Legal
Privacy Policy
Last updated: 3 June 2026. RentalStack is currently in beta.
1. Who we are
RentalStack is an AI-powered listing optimisation tool for Hostaway property managers. We are operated by Darren Morgan ("we", "us", "our"), based in Australia. Questions or requests: support@rentalstack.io.
2. What we collect
We collect the following data when you use RentalStack:
- Account data: email address, organisation name, and any profile information you provide when signing up or updating your account.
- Hostaway API credentials: the API key and account ID you provide to connect your Hostaway account. These are stored encrypted at rest using AES-256-GCM.
- Listing and review data: property listing content (titles, descriptions, amenities) and guest review text synced from Hostaway on your request. We process this data to provide the service and do not use it for any other purpose.
- Billing data: your payment method and transaction history are handled directly by Stripe. We store only your subscription status, plan tier, and Stripe customer ID — never raw card details.
- Waitlist data: if you joined the waitlist, we stored your email address and the source field you submitted.
- Usage and error data: anonymised usage events and error reports collected via Sentry to diagnose bugs and improve reliability.
- Log data: standard server logs (IP address, browser type, pages visited, timestamps) retained for up to 30 days.
3. How we use your data
- To provide and operate the RentalStack service.
- To run AI analysis on your listing and review content — this involves sending listing text to Anthropic's API for processing (see Third-party processors below).
- To process billing and manage your subscription via Stripe.
- To send transactional emails (account invites, billing receipts, service notices) via Resend.
- To monitor service health and diagnose errors via Sentry.
- To protect the service from automated abuse via Cloudflare Turnstile.
- We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Third-party processors
We share data with the following sub-processors only as necessary to provide the service:
- Anthropic— AI processing. Listing and review text is sent to Anthropic's API to generate rewrites and reply drafts. Anthropic's privacy policy governs their handling of API inputs.
- Stripe — Payment processing and subscription management. Stripe handles all payment card data; we never see or store raw card numbers.
- Resend — Transactional email delivery (invites, billing, service notices).
- Cloudflare — CDN, DDoS protection, and bot verification (Turnstile) on public-facing forms.
- Sentry — Error monitoring and performance tracing. Error reports may include request metadata; we configure Sentry to avoid capturing sensitive field values.
- Hetzner Online GmbH — Cloud hosting. Our servers and database are hosted on Hetzner infrastructure in the EU.
5. Data security
Hostaway API credentials are encrypted at rest using AES-256-GCM before being written to our database. Access to production systems is restricted to authorised personnel. Data in transit is protected by TLS. We follow reasonable industry-standard practices to protect your data, but no system is completely secure — please use a strong, unique password and keep your API credentials confidential.
6. Data retention
We retain your account data and listing/review data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or billing compliance purposes (e.g. Stripe billing records).
7. Your rights
You may request access to, correction of, or deletion of your personal data at any time by emailing support@rentalstack.io. We will respond within 30 days. Where applicable, you also have the right to data portability and to object to processing.
8. Cookies
We use essential session cookies to keep you logged in and to secure your account (including the beta-invite flow). We do not use advertising or tracking cookies. The Cloudflare Turnstile widget on public forms may set a functional cookie for bot detection purposes.
9. Beta service
RentalStack is currently in beta. Features, data-handling practices, and third-party integrations may change as the product evolves. We will update this policy and notify registered users of material changes via email.
10. Governing law
This policy is governed by the laws of Victoria, Australia. By using RentalStack you consent to the jurisdiction of Australian courts for any dispute relating to privacy.