Privacy Policy

Our Commitment to Privacy

At Instalease Corp ("Instalease", "we", "us", or "our"), a Delaware corporation, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, mobile applications, and services (collectively, the "Service").

By using our Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our Service.

1. Information We Collect

1.1 Information You Provide to Us

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, password, profile photo
• Profile Information: Bio, preferences, user type (host/renter)
• Payment Information: Credit/debit card details, billing address (securely processed by Stripe)
• Property Listing Information: Descriptions, photos, amenities, pricing, availability
• Booking Information: Reservation details, dates, times, special requests
• Communications: Messages with other users, support inquiries, reviews
• Verification Documents: Government-issued ID, business licenses (when required)

1.2 Automatically Collected Information

When you use our Service, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent, search queries, click patterns
• Location Information: Approximate location based on IP address; precise location if you grant permission (mobile apps)
• Cookies and Tracking: Session cookies, preference cookies, analytics cookies
• Mobile Device Permissions: Camera (for photos), photo library, push notifications, location services

1.3 Information from Third Parties

We may receive information from:

• Sign in with Apple: Basic profile information (name, email) when you use Apple authentication
• Payment Processors: Transaction confirmation from Stripe
• Identity Verification Services: Verification results for enhanced security
• Analytics Providers: Aggregated usage statistics

2. How We Use Your Information

We use your information for the following purposes:

• Provide Services: Facilitate bookings, process payments, enable messaging
• Account Management: Create and maintain your account, verify identity
• Communication: Send booking confirmations, updates, customer support responses
• Personalization: Provide personalized recommendations using our proprietary AI (SOC compliant)
• Safety & Security: Detect and prevent fraud, enforce policies, protect against abuse
• Analytics: Analyze usage patterns, improve features, optimize performance
• Marketing: Send promotional emails (with your consent; opt-out available)
• Legal Compliance: Comply with laws, regulations, and legal processes
• Dispute Resolution: Investigate and resolve conflicts between users

3. How We Share Your Information

3.1 With Other Users

When you list a space or make a booking, relevant information is shared:

• Hosts can see renter names, profiles, and booking details
• Renters can see host names, profiles, and space details
• Reviews and ratings are publicly visible

3.2 With Service Providers

We share information with trusted third-party service providers:

• Stripe: Payment processing (PCI-DSS compliant)
• SendGrid: Transactional and marketing emails
• Cloud Storage Providers: Image hosting and data storage (AWS S3, Cloudflare R2)
• Analytics Services: Usage analytics and performance monitoring
• Customer Support Tools: Support ticket management

All service providers are contractually obligated to protect your information and use it only for the purposes we specify.

3.3 For Legal Reasons

We may disclose your information when required by law or when we believe disclosure is necessary to:

• Comply with legal obligations, court orders, or government requests
• Protect our rights, property, or safety
• Prevent fraud or illegal activity
• Enforce our Terms of Service
• Protect the safety and rights of users or the public

3.4 Business Transfers

If Instalease is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.5 What We Don't Share

We DO NOT:

• Sell your personal information to third parties
• Share your information for third-party marketing without your consent
• Share your payment card information (handled securely by Stripe)

4. Sign in with Apple

When you use Sign in with Apple to create or access your account:

• We receive basic profile information (name, email) you authorize Apple to share
• You can choose to hide your email; Apple will provide a private relay address
• We do not receive your Apple ID password or other Apple account information
• You can manage your Apple sign-in preferences in your Apple ID settings
• Deleting your Instalease account does not automatically revoke Apple sign-in authorization (manage separately in Apple settings)

5. Proprietary AI & Data Processing

We use our own proprietary AI technology to enhance your experience:

• Purpose: Personalized search results, space recommendations, pricing insights
• Data Used: Your search history, booking patterns, preferences, reviews
• Security: Our AI systems are SOC compliant with enterprise-grade security
• No Third-Party AI: We do not share your data with third-party AI services
• Opt-Out: You can disable personalized recommendations in your account settings

6. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Password Security: Passwords hashed using bcrypt with industry-standard salting
• Access Controls: Limited employee access; role-based permissions
• Regular Audits: Security assessments, penetration testing, vulnerability scans
• PCI Compliance: Payment data handled by PCI-DSS compliant Stripe
• Monitoring: 24/7 security monitoring and incident response

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Breach Notification

In the event of a data breach that compromises your personal information:

• We will notify affected users within 72 hours of discovering the breach
• Notification will include the nature of the breach, affected data, and remedial actions
• We will notify relevant regulatory authorities as required by law
• We will provide guidance on steps you can take to protect yourself

8. Your Privacy Rights

You have the following rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data (see Account Deletion below)
• Data Portability: Request your data in a portable, machine-readable format
• Opt-Out: Unsubscribe from marketing emails (transactional emails still sent)
• Object: Object to certain processing of your data
• Restrict Processing: Limit how we use your information

To exercise these rights, contact us at privacy@instalease.com or through your account settings.

9. Account Deletion (Apple Requirement)

You can delete your account at any time:

• How: Go to Profile → Account Settings → Delete Account (mobile app) or contact support
• Effect: Immediate account deactivation; profile no longer visible
• Data Deletion: Personal information deleted within 30 days
• Exceptions: Some data retained for legal compliance, dispute resolution, or fraud prevention (anonymized where possible)
• Bookings: Active bookings must be completed or cancelled before deletion
• Reviews: Your reviews may remain visible but disassociated from your account

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request details about the personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information (with certain exceptions)
• Right to Opt-Out: Opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Authorized Agent: You may designate an authorized agent to make requests on your behalf

To exercise your CCPA rights, email privacy@instalease.com with "California Privacy Request" in the subject line.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on consent, contract performance, legal obligations, and legitimate interests
• Data Transfers: Your data may be transferred to the US; we use Standard Contractual Clauses for protection
• Data Protection Officer: Contact our DPO at dpo@instalease.com
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority
• Withdrawal of Consent: You can withdraw consent for data processing at any time

12. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Keep you signed in, remember your preferences
• Analytics Cookies: Understand how you use our platform (Google Analytics, anonymized)
• Functional Cookies: Enhance features and personalization
• Advertising Cookies: Deliver relevant ads (with your consent)

You can control cookies through your browser settings. Note that disabling cookies may limit some features. For detailed information, see our Cookie Policy.

13. Mobile App Permissions

Our mobile apps may request the following permissions:

• Camera: Take photos for listings or profile pictures
• Photo Library: Upload existing photos
• Location: Find nearby spaces, provide location-based recommendations
• Notifications: Receive booking updates, messages, and alerts

You can manage these permissions in your device settings. Denying permissions may limit certain features.

14. Data Retention

We retain your information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal obligations (tax records, financial reporting)
• Resolve disputes and enforce agreements
• Prevent fraud and abuse

Retention Periods:

• Active account data: Retained while account is active
• Deleted accounts: Personal data deleted within 30 days (except legal holds)
• Transaction records: 7 years for tax and legal compliance
• Support communications: 3 years
• Marketing data: Until you opt-out or account deletion

15. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions for certain countries
• Binding Corporate Rules for intra-group transfers

16. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us immediately at privacy@instalease.com.

If we learn we have collected personal information from a child under 18, we will delete that information as quickly as possible.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification to your registered email address
• Displaying an in-app notification

Your continued use of our services after changes become effective constitutes acceptance of the updated Privacy Policy.