Privacy Policy

1. Data controller

• Brand: RentIDs
• Controller: Unnitan Bera S.L.
• Spanish tax ID (CIF/VAT): B88763073
• Registered office: Paseo de Gràcia 95, 5º 1ª, 08008 Barcelona, Spain.
• Contact: soporte@rentids.com

RentIDs is operated by Unnitan Bera S.L. This policy explains how we process personal data on rentids.com and app.rentids.com.

2. Scope

This Policy applies to the marketing site, the product, and the sign-up, invitation, document upload, verification, payment and profile or certificate sharing flows.

If you access RentIDs through an agency or through a link shared by an applicant, we will process the data needed to provide that flow and to record security access logs.

3. Data we process

3.1 Marketing and access list

• Email and type of interest (tenant or agency).
• Communications sent and technical data needed to prevent abuse.
• Site browsing data when you accept analytics cookies.

3.2 Tenant accounts

• Name, email, authentication user and session data.
• Identity, income and employment documents and other documents you upload voluntarily.
• Data you declare to generate your rental profile or certificate.
• Links, permissions and events associated with shared certificates.

3.3 Agency accounts

• Agency name, email, authentication user and plan data.
• Processes created, invited applicants, access to profiles and operational activity.
• Billing or subscription data where applicable.

3.4 Payments, authentication and security

• Payment data processed by Stripe. RentIDs does not store full card numbers.
• Google OAuth data if you choose to sign in with Google (email, identifier and permitted basic profile).
• Technical and security logs: IP address, browser, paths, timestamps, access events and relevant errors.
• Transactional emails, product notifications and support communications.

4. What we use the data for

• Creating and managing user and agency accounts.
• Receiving, storing and reviewing documents provided by users.
• Generating, maintaining and sharing rental profiles or certificates.
• Allowing agencies to access information shared in an authorised process.
• Processing payments, subscriptions, confirmations and related billing.
• Sending transactional emails, invitations, status notices and support communications.
• Measuring use of the marketing site with Google Analytics when you accept cookies.
• Preventing fraud, investigating incidents and protecting the security of the product.
• Complying with legal obligations and handling rights requests.

5. Legal bases

• Performance of the service: to manage accounts, verifications, payments, certificates, invitations and shared access.
• Consent: for analytics cookies and marketing communications where applicable.
• Legitimate interest: security, abuse prevention, operational logs, product improvement and support.
• Legal obligation: tax and accounting compliance, claims and requests from authorities where applicable.

6. Data sharing and providers

We only share data when it is necessary to operate RentIDs, when you authorise it within the product or when there is a legal obligation.

• Agencies or authorised recipients: they access the information the applicant shares or that is part of a process started by the agency.
• Supabase: database, storage, authentication and backend services.
• Vercel: hosting, deployment and serverless execution.
• Cloudflare: security, DNS/CDN and traffic protection.
• Stripe: processing of payments, subscriptions and payment events. Stripe may act as an independent controller for payment data.
• Resend: sending transactional emails and product communications.
• Google Analytics and Google Tag Manager: measurement of the marketing site when you accept analytics cookies.
• Google OAuth: authentication if you choose to sign in with Google.

RentIDs does not sell personal data to third parties.

7. International transfers

Some providers may process data outside the European Economic Area. In those cases we use providers with appropriate safeguards, such as adequacy decisions, standard contractual clauses or other mechanisms recognised by data protection law.

8. Retention

• Access list: until you unsubscribe or we no longer need it for beta access.
• Account and product data: while you keep your account or as long as needed to provide the service.
• Uploaded documents: for the time needed for review, the product, support or legal compliance.
• Certificates and shared links: while they are active or needed for traceability and security.
• Technical and security logs: for reasonable periods to operate, prevent abuse and resolve incidents.
• Payments and billing: in line with the applicable legal, tax and claims periods.

9. Security

We apply reasonable technical and organisational measures to protect data, including access control, private storage of documents, permission-based links, security logs and the use of specialised providers. No system is infallible; if a breach affects your rights, we will act in accordance with the applicable regulations.

10. Your rights

You can request access, rectification, erasure, objection, restriction of processing and portability where applicable.

To exercise your rights, write to us from your registered email at soporte@rentids.com. We will reply within the applicable legal period.

You can also file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if you believe the processing does not comply with the regulations.

11. Minors

RentIDs is not aimed at minors. If we detect that a minor's data has been provided without a valid basis, we may block or delete that information.

12. Beta phase

During the beta we may review processes, investigate incidents and adjust features to improve security, quality and reliability. This processing is limited to what is needed to operate and improve RentIDs.

13. Changes to this Policy

We may update this Policy when the product changes, when we add providers or when necessary for legal reasons. The version in force will always be the one published on this page.