Privacy policy

This marketing site is static: it holds no form, no account and no advertising tracker.

By default, nothing is stored in your browser. The pages and the fonts are served with the site: no request goes to another domain, Google included.

Audience measurement (Google Analytics) is loaded only if you accept it in the banner. Until you accept, no measurement script runs and no measurement cookie is set; if you refuse, none ever is.

Your choice is kept for six months in your browser — not in a cookie sent to any server — after which the question is asked again. You can change it at any time with the “Cookies” link at the foot of the page.

If you write to contact@rentalshub.io, your address and the content of your message are used to reply to you, and for nothing else.

These exchanges are kept for three years after our last exchange, and then deleted.

The application sits at a different address from this site, but this policy covers it too: it is the one shown to you when you sign up, and there is no other.

The account holds your first name, your last name, your email address and, if you fill them in, your telephone number, your company name and a profile picture. To those are added the language of the interface, and the version of the terms and conditions you accepted together with the moment you accepted it.

Depending on how you open the account, we keep either a hash of your password — never the password itself — or the identifier Google hands us to recognise you by. If you arrive through Google, your name, your email address and your profile picture are passed to us by Google at the moment you agree to continue with it.

Every sign-in leaves a trace: the date, the IP address, the browser, the operating system, the kind of device and the city deduced from it. That deduction happens on our own servers, against a database downloaded in advance: your IP address is sent to nobody for it.

All of this serves to give you access to the service, to run it and to keep it secure. The legal basis is the performance of our contract, and, for the sign-in traces, our legitimate interest in protecting accounts.

As soon as a subscription is paid for, we keep the details you enter for your invoices: legal or personal name, postal address, country, VAT number where there is one, and the language you want your documents drawn in. They appear on every invoice issued and can no longer be changed on it afterwards.

We never see your card number: it is entered at Stripe, on a page Stripe hosts. Of the card we keep only what any receipt prints — the brand, the last four digits, the expiry date — and the identifier Stripe gives us to recognise it by.

The legal basis here is twofold: the performance of our contract in order to collect the subscription, and a legal obligation for keeping the invoices.

Your account and workspace data are kept for as long as the account exists. A suspension or a cancellation erases nothing: your data stays, and you find it again if you come back.

Erasure is available on request, at contact@rentalshub.io. We carry it out within a month, except for what the law obliges us to keep.

Invoices and their supporting records are kept for ten years from the close of the financial year, as the French commercial code requires.

Email exchanges are kept for three years after the last of them.

We back the database up every night, with OVH in France, in a store separate from the one hosting the application. Those backups are kept for thirty-five days, and one a month for twelve months. Data erased at your request disappears from the service at once, and from the backups as they expire: we do not reopen them to remove a row, and we use them only to restore the service after an incident.

We sell no data and pass none to anybody for advertising. The only third parties that receive any are the sub-processors the service needs in order to run, together with the audience measurement of our marketing site where you have accepted it; each one receives only what its task calls for.

OVH hosts the application, its database, and the invoices and photographs we archive. Stripe handles payments. Channex relays availability, prices and reservations to the distribution platforms; for Vrbo, it also receives the login and password of the Vrbo account you enter when connecting, which we pass on to it without keeping them. It keeps them for as long as the connection exists, and a connection started and never finished is deleted there within two days. To appear on Google, a property is passed by Channex to Google with its name, its address, its contact phone number, its description, its facilities, its photos, its prices and its availability; a guest booking from Google does so on Channex’s booking page, and their details reach us through Channex, as for any platform booking. Google provides the maps, the geocoding of addresses and signing in with a Google account. Mailjet delivers the emails the service sends. Sentry receives the technical errors the service runs into, on its German servers: the message, where in the code it happened and the address of the page concerned, so that we can fix it. Neither your identity nor your IP address is sent to it, and what the service exchanges with the platforms does not appear there. Firecrawl and Anthropic read a listing when you import one. Let’s Encrypt issues the HTTPS certificate for a domain name you own when you connect it to your booking site: it receives only that name, which it then publishes, like every certificate authority, in the public Certificate Transparency logs. Google Analytics measures the audience of our marketing site, and only where you have accepted it in the banner: it receives nothing of what your account holds.

The application and its database are hosted by OVH in Canada; the invoices and photographs we archive are stored by OVH in France. Canada is covered by an adequacy decision of the European Commission, which recognises its law as offering an adequate level of protection: that transfer requires no additional contractual safeguard.

Some of these sub-processors are established in the United States or transfer data there: those transfers are covered by the European Commission’s standard contractual clauses and, where it applies, by the EU–US Data Privacy Framework.

Any addition to this list is announced before it takes effect.

Guests entered into the service, or who book on a customer’s booking site, are not our customers: their data belongs to whoever manages them.

For that data our customer is the controller and we are the processor within the meaning of article 28 of the GDPR: we process it only on their instruction, for the duration of their contract, and we return it to them or delete it at its end.

A guest wishing to exercise their rights therefore writes to the host they booked with. Write to us all the same if you do not know who to contact: we will pass it on.

You have the right to access, correct, erase, restrict and object to the processing of your data, as well as the right to portability and the right to leave directions as to what becomes of it after your death.

To exercise them, write to contact@rentalshub.io. You may also lodge a complaint with the French data protection authority (CNIL).

Data controller: Rentals Hub, 47 rue Vivienne, 75002 Paris, France.