This policy explains how RightTenantry collects, uses, and protects personal data when landlords use our service to rank rental applications and when applicants submit an application through a landlord's shared link. Last updated 2026-05-23.
1. Who we are
RightTenantry is the data controller for the personal data described in this policy. You can reach our privacy contact at [email protected]. Our registered business address is listed on the contact page.
2. What this policy covers
This policy applies to two groups: landlords who sign up to use the RightTenantry dashboard, and applicants who submit a rental application at /apply/<code> using a link a landlord shared with them. It also covers emails sent to a vacancy's forwarding address.
3. What we collect and why
Landlord account data
- Name, email, password hash, and notification preferences — needed to create and secure your account.
- Property details and vacancy information you create — needed to publish an application form and receive applications.
- Billing identifiers we receive from Stripe (no card numbers) — needed to link completed payments to the vacancy they unlock.
Applicant data
- Identification and contact details: name, email, phone, current address — needed so the landlord can reach you and verify basic details.
- Employment and income information: employer, job title, monthly income, additional income sources — needed to assess affordability.
- Rental history and references: previous landlord or character references, employer references, declared eviction or CCJ history — needed so the landlord can verify your background.
- Household information: co-applicants who will share the rent, number of occupants, pets — needed to understand the tenancy and match the property to your circumstances.
- Supporting documents you upload (proof of income, photo ID is deliberately NOT requested at application stage) — needed to verify the information you provided.
- Your personal statement and consent record — needed so the landlord can hear your story and so we can evidence that you agreed to this policy.
Emails sent to a vacancy's forwarding address
When you email a vacancy's forwarding address — for example, to ask a question before applying — we store your email address, display name, phone number if you include it in the message, and the message body. This is needed to forward the email to the landlord and to send an automatic acknowledgement.
4. Our lawful bases for processing
We rely on the following lawful bases under GDPR Article 6:
- Legitimate interest — assessing prospective tenants so the landlord can make a fair, informed letting decision. Following Irish Data Protection Commission guidance (2019), we do not rely on consent as the lawful basis for tenant screening, because the power imbalance between landlord and applicant makes consent unlikely to be freely given.
- Contract necessity — processing landlord account and billing data to deliver the SaaS service you signed up for.
- Legal obligation — keeping accounting, tax, and consent records for the periods Irish law requires.
- Consent — used narrowly, for example when an applicant attests that they have obtained a guarantor’s permission before providing third-party contact details, AND for any non-essential cookies or browser storage (analytics, marketing). Non-essential cookies are off by default and fire only after you opt in via our cookie banner. Required under Irish ePrivacy Regulations 2011, regardless of the GDPR Art. 6 basis we would otherwise rely on.
5. How long we keep your data
We apply the storage-limitation principle: data is kept only as long as necessary for the purpose it was collected.
| Data | Retention | Trigger |
|---|---|---|
| Rejected applicant personal data | 30 days | from when the landlord marks the application as rejected |
| Uploaded document files | 30 days | same as above — deleted from storage after database deletion |
| Emails to a vacancy's forwarding address | 30 days | after the vacancy closes. To ask for earlier deletion of an email you sent us, email [email protected] — we'll respond within 30 days (GDPR Art 12(3)). |
| Consent records (without identifying data) | 6 years | from when consent was given — kept to evidence agreement |
| Decision audit log (pseudonymised) | 6 years | from the event — required by EU AI Act Article 26(6) and Irish statute of limitations |
| Landlord account data | Until you delete your account | self-service delete via Settings → Account. We do not auto-delete dormant accounts. |
| Payment records | 6 years | from the transaction date — Revenue requirement |
The 30-day rejected-applicant clock is enforced automatically by a daily scheduled job. It starts when a landlord marks your application as rejected; the clock is immune to later changes to the vacancy so it cannot be reset.
6. How AI assists the landlord's assessment
When you submit an application, an automated analysis summarises your answers and ranks applications side by side, helping the landlord review them efficiently. The landlord always makes the final decision — the analysis is advisory, not binding.
