How we look after your data
Landlords keep passports, share codes and signed agreements in Rynt.it. Here is what happens to them, in plain words: what we do today, and what we haven’t done yet.
- Uploaded files are private. Rynt checks that you are allowed to see a file before it issues a short-lived link, and the link stops working after five minutes.
- Tenants see their own tenancy and nothing else, and only the documents you share with them.
- Our staff can open your account only to fix a problem, only after re-entering their own password, and every time is logged.
- You can delete your data or close your account yourself, from Settings.
Your files are private
Everything you or your tenants upload (ID documents, Right to Rent evidence, gas and electrical certificates, signed agreements, inventory photos, receipts) is kept in private storage. None of it has a public web address.
When someone opens a file, Rynt.it first checks that a record they’re allowed to see holds that exact file. If it does, it gives them a link that stops working after five minutes. If it doesn’t, the answer is “not found”, the same as for a file that doesn’t exist.
Who can see what
- You see the records in your own account and no one else’s.
- Your tenants, if you invite them, see their own tenancy: rent and receipts, the repairs they’ve reported, their Right to Rent details, the contacts you choose to share, and the documents you share with them. A document you mark as not shared stays hidden from them. Messages go in one conversation for each tenancy, which you and the tenants on that tenancy can all read.
- Councils and utility suppliers receive details only when you send them, using “Tell someone” on a tenancy.
Our staff
To fix a problem, a Rynt.it administrator can open an account as its user. To do that they have to type their own password again, and each time is written to an audit log with the time and the account opened. Administrator accounts can’t be opened this way.
While an administrator is in your account, Rynt.it won’t let them close it, delete your data in bulk, import a spreadsheet, or accept terms on your behalf. Those stay your decisions.
Passwords and sign-in
- Your password is stored only as a one-way hash (bcrypt). Nobody at Rynt.it can read it.
- A forgotten password is reset through a link sent to your email address.
- New accounts can only be landlords or tenants. Nobody can sign themselves up as an administrator.
- We will never ask for your password by email, text or phone.
Payments
Plan payments go through Stripe’s own checkout page. Your card details go to Stripe; Rynt.it never sees or stores your card number.
Where your data is kept
| What | Where |
|---|---|
| The database (your records) | [DATABASE PROVIDER AND REGION] |
| Uploaded files | Supabase Storage, [STORAGE REGION] |
| The application servers | [HOSTING PROVIDER AND REGION] |
Rynt.it is served over HTTPS, so what passes between your browser and us is encrypted on the way. [CONFIRM: encryption at rest by the database and storage providers]. Every company that handles data for us is listed in our privacy notice.
When you leave
Settings lets you delete data (for example every property, or every payment record) and keep your account, or close your account altogether. Closing it locks the account at once: you and your tenants can no longer sign in. We keep your data for 30 days, and you can reopen the account by signing in during that time. After 30 days we delete your sign-in and every record filed against it for good: properties, tenancies, tenants and their logins, money, repairs, inventories and compliance records. Before you close, you can download everything, and Rynt.it shows you what will go before you confirm.
Uploaded files are removed from storage [FILE DELETION: when, after closing]. Backups are kept for [BACKUP RETENTION PERIOD] and then overwritten.
What we haven’t done yet
We’d rather tell you than have you find out.
- No independent penetration test yet. One is planned. We’ll say here when it’s done.
- No two-step sign-in yet. Use a password you don’t use anywhere else.
Report a problem
If you think something is wrong with how Rynt.it handles data, or you’ve found a security problem, email support@rynt.it with “Security” in the subject. Please don’t test against other people’s accounts.
Rynt.it is run by [COMPANY NAME], registered with the Information Commissioner’s Office, number [ICO REGISTRATION NUMBER].