We pay hosts by bank transfer. For each payout we record the amount and currency, which bookings it covers, the transfer reference and date, and the bank name, account holder name and last four digits of the account it was sent to.

Location

Neither app collects your location in the background. Each asks for permission to use your location only while the app is open, and only for the purposes below. You can say no, and the rest of the app still works.

• RENT uses your location only when you tap Nearby in search. Your current position is sent with that search so that we can find listings near you. It is not saved to your account.
• RENT Owner uses your location to fill in a listing’s address and place its pin on the map. That happens when you tap Use my current location, or when you open the map to set the pin. Your phone’s own location service (Apple’s or Google’s) turns the position into an address. The pin you save becomes the listing’s map position, which guests see.

Address search. When you search for an address in either app, what you type goes to our servers, which look it up with Google’s mapping services. Google receives the search, not your name or account. If a host saves a listing without placing a pin, our servers find the address on the map with OpenStreetMap’s Nominatim service, which receives only the address.

Device and technical data

Both apps also collect:

• A push notification token for your device, and whether it is an iPhone or an Android phone. We use it to tell you about bookings, messages and your listings. It is removed when you sign out. You can also turn notifications off in your device settings.
• Your IP address, which reaches our servers with every request. We use it to limit how often requests can be made. We also record it against each signed-in session, together with the software identifier (user agent) your app sends, and delete both when that session expires.
• Server logs recording which part of our service was called and when. This includes anything carried in the request address, such as an address search or the position sent with a Nearby search.
• Crash and error reports. When an app, or our servers while handling your request, run into an error, a report goes to Sentry, the service we use to find and fix faults. It says what went wrong, where in our code and on which screen, and includes the app version, your device model, operating system, language and time zone, and a random identifier the crash reporter creates for your installation of the app. For a small sample of screens and requests it also records how long they took. Before a report leaves your device or our servers we remove email addresses, phone numbers and IP addresses, and anything a web address carries after its path, such as an address search. A report never includes your name or account, what you type, or what is on your screen. Sentry does not store your IP address; it uses it only to note which country a report came from. Reports are stored in the EU (Frankfurt) and kept for up to 90 days.

Neither app contains advertising or analytics software from other companies. The crash reporter above is there to find and fix faults, not to measure how you use the apps. We do not track you across other companies’ apps and websites.

Who sees your information

Anyone using the RENT app can see published listings, including their photos, address and map position, prices and house rules. They can also see the host’s name and profile photo, and reviews. Each review shows the reviewer’s name and profile photo, and the host’s reply if there is one.

When you request a booking, the host sees your name and profile photo, the dates or hours, the number of guests, the amount and the booking’s status. Hosts do not see your email address or phone number in a booking.

When you request a viewing of a residence in Dubai, the contact details and message you enter are sent to the host as a chat message.

When you chat, the other person sees your name, profile photo and messages. If you have not added a name, their app shows your country code and the last four digits of your mobile number instead (for example +44 ••• 3456); the rest of the number is never sent to them. Deleting a chat removes it from your inbox only. The other person can still see it, and so can we.

Our team works through an internal admin panel. Each staff member’s access depends on their role, and some can see only one of the stays, event spaces or Danube sections. Only our most senior administrators can see your email address and phone number. Only staff with permission to review identities can open ID documents. Only staff who send payouts can see a host’s full account number, and every time they do, it is logged.

Service providers

We use these service providers to run the apps. They process data on our behalf, under contract and on our instructions:

• Amazon Web Services, for our servers, file storage and caching, in London;
• MongoDB Atlas, for our database;
• Twilio, for sign-in codes by text message;
• Microsoft Azure Communication Services, for email: verification codes, updates on your listings and on reports you make, notices when we remove something you posted, and refund confirmations;
• Google Firebase Cloud Messaging for push notifications, with Apple’s push service on iPhone;
• Google Maps Platform for address search, and Google Maps and Apple Maps for the maps in the apps;
• OpenStreetMap’s Nominatim service, for placing listing addresses on the map;
• Sentry (Functional Software, Inc., a US company), for crash and error reports, which it stores in the EU; and
• PayPal, for payments.

We do not sell your personal data. We share it with regulators or law enforcement only where the law requires us to.

Keeping your data, and deleting it

We keep your account data for as long as your account is open.

You can delete your account from inside the app. Each app has its own account, so if you use both, delete each one:

• in RENT, go to Profile → Support → Delete account;
• in RENT Owner, go to Account → Account Settings → Delete Account.

You can also delete it on the web, without the app, at www.space-iz.com/delete/rent/user (RENT) or www.space-iz.com/delete/rent/owner (RENT Owner). You confirm it is you with a code we text to the mobile number on your account.

Or email support@space-iz.com from the email address on your account, or tell us the mobile number on your account. Our support page has step-by-step instructions.

When you delete your account, you are signed out of that app on every device and your account is hidden straight away. For 30 days you can change your mind: sign in to the same app again with the same mobile number and it offers to restore the account. After 30 days it can no longer be restored, and we delete it permanently, including your:

• profile, photos and email address;
• identity documents and bank details;
• listings, bookings and viewing requests;
• chats, which are deleted for the other person in each conversation too;
• reviews, reports, wishlist and notifications; and
• push notification tokens and signed-in sessions.

What we keep. We keep records of payments, refunds and payouts, without your profile, for as long as tax and accounting law requires us to. We cannot delete these on request.

A host cannot delete their account while they have a listing that guests can see, or a booking that is waiting for an answer or has been accepted. Switch the listing off and deal with those bookings first.

Children

The RENT apps are for adults. You must be 18 or over to use them, and we do not knowingly collect data about children. If you think a child has given us their data, email privacy@space-iz.com and we will delete it.

Your rights and how to contact us

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time; for example, you can turn off location or notifications in your device settings. These rights, and how to exercise them, are set out in full in our general privacy policy.

To exercise any of them, or to ask us anything about this notice, email privacy@space-iz.com. For anything else about the apps, email support@space-iz.com.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first, so that we can put it right.