Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account information — your email address, full name, password (hashed), and the university you attend.
• Identity verification documents — government-issued ID, passport, driver's license, or school ID images, plus a verification selfie. Stored privately and used only to verify identity.
• Property verification documents — lease agreements, utility bills, or other documents proving your right to sublet the property you list.
• Payment information — billing details, payout bank information (for listers), and transaction history. Card details are handled directly by Stripe; we never see or store full card numbers.
• Listing content — property photos, descriptions, addresses, pricing, availability dates, and house rules.
• Messages and communications — messages you send to other users, support requests, and contract signatures.
• Usage and device data — IP address, browser type, operating system, pages visited, timestamps, and approximate location derived from IP.

2. How We Use Your Information

• — Operate the SublettingU marketplace, including matching renters with listings.
• — Process payments through Stripe and disburse payouts to listers.
• — Verify the identity of users and the legitimacy of listings to prevent fraud.
• — Generate, store, and execute electronic sublease agreements between parties.
• — Power AI features (such as listing description generation, smart search, and lease summarization) via Anthropic's Claude API.
• — Send transactional emails — booking confirmations, payment receipts, contract signing requests, and verification status updates.
• — Investigate violations of our Terms, Community Guidelines, or applicable law.
• — Improve and secure the platform.

3. Third Parties We Share Data With

We do not sell or rent your personal data. We disclose information to law enforcement only when legally compelled or when needed to protect the safety of our users.

4. Data Retention

• — Account data: retained until you delete your account.
• — Payment records: retained for 7 years to comply with US tax and financial regulations.
• — Messages: retained for 2 years after the conversation ends.
• — ID verification documents: deleted 1 year after the verification decision.
• — Signed contracts: retained for the duration of the sublease plus 6 years for legal recordkeeping.
• — Server logs: retained for 90 days.

5. Your Rights

You have the following rights with respect to your personal data:

• — Access — request a copy of the personal data we hold about you.
• — Deletion — request that we delete your account and associated data.
• — Download / Portability — request your data in a structured, machine-readable format.
• — Correction — ask us to correct inaccurate information.
• — Opt out — unsubscribe from marketing emails at any time. Transactional emails (such as receipts and contract signatures) are required and cannot be opted out of while you have an active account.

To exercise any of these rights, email privacy@sublettingu.com. We will respond within 30 days.

6. CCPA — California Residents

Under the California Consumer Privacy Act, California residents have the right to (a) know what personal information we collect about them, (b) request deletion of their personal information, (c) opt out of the sale of personal information (we do not sell data), and (d) not be discriminated against for exercising these rights. To exercise CCPA rights, email privacy@sublettingu.comwith “CCPA Request” in the subject line.

7. GDPR — Users in the European Economic Area

If you are located in the EEA, UK, or Switzerland, our legal bases for processing your data are: (a) contract — to provide the services you have requested, (b) legal obligation — to comply with tax, financial, and law-enforcement requirements, (c) legitimate interest — to operate, secure, and improve the platform, and (d) consent — for any processing requiring it (which you may withdraw at any time).

You have the right to lodge a complaint with your local data protection authority. International transfers of EEA personal data are made under Standard Contractual Clauses.

8. Children's Privacy

SublettingU is intended only for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact privacy@sublettingu.com and we will delete the account promptly.

9. Security

We protect your data with TLS encryption in transit, encryption at rest, role-based access controls, and audit logging. Identity and property verification documents are stored in private storage buckets accessible only to authorized SublettingU personnel involved in verification review.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be communicated by email and through a prominent notice on the platform.

11. Contact

Questions about this policy or our data practices? Email us at privacy@sublettingu.com.