What the analysis uses
- Declared monthly income and stated income sources, relative to the advertised rent
- Declared employment status and duration
- References you provide (landlord, employer, or character)
- Declared rental history, including any eviction or CCJ disclosures
- Number of occupants, pets, and whether you smoke
- The content of your personal statement
What the analysis never uses
Consistent with the Irish Equal Status Acts 2000–2018, the analysis is built and tested to exclude all ten protected grounds from its assessment:
- Gender
- Civil status (such as marital status)
- Family status
- Sexual orientation
- Religion or belief
- Age
- Disability
- Race, colour, nationality, or ethnic or national origins
- Membership of the Traveller community
- Housing assistance (HAP, RAS, or other social welfare payments)
Your rights around the automated analysis
You have the right to request human review of any AI-assisted decision about you (GDPR Article 22, EU AI Act Article 26(11)). Email [email protected] with your application reference. We respond within 10 working days.
7. Your rights
You can:
- Ask for a copy of the data we hold about you (right of access)
- Ask us to correct inaccurate data (right of rectification)
- Ask us to delete your data (right of erasure)
- Ask us to restrict processing while we resolve an issue
- Ask us to send your data to another service in a machine-readable form (right of portability)
- Object to processing you think isn't justified
- Withdraw consent where we rely on it
If you submitted an application, your confirmation email contains a one-time link to delete your application yourself, without contacting the landlord. For any other request — including a copy of the data we hold about you — email [email protected] from the address on your application. We'll respond within 30 days as required by GDPR Article 12(3).
8. Who we share data with
We use the following processors to deliver the service. Each is bound by a data-processing agreement and operates in the European Economic Area or equivalent.
- Supabase — Postgres database and object storage for uploaded documents. EU region.
- Stripe — payment processing for landlord billing. We never see or store card numbers. EU (Stripe Payments Europe Ltd).
- Resend — transactional email delivery (application confirmations, erasure links, inbound email forwarding). EU region.
- Google Cloud Platform — Cloud Run (application hosting), Cloud Run Jobs (scheduled retention deletions), Cloud Scheduler, Secret Manager, and Agent Engine / ADK for the AI scoring agents that process applicant data. EU region (europe-west1).
- Cloudflare — CDN, DNS, and edge rate-limiting. Handles request metadata only. EU-preferred global routing.
- Sentry — error monitoring. Stack traces are scrubbed for PII before transmission. EU region where configured.
- PostHog — product analytics. With your consent (see Cookie settings), captures pageviews, clicks, and signup/payment funnel events so we can fix bugs and improve the service. We do not enable session recording. EU region (eu.i.posthog.com). Opt out any time through Cookie settings.
- Google Ads — advertising measurement. With your marketing consent (see Cookie settings), we tell Google when a signup, listing, or payment followed one of our ads, so we can see which campaigns work. Active only after you opt in. Opt out any time through Cookie settings.
9. International transfers
Your data is processed in the European Economic Area. Where a sub-processor operates a global service (for example, Cloudflare's edge), data in transit may briefly cross EEA borders but is not stored outside the EEA. Standard Contractual Clauses are in place where required.
10. Security
Data is encrypted in transit (TLS 1.2+) and at rest. Database access is restricted to authenticated service accounts with scoped grants. Uploaded documents are stored in a private bucket with access mediated by signed URLs. Our retention job deletes rejected-applicant data on a fixed schedule so personal data is not kept longer than necessary.
12. Children
The service is directed at adults who rent or let residential property in Ireland. We do not knowingly collect personal data from children under 16. If you believe a child has submitted data, please contact us and we will delete it.
13. Complaints
You have the right to lodge a complaint with the Irish Data Protection Commission if you believe we have not handled your data lawfully. Details at dataprotection.ie.
14. Changes to this policy
We may update this policy as the service evolves. Material changes — new sub-processors, changes to lawful basis, or changes to retention — are reflected in a new policy version and shown in the "Last updated" date. Every consent record we hold is tagged with the policy version that was live when you agreed, so you can always see what you agreed to at the time.
15. Contact
Data protection queries: [email protected]. General support: [email protected]. More ways to reach us are on the contact page.