Privacy Policy

Information We Collect

We collect several categories of information from or about you, as described below.

1. Information You Provide Directly

When you create an account, list a sublet, book a sublet, or use certain features, you provide information to us. This includes:

• Account registration — your email address, full legal name, password (which we store only as a hash), university affiliation, gender, profile photo (optional), and an optional biography or free-text profile description.
• Identity verification — when you opt into identity verification, we collect a document type (government-issued ID, passport, driver's license, or student ID), an image of the front (and back, where applicable) of the document, and a selfie taken while you hold the document next to your face. We also record the submission timestamp, the review outcome and timestamp, and the IP address from which you submitted the documents. These materials are treated as sensitive personal information and are subject to the additional protections described in Section 4 below.
• Property verification — when you list a sublet, we require documentation of your right to sublet, such as a current lease or rental agreement, recent utility bill, bank statement showing the address, or other official mail bearing your name and the listed address. We record the document, the submission and review timestamps, the verification status, and any rejection reason.
• Listing information — when you post a sublet listing, we collect the title and description, monthly rent, full property address (street, city, state, ZIP), precise latitude and longitude coordinates of the property, university association, bedroom and bathroom counts, lease type, move-in and move-out dates, property photos, amenities, house rules (pets, smoking, parties, guest policies), free-form roommate details, property guidelines and move-in instructions, and whether renters insurance is required.
• Booking and payment information — when you book or accept a booking, we collect the move-in and move-out dates, the booking amount, the service fee, any referral discount, and the Stripe customer or Connect account identifiers associated with you. Payment card details are entered directly with Stripe and are not received or stored by SublettingU. We retain payment status information (pending, authorized, succeeded, released, refunded, failed, or disputed) and the Stripe checkout session and payment intent identifiers.
• Sublease contracts and electronic signatures — for every completed booking we generate and store a sublease contract. We retain the contract document, the timestamp and IP address of each party's electronic signature, the contract status, and the associated booking, listing, renter, and lister identifiers.
• Messages and communications — we retain the text of messages you exchange with other users through the Platform, along with sender and recipient identifiers, the associated listing, read status, and timestamps. We also retain communications you send to us directly, including support requests, feedback submissions, and survey responses.
• Referral and waitlist data — if you join our waitlist, we collect your email address and optionally your first name and university. If you participate in our referral program, we generate and store a unique referral code for you, record the referral code you used (if any) when you signed up, your referral count, your referral credit balance, your waitlist position (if applicable), and the timestamp of your signup.
• Consent and legal acknowledgments — we record whether and when you have accepted these Services' Terms of Acceptable Use, whether you have acknowledged the renter's insurance recommendation, and any other consents or acknowledgments you provide during signup or onboarding.

2. Information We Collect Automatically

As you use our Services, certain information is collected automatically about your device and your interactions with the Platform:

• Usage data — we log usage information such as when you log in, the features or pages you access, the actions you take (for example, creating a listing or signing a contract), and the dates and times of those events.
• Device and technical data — we collect data about the device and internet connection you use to access the Platform, including IP address, browser type and version, operating system, device identifiers, and approximate location derived from IP address. If you use our mobile application, we may collect device type, OS version, and unique device or advertising identifiers.
• Cookies and similar technologies — we use a limited set of cookies and similar technologies that are necessary to operate the Platform, including session cookies set by our authentication provider to keep you logged in. We do not use third-party analytics cookies, advertising pixels, session-recording tools, or behavioral tracking scripts. You can control cookies through your browser settings; however, disabling session cookies will prevent you from signing in.

3. Information from Third Parties

On occasion, we may obtain information about you from third-party sources, including:

• Payment and payout providers — Stripe (and any other payment processor we use) may send us confirmation of payment status, payout status, dispute or chargeback notices, and the identifiers needed to reconcile transactions on the Platform. If you connect a Stripe Express account as a lister, Stripe may share verification or onboarding status with us.
• Identity and university verification services — we may use third-party identity verification services and university name lookup services to facilitate verification. These providers may share with us a verification result, risk score, or matched university record.
• Referral activity — if another user refers you to the Platform, we receive that user's referral code and link it to your account if you sign up.

