Privacy Policy

1. Who we are

KiviRent ("we", "us") operates a rental listings and messaging platform for landlords and tenants in Lithuania. This policy explains what personal data we collect when you use KiviRent, why we collect it, and the rights you have over it under the EU General Data Protection Regulation (GDPR).

2. Data we collect

• Account data: name, email, phone, password (stored hashed, never in plain text), account type (tenant or landlord).
• Profile data: profile photo, verification documents you choose to upload.
• Listing data: if you're a landlord, the properties you list — address, price, photos, and related details.
• Communications: messages you send through KiviRent's chat, viewing requests, and rental applications.
• Booking & contract data: appointments, rental requests, lease terms, and signed contract documents tied to a booking.
• Reviews: ratings and comments you leave for a property or the other party after a stay.
• Usage data: login timestamps and basic device/browser information, collected for security (e.g. rate limiting, fraud prevention).

KiviRent does not currently process rental payments on-platform — landlords and tenants arrange and confirm payment directly, and the landlord records the booking in KiviRent afterwards. We don't collect card or bank details.

3. Why we process it

• To create and secure your account, and authenticate you (contract necessity).
• To operate the core service — listing properties, matching tenants and landlords, messaging, scheduling viewings, and managing rental applications and contracts (contract necessity).
• To send you transactional emails, such as booking confirmations or new-message notifications (contract necessity / legitimate interest).
• To keep the platform secure — rate limiting, abuse prevention, audit logs on failed logins (legitimate interest).
• To comply with legal obligations, including retaining signed lease contracts where required by law (legal obligation).

4. Who we share it with

We share data only where it's needed to run the service:

• The other party to a conversation, booking, or contract — a landlord and tenant necessarily see each other's name, contact details, and messages.
• Google Maps, to display property locations.
• Our email delivery provider, to send transactional emails.
• Our hosting and file storage providers, who store the platform's data and uploaded files on our behalf.

We do not sell your personal data to third parties.

5. How long we keep it

We keep account and activity data for as long as your account is active. Signed lease contracts and related booking records may be retained after account deletion where we have a legal obligation or legitimate interest to do so (for example, to resolve a dispute between a landlord and tenant). See Section 7 for what happens when you delete your account.

6. Cookies & local storage

KiviRent uses your browser's local storage to keep you signed in (your session token) and to remember basic preferences. We don't use third-party advertising or tracking cookies.

7. Your rights

Under GDPR, you can, at any time from your profile page:

• Access & export a copy of the data tied to your account.
• Correct inaccurate account details by editing your profile.
• Delete your account. This deactivates your account and immediately scrubs your directly-identifying details (name, email, phone, photo). Records that other users legitimately rely on — like a signed contract or a review — may be retained in anonymized form, consistent with GDPR Art. 17(3)(b).

You can also object to or ask us to restrict certain processing by contacting us — see Section 9.

8. Security

Passwords are hashed with BCrypt and never stored or logged in plain text. Access to the platform is protected by JWT-based authentication, and we apply rate limiting to guard against abuse. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.

9. Contact us

Questions about this policy, or a request relating to your data? Email us at contact@kivirent.com. We answer data requests within one month, as required by GDPR Art. 12(3).