Privacy Policy

1. Data controller

Rentoutbase is operated by Embrik Skrindo (sole proprietor), Norway. For any questions about this policy or your rights, contact support@rentoutbase.com.

For your own account as a landlord — your account details, your billing and how you use the service — Rentoutbase is the data controller.

For personal data you enter or collect through the platform about your tenants, co-tenants, applicants or others, you are the data controller and Rentoutbase acts as your data processor. Our Data Processing Agreement sets out how we process that data on your behalf.

If you are a tenant: your landlord decides what is recorded about you and is the controller for it. Contact your landlord first. If you contact us, we will pass your request on to them.

2. Categories of personal data

• Account data: name, email address, phone, address, role. Passwords are handled by our authentication provider, Supabase Auth, and are never stored in plain text.
• Property data: addresses, buildings, rent amount, lease dates, images, meter numbers, bank account number.
• Tenant and applicant data: name, email, phone, access code, tenancy history, rent records, and enquiries sent through a landlord's listing page.
• Contract data: lease agreements, identity details included in a lease (such as date of birth or national identity number), signatures, signing timestamps.
• Communications: messages exchanged in the platform, announcements to tenants, damage reports and photos.
• Rob AI data: what you write to Rob and his replies, facts you have asked Rob to remember about your portfolio or a property, the proposals Rob raises and a log of the actions he performs.
• Employee and integration data: name, email address and permissions of employees you invite; integration API keys (stored only as hashes) and a log of every call made with them.
• Enquiries: name, email address and the message you send through our contact or demo form.
• Billing data: subscription status, plan and Stripe customer ID. Card details are processed by Stripe; we never store them.
• Usage and security data: IP address (for rate limiting and abuse prevention), session tokens, audit logs of administrative actions, and page-view statistics collected with Vercel Web Analytics.
• Device data (tenant app only): photos captured or selected by the tenant, push notification token.

3. Purposes and legal basis (GDPR art. 6)

For tenant data we process as a landlord's processor, the landlord determines the purpose and the legal basis.

We do not rely on consent for the processing described above (except for optional marketing, which we currently do not send). We do not sell your data. We do not use it for advertising or profiling, and we do not perform automated decision-making with legal effect on you (art. 22): Rob AI finds things out and drafts, and a person decides.

3a. Rob AI and other AI features

Rentoutbase uses the OpenAI API for its AI features. Data is sent to OpenAI only when you use one of those features or have switched on Rob AI, and only what is relevant to the request:

• Conversations with Rob: your message and the portfolio data Rob looks up to answer it, such as properties, tenancies, rent status, lease dates, open damage reports, finances and tenant messages.
• Damage report triage: the text and photos of a damage report, to suggest how it should be categorised and prioritised.
• Reply drafts: the conversation with a tenant, to draft a reply for you to review.
• Contract and listing import: the text of the contract or listing you import.
• Property memory: your own replies to tenants, to update what Rob knows about a property.

Rob is switched off until you switch him on, and pausing him stops all of his processing. Rob never writes and sends a message to a tenant on his own: a message he has drafted is sent only after you have approved the exact text. Standard rent reminder emails go out automatically only where they have been switched on for your account; they are off when Rob is first activated.

Rob changes data in your account, such as recording a rent payment, only when you explicitly ask, and an action requested after he has read text written by a tenant is queued for your approval instead. Every action Rob takes is logged. Rob remembers facts only from your own messages, never from what a tenant wrote.

OpenAI processes this data to produce the response, under its terms for the API, and does not use data sent through the API to train its models. Rentoutbase does not train AI models on your data either. OpenAI is a US company and processes the data outside the EEA, including in the US; see section 4.

4. Sub-processors

We use the following service providers to run Rentoutbase. For tenant data they are sub-processors under our Data Processing Agreement. The list of sub-processors shows what data each one receives (last updated 28 September 2026).

• Supabase — Database, sign-in and file storage (photos and documents). EU: AWS region eu-west-1, Ireland.
• Vercel — Hosting of the website, dashboard and API, and page-view statistics (Vercel Web Analytics). Server functions run in Dublin, Ireland (EU). Content is delivered through Vercel’s global edge network. Vercel is a US company.
• OpenAI (API) — AI processing: conversations with Rob AI, maintenance triage, drafts of replies to tenants, and contract and listing import. OpenAI is a US company. Processing takes place outside the EEA, including in the US. OpenAI does not use data sent through its API to train its models.
• Resend — Email from the service: access codes, contract links, notifications and reminders, and enquiries from the contact and demo forms. Resend is a US company. Processing may take place in the US.
• Stripe — Subscription billing. Rent collection through Stripe is used only where that feature has been enabled for the account. Stripe is a US company. Processing may take place in the US.
• Apple — Push notifications to the iOS app (Apple Push Notification service). Apple is a US company. Processing may take place outside the EEA.
• Expo — Delivery of push notifications to the tenant app, and the tooling the app is built with. Expo is a US company. Processing may take place outside the EEA.

Some of these providers are US companies or may process data outside the EU/EEA. Such transfers take place under each provider's data processing terms. You can ask us for more information at the contact address above.

If we engage a new sub-processor or replace an existing one, we will update the list and notify registered users at least 30 days before the change takes effect, so you have an opportunity to object.