4. Sensitive and Biometric-Adjacent Data

Identity verification involves the collection of government-issued identification documents together with a selfie of you holding that document. We treat these materials as sensitive personal information. We use them solely to confirm your identity for purposes of Platform safety, to investigate fraud or misuse, and to comply with applicable law. We store verification documents in private storage accessible only to authorized personnel involved in the verification review. We do not use the selfie image to derive a biometric template, run facial recognition against any database, sell or license the image, or share the image with any third party other than service providers acting on our behalf or as required by law. We retain verification documents for one year following the verification decision, after which they are deleted or anonymized, except where a longer retention period is required by law or by a pending dispute or investigation.

Residents of Illinois, Texas, Washington, and other states with biometric or facial-recognition statutes: by submitting an identity-verification selfie, you provide your written consent to our collection, use, and retention of that image as described above. You may withdraw your consent and request deletion of your verification materials at any time by emailing privacy@sublettingu.com, subject to our right to retain materials necessary to resolve disputes, prevent fraud, or comply with law.

We do not intentionally collect other categories of sensitive personal information, such as racial or ethnic origin, religious beliefs, health information, or genetic information. Please refrain from providing such information through the Platform. If you do, we will treat it with the same care described above and in accordance with applicable law.

5. Children's Data

The Services are not directed to children under 18. We do not knowingly collect personal information from anyone under 18, and our Terms of Acceptable Use prohibit users under 18 from creating accounts. If we discover we have inadvertently collected personal information from a child under 18, we will promptly delete it. If you believe we may hold information from a child under 18, please contact us at privacy@sublettingu.com.

How We Use Your Information

We use the information we collect to provide, maintain, secure, and improve the Services, to develop new features, and to protect SublettingU and its users. Specifically:

• To operate the marketplace — we use your information to facilitate the core functions of the Platform, including matching renters with listings, displaying listings and profiles, enabling communications between users, generating and storing sublease agreements, and recording electronic signatures.
• To process payments and payouts — we use payment-related information to charge renters through Stripe, to hold funds until the move-in date, to release payouts to listers through Stripe Connect, to apply referral credits, and to issue refunds in accordance with our Cancellation Policy.
• To verify identity and listings — we use identity, university, and property verification information to confirm that users and listings are legitimate and to reduce the risk of fraud.
• To power AI features — we use the Anthropic Claude API to power features such as listing fraud detection, listing description generation, natural-language search, suggested message replies, match scoring, lease summarization (which involves transmitting lease documents you upload), and support-chat assistance. Anthropic does not use API inputs to train its models, and we transmit only the information needed for each feature.
• To communicate with you — we use your contact information to send transactional communications, including booking confirmations, payment receipts, contract-signing requests, verification status updates, dispute notifications, security alerts, and other essential service messages. With your permission where required, we may also send product updates, newsletters, or referral-program announcements; you may opt out of marketing communications at any time.
• To maintain safety and security — we use account, transaction, and communications data to detect and prevent fraud, abuse, harassment, and other harmful activity; to enforce our Terms of Acceptable Use and Community Guidelines; and to investigate violations.
• To improve the Platform — we use aggregated and de-identified usage data to understand how users interact with the Services and to identify opportunities to improve them.
• Legal compliance — we process personal data to comply with applicable laws, including tax-reporting obligations, to respond to lawful requests, and to enforce our agreements and policies.

Legal Bases for Processing (EEA and Similar Jurisdictions)

If you are in a jurisdiction that requires a lawful basis for processing personal data (such as the European Economic Area, the United Kingdom, or Switzerland), our legal bases include: (i) performance of a contract, for processing necessary to provide the Services you have requested; (ii) legitimate interests, for processing necessary to operate, secure, and improve the Platform; (iii) consent, for processing that requires it (such as the use of identity-verification selfies, which you may withdraw at any time); and (iv) compliance with legal obligations, including tax, anti-fraud, and law-enforcement requirements.

Sharing of Information

We are careful about how and when we share personal information. We share it only in the following circumstances:

• With transaction counterparties — when you book or accept a booking, the other party to that transaction receives the information needed to complete it. For example, when a renter confirms a booking, the lister sees the renter's name and booking details, and the renter sees the lister's contact and payout information as relevant to the booking. The signed sublease agreement is shared with both parties.
• With your consent or at your direction — we will share your information with third parties when you instruct us to do so.

