Renthings

Version 2026-10-05

Uniqode Pte. Ltd. (UEN 202611861H) operates Renthings and is the organisation responsible for your personal data under Singapore's Personal Data Protection Act 2012 (the PDPA). This policy explains what we collect, why, who receives it, where it goes, how long we keep it, and what you can ask us to do. Our Data Protection Officer can be reached at support@renthings.sg.

1. What we collect

Account data: your email address, display name, and password, which is stored only as a one-way hash.
If you sign in with Google: the name, email address, profile photo link, and Google account ID that Google shares with us. We use the name as your first display name and do not show the photo.
Your mobile number, if you verify one. You need a verified Singapore mobile number before you can request a Rental. It is never shown to other members.
Listings and photos. When your browser can re-encode a photo, that removes camera metadata such as location.
Messages you send and receive on Renthings.
Rental and payment records: dates, amounts, Deposit Holds, refunds, Payouts, Disputes, Return Adjustments, and Reviews. Card details never touch Renthings; Stripe holds them. If you receive Payouts, Stripe collects your identity and bank details itself, and Renthings does not collect or store them.
Records of content checks, Reports, Suspensions, and Sign-in Blocks, and our Operators' decisions about you or your content.
Feedback you send us, Reports you make, and the members you Block.
Device data for push notifications, if you turn them on.
Privacy requests you make on our website: which account, what for, and when.
Technical data: IP address, browser, and errors, kept to run and secure the service. This includes the network address and browser recorded with each sign-in session (at first this can be our server's, until your browser next refreshes the session).
Page analytics: which pages are visited, from which site, and the country, browser, and operating system, counted without cookies and without identifying you.

2. Why we use it

To run your account, Listings, Messages, Rentals, payments, and Payouts.
To verify your mobile number before you request a Rental, so that a Suspension cannot be escaped simply by opening a new account with a new email address.
To keep the marketplace safe: content checks, Reports, Blocks, and Suspensions.
To send Notifications and Reminders you can control in Settings, and a few messages you cannot turn off because the service needs them: the email that confirms your address, the text with your verification code, the link for a privacy request, an email with the reason if your account is suspended or its sign-in is blocked, and a warning before we delete an account nobody has signed in to for three years.
To answer your Feedback and support requests.
To keep Renthings secure and working, with bot checks, error reports, and logs, and to see which pages are used.
To keep the records the law requires, to resolve Disputes and claims, and to respond to lawful requests from authorities.

We collect and use your data with the consent you give when you sign up, or where the PDPA treats you as consenting, for example when a provider below needs it to give you the service you asked for. We also rely on the PDPA's legitimate interests exception, having assessed in writing that the benefit outweighs any adverse effect on you, to keep the marketplace safe (content checks, Reports, Suspensions, and the fingerprints in section 6), to protect Renthings from bots, fraud, and misuse (bot checks, rate limits, and security logs), and to keep Messages visible to the other members of a Conversation after you delete your account, for the time section 6 shows. You can ask our Data Protection Officer about any of this.

We do not sell your personal data, and we do not use it to send you marketing.

3. Automated decisions

Listings, photos, Messages, and Reviews are checked by an automated system, using an AI model from Anthropic, against our Content Policy before other members see them. It receives the content being checked, never your name, email address, or other account details, although what you write can itself contain personal data. It can let the content through, hold it for an Operator, or stop it: a Listing is not published and you are told which rule it broke, and a Message or Review is not delivered. Some content is then reviewed by our Operators. The automated system never suspends an account; only an Operator can, apart from the one case below.

An account is suspended automatically when it signs up, signs in, or verifies a number with the email address, mobile number, or Google account of a member who deleted their account while suspended. Section 6 explains what we keep to do this.

You can ask us to review any of these decisions by writing to support@renthings.sg, and an Operator will look again.

4. Who we share it with

Other members. They see your display name, your Listings, Reviews about you, and the Messages you send them.
Stripe, our payment provider, for payments, Deposit Holds, refunds, and Payouts. If you set up a Payout account, we give Stripe your sign-in email address, and Stripe verifies your identity. When you provide personal data in connection with a payment or a Payout account, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy, including to prevent fraud.
Supabase, which runs our database, sign-in, and photo storage.
Vercel, which hosts our application and runs our page analytics.
Twilio, through Supabase, which receives your mobile number to text you a verification code.
Resend, which sends our emails, and the push notification services of your browser or device.
Cloudflare, whose Turnstile check uses technical data from your browser (such as its IP address and user agent) to tell people from bots on our sign-in, sign-up, Feedback, and privacy request forms. Cloudflare also uses that data to improve its bot detection, as its Turnstile Privacy Addendum explains.
Sentry, which receives technical reports when something in the app goes wrong. We have set Sentry not to store IP addresses.
Anthropic, our AI provider for content checks. It receives only the content being checked, never your name, email address, or other account details, and it does not use it to train its models.
Google, if you choose to sign in with Google.
Authorities, when the law requires it.
An organisation that takes over Renthings, if that ever happens, which must then protect your data as this policy says.

5. Where your data is processed

Our application runs in Singapore, and so do our database, sign-in, and photo storage. Some of our providers store or process data in other countries:

in the United States: Resend, Twilio, Sentry, and Anthropic, which may also process content checks in Europe, Asia, or Australia;
in Singapore and other countries, including the United States: Stripe, Vercel (for its logs and analytics), and Supabase (for support, and possibly some logs and backups);
on their networks around the world: Cloudflare, Google, and the push notification services.