4a. What we don't do

• We do not sell your personal data.
• We do not share your data with advertising networks, data brokers or profiling services.
• We do not train AI models on your content. When you use an AI feature, OpenAI processes the relevant data to produce the answer, as described in section 3a.
• We do not send marketing emails unless you separately opt in. You can opt out at any time.

5. Device permissions (tenant app)

• Camera: used only when you capture a photo for a damage report.
• Photo library: used only when you attach an existing photo to a damage report.
• Push notifications: used to deliver messages and reminders from your landlord, with your permission.

These permissions are never used for any other purpose. You can revoke them at any time in your device settings.

6. Retention and deletion

• Active accounts: data is kept for as long as your account exists.
• Deleting your account: as a landlord you can delete your account under Settings → Delete account. This deletes your user record and login, your properties and the records linked to them (such as messages, damage reports and rent records), your templates, calendar events and notifications, and Rob AI's proposals and action log and your integration keys.
• What we complete on request: uploaded photos and documents stay in file storage, and tenants have their own user records, which are not removed with yours. Contact us and we will delete them, or finish the deletion if it cannot be completed in Settings.
• Tenant data: the landlord decides how long it is kept and can remove a tenant and their history in the dashboard.
• Billing and accounting records: invoices and payment records are kept for as long as the Norwegian Bookkeeping Act (bokføringsloven) requires.
• Logs: Rob AI's action log and the log of integration calls are deleted with the account. Logs of administrative actions taken by Rentoutbase are kept to document what was done.
• Enquiries: contact and demo requests are kept while we follow them up. Ask us if you want yours deleted.

7. Your rights

Under the GDPR you have the following rights:

• Access (art. 15): receive a copy of the data we hold about you. Landlords can download the data linked to their account via Settings → Download your data; otherwise contact us.
• Rectification (art. 16): correct inaccurate or incomplete data. Most fields are editable in Settings, otherwise contact us.
• Erasure (art. 17): delete your account and personal data via Settings → Delete account. Section 6 explains what that covers and what we complete on request. Some records may be retained to meet the legal obligations listed there.
• Portability (art. 20): export your data in machine-readable format (JSON) via Settings → Download your data.
• Restriction (art. 18) and Objection (art. 21): limit or object to processing. Contact us.
• Withdraw consent at any time, where processing is based on consent.

Tenants: requests about data a landlord has recorded should go to that landlord (see section 1). We help the landlord answer them.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet, or with the supervisory authority in the EU/EEA country where you live.

8. Security

We protect your data with these technical and organisational measures:

• All traffic to and from the service uses HTTPS.
• Passwords are handled by Supabase Auth and never stored in plain text.
• The database is closed to Supabase's public Data API: row level security is enabled on every table, with no public access.
• Sign-in attempts are rate limited, and each user can turn on two-step sign-in with a one-time code by text message.
• Documents and photos from damage reports and inspections are stored privately and opened only through links that cannot be guessed.
• Employees get role-based permissions, which can be limited to specific buildings or apartments.
• Integration API keys are shown once, stored only as hashes, limited in scope, rate limited and revocable, and every call is logged.
• A message Rob AI has drafted is not sent to a tenant until you have approved the exact text, and his actions are logged.
• Administrative actions taken by Rentoutbase are logged.

We hold no security certifications. No system is completely secure. If a personal data breach affects data we control, we will notify Datatilsynet within 72 hours where required by art. 33, and you without undue delay where required by art. 34. If it affects tenant data we process for a landlord, we notify the landlord without undue delay, as set out in the Data Processing Agreement.

9. Children

Rentoutbase is intended for users who are 18 or older. We do not knowingly collect data about minors.

10. Cookies

We use essential cookies required to keep you signed in and to protect the service from abuse. We do not use advertising, tracking or analytics cookies that require consent under the ePrivacy rules. We count page views with Vercel Web Analytics.

11. Changes

We may update this policy. If we make material changes, we will notify registered users by email or in-app notice at least 14 days before the change takes effect.

12. Jurisdiction-specific rights

United States: our database and file storage are hosted in the EU (Ireland), and our server functions run in Ireland. If you are a customer in the United States, your data — and the data you enter about your tenants — is stored in the EU rather than in the US. Some of the providers listed in section 4 are US companies and may process data in the US, as described there.

Requests under US state privacy laws — such as the right to know or access the personal information we hold, the right to request deletion or correction, and the right to opt out of sale or sharing (we do neither, see section 4a) — are handled through the same contact channel as all other privacy requests: support@rentoutbase.com. We do not discriminate against you for exercising these rights, and we aim to respond within the same 30-day window described in section 13.

United Kingdom: the UK GDPR and the Data Protection Act 2018 give you rights equivalent to those described in section 7. Complaints can be directed to the UK Information Commissioner's Office (ICO).

Switzerland: the revised Federal Act on Data Protection (FADP) gives you rights equivalent to those described in section 7. Complaints can be directed to the Federal Data Protection and Information Commissioner (FDPIC).

Other EU/EEA countries: you may lodge a complaint with the supervisory authority in your country of residence instead of Datatilsynet.

13. Data protection contact

We are not legally required to appoint a Data Protection Officer, but Embrik Skrindo is the designated point of contact for all data protection matters and can be reached at support@rentoutbase.com. We aim to respond to requests within 30 days as required by art. 12 GDPR.