Service providers. We use trusted third-party service providers to perform functions on our behalf, including:

Cookies, Tracking, and Analytics

SublettingU does not use third-party analytics tools, advertising pixels, behavioral tracking scripts, or session-recording technologies. The only cookies we set are those necessary to authenticate your session and operate the Platform. Most web browsers allow you to control or delete cookies; however, disabling session cookies will prevent you from signing in.

Your Rights and Choices

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• — Access and portability — request a copy of the personal information we hold about you, in a structured, machine-readable format where applicable.
• — Correction — request that we correct inaccurate or incomplete information. Many fields can be updated through your account settings.
• — Deletion — request that we delete your personal information. This may require closing your account. Certain records, such as completed sublease contracts and payment records, may be retained for legal, tax, or compliance purposes.
• — Withdrawal of consent — where we rely on your consent (for example, to retain identity-verification selfies), you may withdraw that consent at any time, subject to our right to retain materials needed to resolve disputes or comply with law.
• — Object to processing — object to processing of your data, particularly for direct marketing or non-essential analytics.
• — Restrict processing — ask us to limit our processing of your data while a complaint is being resolved.
• — Non-discrimination — exercise your privacy rights without retaliation. Note that some data is necessary to provide the Services; we cannot offer the Platform if we cannot, for example, identify your account.

To exercise any of these rights, email privacy@sublettingu.com. We will respond within the time required by applicable law (generally within 30 days). We may need to verify your identity before fulfilling certain requests.

Users in the European Economic Area, the United Kingdom, or Switzerland also have the right to lodge a complaint with their local data-protection authority. We encourage you to contact us first so that we may address your concerns directly.

California residents have the rights set forth in the California Consumer Privacy Act (as amended by the California Privacy Rights Act), including the right to know what categories of personal information we collect, from where, for what purposes, and with whom we share it; the right to access specific pieces of information; the right to request deletion; the right to correct inaccuracies; and the right to non-discrimination. We do not sell personal information.

Email and Communication Preferences

You may opt out of receiving promotional emails by following the unsubscribe instructions in those emails or by adjusting your account settings. We will continue to send you transactional and service-related messages, such as booking confirmations, contract-signing notifications, and security alerts, because these are necessary to provide the Services.

Retention

We retain your personal information only for as long as needed to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. Specific retention periods include:

• — Account data: retained for the life of your account.
• — Payment and tax records: retained for seven years to comply with tax and financial-recordkeeping requirements.
• — Signed sublease contracts: retained for the term of the sublease plus six years for legal recordkeeping.
• — Messages between users: retained for two years after the last message in the conversation.
• — Identity-verification documents and selfies: deleted one year after the verification decision, unless retention is required for a pending dispute, investigation, or legal obligation.
• — Server logs: retained for 90 days.
• — Closed accounts: residual data may persist briefly in backups before being overwritten, and certain records may be retained as set out above.

International Users

SublettingU is based in the United States. If you access the Services from outside the United States, your personal data will be transferred to and processed in the United States and other jurisdictions where we or our service providers operate. Data-protection laws in those jurisdictions may differ from those in your home jurisdiction. For users in the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses or other lawful transfer mechanisms where required.

Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include TLS encryption in transit, encryption at rest, role-based access controls, audit logging, and storage of identity- and property-verification documents in private storage buckets accessible only to authorized personnel involved in verification review. No platform is entirely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials secure. If you believe your account has been compromised, contact us immediately at privacy@sublettingu.com.

Automated Decision-Making

We may use automated systems to support certain decisions, such as flagging suspicious listings or transactions for human review. Significant decisions that affect your access to the Services, including suspension or termination of accounts, are subject to human review. If you believe a decision affecting you was made in error, you may contact us to request review.

Third-Party Links and Accounts

The Services may contain links to third-party websites or services. We do not control and are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party site or service you interact with. If you choose to link your SublettingU account to a third-party account, you may disable that connection through the third-party service or your SublettingU profile, although doing so will not delete data we have already received.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account or by prominent notice on the Platform before the change takes effect. The “Effective Date” at the top of this Policy indicates when the most recent changes were made. Your continued use of the Services after the changes take effect constitutes your acceptance of the updated Policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Thank you for trusting SublettingU with your personal information. We are committed to keeping that trust by handling your data responsibly.

Supplemental State Privacy Rights

The following summarizes rights afforded to residents of certain states and how SublettingU's practices align with those rights. To exercise any of these rights, contact privacy@sublettingu.com or write to SublettingU LLC, Attention: Privacy Officer.