Before data goes to a provider outside Singapore, we make sure that provider is bound, by its data processing terms with us, by law, or by a certification the PDPA recognises (such as the Global Cross-Border Privacy Rules), to protect it to a standard at least comparable to the PDPA. A transfer that is needed to give you the service you asked for, such as processing your payment, is also allowed by the PDPA on that basis. You can ask our Data Protection Officer for a summary of the protections each provider gives.

6. How long we keep it

Account data: until you delete your account, or until we delete it because nobody has signed in to it for three years. Before we do, we email you, and we wait 30 days: signing in once in that time keeps your account. We never delete an account this way while a Rental, a payment, or a Payout of yours is unfinished, and we delete it exactly as if you had deleted it yourself.
Messages: a Conversation about a Rental is kept with that Rental's records, below, and any other Conversation is deleted two years after its last Message. Until then, Messages stay visible to the members you exchanged them with, shown under "Deleted member" once you delete your account, because they are also those members' record of the Conversation. We keep a Conversation longer while a Report about it or about either of you is open, or while either of you is suspended.
Reviews: the same, until the record of the Rental they are about is deleted.
Rental and payment records: until the end of the sixth calendar year after the year of the Rental's last activity, such as its last payment, refund, Payout, or Dispute decision, even after you delete your account. Singapore tax law requires us to keep business records for five years from the Year of Assessment they belong to, which can end in that sixth year, and a claim about a Rental can be brought up to six years after it arises. A Rental with a Dispute or money still to settle is kept until that is done. The Conversation about a Rental is deleted with its records, unless it has had Messages in the last two years. Stripe keeps its own records of payments and Payout accounts for as long as the law requires it to.
Content check and Report records, and our Operators' decisions on them: one year after the last decision, or for as long as a Report is open or the member it concerns is suspended. Anthropic deletes what it checks within 30 days; if its own safety systems flag something as breaking its usage policy, it can keep that content for up to two years, and its safety scores for up to seven.
Feedback: until you delete your account, or, if you sent it without an account, one year after we last handle it.
A sign-up whose email address is never confirmed: deleted after 30 days.
Records of privacy requests: ninety days after the emailed link is used or stops working.
Technical logs: ninety days. The network address and browser of a signed-in device are kept while you use it, and removed after ninety days without use.

When you delete your account, we:

replace your name with "Deleted member" and your email address with an address that reaches no one;
release your mobile number and remove the link to your Google account, so they can be used again on a new account;
delete Listings that were never rented and their photos, and hide the ones that were;
delete your Notifications, Blocks, Feedback, and push notification devices, and turn off email and push notifications;
sign you out on every device and close your Payout account at Stripe, if you have one.

We keep the records listed above for the time shown, because we need them for accounting, to resolve Disputes, or to meet the law.

If your account was suspended when you deleted it, we also keep a fingerprint of your email address, verified mobile number, and Google account. A fingerprint is a code made from each of them with a secret key. It cannot be turned straight back into your details, but it is still personal data, because with the key we can tell whether a new account uses one of them. We use it only for that: to suspend a new account that uses any of them, so that deleting an account is not a way around a Suspension. We delete it five years after the account was deleted. If the same person keeps coming back, an Operator can renew it, which keeps it for five years from that day. An Operator can also clear it at any time, which lets that person back in.

7. How we protect it

Connections to Renthings are encrypted, our database limits who may read and change each table, passwords are stored only as one-way hashes, and card and bank details stay with Stripe.

If a data breach happens, we will notify the Personal Data Protection Commission whenever the PDPA requires it, no later than three calendar days after we assess that it must be notified. If the breach is likely to cause you significant harm, we will also tell you, unless the law says we must not.

8. Your rights

You can see and download your data from Settings (Export my data), including while your account is suspended. You can also ask our Data Protection Officer for your data, and for how it has been used or disclosed in the past year, and ask us to correct anything that is wrong.

If you cannot log in, for example because sign-in to your account is blocked, you can still get your data or delete your account. Go to renthings.sg/privacy-request and enter the email address of your account. We email a link to that address; it works once, for 30 minutes, and nothing happens until you open it. You can also make either request by writing to our Data Protection Officer from the email address of your account.

You can withdraw your consent at any time. To stop optional uses, turn off email or push Notifications in Settings. To withdraw it for everything, delete your account, or write to our Data Protection Officer, and we will act on it within ten business days. We cannot run your account without the data it needs, so withdrawing consent for that means deleting the account, and we still keep the records section 6 lists, for the time it shows.

We answer access and correction requests within 30 days, and if we need longer, we tell you within that time when to expect an answer. We do not charge for them. If you are unhappy with how we have handled your data, write to our Data Protection Officer, who will look into it and reply. You can also complain to the Personal Data Protection Commission.

9. Cookies

We use only the cookies needed to keep you logged in and to keep the site secure: our sign-in cookies, and a short-lived cookie that carries a privacy request link from your email to the page where you confirm it. Your choice of light or dark theme is kept in your browser's local storage.

Cloudflare's Turnstile check, on the forms listed in section 4, may use cookies or local storage that Cloudflare treats as strictly necessary to tell people from bots. On the pages where you pay or place a Deposit Hold, Stripe's payment form uses cookies that Stripe treats as essential, to make the payment work and to prevent fraud. Our page analytics do not use cookies and do not identify you.

10. Children

Renthings is only for people aged 18 or older, and we do not knowingly collect data about anyone younger. If we learn that someone under 18 has an account, we will suspend it and help them, or their parent or guardian, delete it.

11. Changes and contact

We will tell you in the app when this policy changes, and by email if you have email notifications on. If we want to use your data for a new purpose, we will tell you before we do, and ask for your consent where the PDPA requires it. Questions, requests, and complaints about your personal data go to our Data Protection Officer at support@renthings.sg.

Privacy Policy