Privacy Policy

Inrentives, Inc., a Delaware corporation (“Inrentives” or “we”), builds the Renter Passport: a portable tenant screening report that a renter orders, pays for, and shares with the landlords they choose. This policy explains what we collect, why, who sees it, and the choices you have. It covers inrentives.com and the renter, landlord, and agent apps at my.inrentives.com, landlords.inrentives.com, and agents.inrentives.com.

What we collect

• Account details. Your mobile number (renters), email address, name, the codes we text or email to sign you in, and passkey credentials if you create one.
• Identity. Images of your government ID and a selfie, captured by our identity verification provider, which also makes a scan of face geometry to match them (see “Biometric information” below); the name, date of birth, address, and document type read from them (you may correct or change the address at any time; checks already run keep their results), with the document number reduced to a one-way code that shows when the same ID is used on two accounts; and your Social Security number, which the credit, eviction, and background checks require.
• Income. Payroll or bank data you connect, or pay stubs you upload, and the figures verified from them.
• Consumer reports. Credit information (a soft inquiry), eviction records, and background records obtained from consumer reporting agencies at your direction and with your written authorization.
• Payment. Our payment processor handles your card. We keep the transaction record, never the card number.
• Sharing activity. Whom you sent your Passport to, when each link was opened, and what each landlord decided.
• Landlords and agents. Name, email, phone, company or license details, and the attestations, decisions, and referral activity you record.
• Technical data. IP address, device and browser details, and server logs kept for security.

How we use it

• To produce your Renter Passport, keep it current while it is valid, and show it to the recipients you choose.
• To sign you in and protect your account, with texted codes, passkeys, and new-device confirmation.
• To take payment, handle refunds and payment disputes, and pay agent referrals.
• To send the messages the service needs: sign-in codes, receipts, share notifications, and expiry reminders. We send marketing only if you ask for it.
• To detect fraud, prevent abuse, meet our legal obligations, including the Fair Credit Reporting Act, and keep an audit trail of every report access.
• To improve the product, using aggregate measurements that never include report data.

Who we share it with

• The landlords and agents you choose. A landlord sees your Passport only after attesting to a permissible purpose. An agent you authorize sees your verification status and the level of detail you allow. We never sell your data.
• Service providers acting on our instructions: identity verification (Persona), income verification (Plaid; Plaid’s handling of your data is described in its own privacy policy), consumer reporting agencies for credit, eviction, and background records, payments (Stripe), sign-in and passkeys (Stytch), text messages (Twilio), email delivery (SendGrid), address suggestions as you type (Google Maps Platform, through our server), and hosting (Google Cloud, in the United States).
• Legal and safety. When the law requires it, to protect our users or the public, or as part of a merger or sale, in which case this policy continues to apply.
• Never your mobile number for marketing. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. We share no mobile information with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data and consent are excluded from every category above and are never shared with any third party.

How long we keep it

• Passport data (check results, verified figures, and the underlying reports) for the life of the Passport plus 90 days, and longer only while a dispute or payment dispute is open.
• Your Social Security number while a Passport is active and for 30 days after your last Passport expires without renewal, is refunded, or is abandoned unfinished. We do not keep your ID document number.
• ID images, selfies, and the face scan made from them are never stored by us. Our identity verification provider holds them and destroys them on the biometric schedule below.
• The report exactly as a landlord saw it when they attested, along with attestations, decisions, consents, and access logs, for seven years, as consumer reporting rules and claims periods require.
• Payment records for seven years. Message records for one year. Account details for the life of your account.

How we protect it

Social Security numbers, dates of birth, ID document data, and raw reports are encrypted at the application layer with keys held in Google Cloud KMS, in addition to encryption in transit and at rest. The database has no public endpoint. Every report access is logged. Pages that hold personal data load no third-party scripts, and card details never touch our servers.

Your choices and rights

• See and control sharing. Your dashboard lists every link you have sent and who has opened it. You can revoke sharing at any time.
• Correct your information. If something in a report is wrong, dispute it from your dashboard and we will route it to the company that produced the data. The Fair Credit Reporting Act gives you the right to dispute inaccurate information at no cost; the Consumer Financial Protection Bureau explains those rights at consumerfinance.gov.
• Delete your account. Write to us and we will delete your data, including the copies our identity, income, payment, and sign-in providers hold, keeping only what the law requires us to retain (your consents, landlords’ attestations and decisions, the reports as landlords saw them, dispute and payment records, and audit trails) for the periods above.
• Messages. A code you ask for comes by text. Texts about your account come only if you check the box for them when you sign in with your phone; otherwise we email them. Reply STOP to any text to stop them, or HELP for help (our terms say more). We do not send marketing texts.
• State rights. Residents of some states have additional privacy rights. Write to us and we will honor them as the law provides.

Biometric information

To confirm that the person verifying is the person on the ID, our identity verification provider, Persona Identities, Inc. (“Persona”), makes a scan of face geometry from the selfie you take and from the photo on your ID. Illinois law calls this biometric information. It is collected only with your written consent, given on its own before the camera opens, and used only for that match.

• Who holds it. Persona processes it on our behalf. We never store the selfie, the images of your ID, or the face scan ourselves. We never sell, lease, trade, or otherwise profit from biometric information, and we disclose it to no one beyond Persona unless the law requires it.
• Retention schedule. The selfie, the ID images, and the face scan are destroyed 30 days after your identity check’s outcome is final (verified automatically or decided by a person). If a check is never completed, they are destroyed when the Passport is refunded or left unfinished. In every case they are destroyed no later than three years after your last interaction with us, whichever comes first.
• How it is destroyed. We instruct Persona to permanently redact the verification, which deletes the images and the face scan and leaves only a record that a check took place. Redaction runs automatically every night on the schedule above, and each run is logged without the data itself. Only a valid warrant or subpoena can delay this schedule.
• Your choices. You can decline: the selfie check does not start, and nothing is collected. You can ask us to destroy your biometric information sooner, or to delete your account, by writing to us.

Children

Inrentives is for adults. We do not knowingly collect information from anyone under 18.

Changes

When this policy changes we update the date above. If a change materially affects how we use your data, we tell you by email or text before it takes effect.

Contact

Inrentives, Inc., Chicago, Illinois. Write to support@inrentives.com with any question about this policy or your data.