Effective Date: September 2025

RocketRent Privacy Policy

RocketRent, Inc. (“RocketRent,” “RR,” “we,” “us,” or “our”) provides a platform for landlords and tenants to generate, execute (e‑sign), and manage legally binding real estate documents (including state‑specific forms), communicate, and collect and make rent payments (the “Services”). Where available, the Services may also facilitate identity checks, electronic notarization, and region‑specific hosting options (e.g., U.S. or EU) through vetted third‑party providers. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our websites (including rocketrent.com and subdomains), mobile apps, and related Services, and explains the choices you have.

If you do not agree with this Policy, please do not access or use the Services.

1) Scope & Audience

This Policy applies to: (a) visitors to our websites; (b) users who create an account (landlords, property managers, tenants, and prospective tenants); and (c) representatives of organizations that use RocketRent. Certain features—such as credit/background screening and rent payment processing—are provided by third parties and are subject to their privacy terms as well. See Section 9.

2) Personal Information We Collect

We collect information directly from you, automatically, and from third parties.

A. Information you provide

• Account & profile: name, email, phone, address, profile photo, role (landlord/tenant/manager), company name.

• Identity & verification (where applicable): date of birth, government ID numbers (e.g., SSN/ITIN for screening as permitted by law), selfies/ID images (if we support identity verification), and other documents you upload (pay stubs, bank statements, proof of income, pet/vehicle info, etc.).

• Property & lease: property addresses, unit details, leasing terms, rent amounts, fees, deposits, notices, and documents you generate or upload.

• Applications & screening: application data, rental history, references, authorization and disclosures required by law, and screening results (e.g., credit, eviction, and criminal records) returned by screening providers, where permitted by law.

• Payments: payment instrument details tokenized by our payment processors (e.g., last 4 digits, card type, masked bank account information), transactions, payouts, and chargebacks.

• Communications: messages, maintenance requests, comments, attachments, call recordings/voicemails (if you use features enabling them), and support tickets.

• Preferences: marketing and notification settings, cookie preferences.

• Legal documents & templates: contents of leases, notices, deeds, affidavits and related forms; full legal names; signatures/initials; witness/notary details and seals; property legal descriptions and parcel/APN numbers; dates; and any fields you complete in a form or template.

• E‑signature artifacts: consent records, timestamped event logs, IP addresses, device identifiers, certificate or seal IDs, cryptographic hash values, and other audit‑trail metadata required by applicable e‑signature laws and our providers.

B. Information collected automatically

• Usage & device data: log files, IP address, device identifiers, app version, browser type, operating system, referring/exit pages, clickstream, language, crash/diagnostics.

• Cookies & similar tech: cookies, pixels, SDKs, local storage, and beacons used for authentication, preferences, analytics, and advertising. See Section 8.

• Approximate location derived from IP or device (if permission is granted) to prevent fraud and tailor content.

C. Information from third parties

• Payment processors and open‑banking providers (e.g., card networks, ACH facilitators, bank‑linking services) provide tokenized payment details, account validation status, and fraud signals.

• Screening providers/credit bureaus provide background, credit, eviction, and identity verification results with your authorization and as allowed by law.

• Data enrichment & anti‑fraud partners provide risk scores, device reputation, and signals that help prevent abuse.

• Advertising/analytics partners provide aggregated insights and audience information.

3) How We Use Personal Information

We use information to:

• Provide, maintain, and improve the Services, including payments, screening, leasing tools, and communication features;

• Create and manage accounts; personalize experiences; and provide customer support;

• Authenticate users; detect, investigate, and prevent security incidents and fraud;

• Facilitate rent collection and payouts, resolve disputes, and manage chargebacks;

• Generate, execute (e‑sign), and store leases and other legal real estate documents you request; maintain compliant audit trails for evidentiary purposes;

• Send transactional messages (receipts, reminders, updates) and—with your consent or as permitted by law—marketing communications;

• Debug, analyze usage, and develop new features;

• Comply with legal obligations, law enforcement requests, tax/reporting requirements, and contractual requirements with our service providers;

• Enforce our Terms of Service, acceptable use rules, and other policies.

Aggregated/De‑identified data. We may create aggregated or de‑identified data that no longer identifies individuals and use it for analytics, product improvement, or other lawful purposes. We will not attempt to re‑identify such data except as required to test de‑identification.

4) Legal Bases (EEA/UK only)

If you are in the EEA/UK, our processing is based on: (i) contract (to provide the Services); (ii) legitimate interests (to secure and improve the Services, prevent fraud, and market similar products); (iii) consent (where required, e.g., certain cookies/marketing); and (iv) legal obligations (e.g., financial recordkeeping).

5) Your Choices

• Account settings to access and update profile details and notification preferences.

• Marketing: opt out of promotional emails at any time (unsubscribe link or account settings). You will still receive transactional messages.

• Cookies: manage preferences via our cookie banner or browser settings (core functionality cookies may be required for the Services to work).

• Permissions: you may disable device permissions (e.g., location, contacts) in your device settings; some features may not work.

6) State Privacy Rights (United States)

Residents of certain U.S. states—including California, Colorado, Connecticut, Utah, Virginia, and others as laws expand—may have the right to request: (a) access to, correction of, or deletion of personal information; (b) information about categories of personal information collected, sources, purposes, and recipients; (c) opt out of sales or sharing of personal information for cross‑context behavioral advertising; (d) opt out of profiling/targeted advertising; and (e) appeal a refusal.

How to exercise your rights. Submit a request at rocketrent.com/privacy‑request or email privacy@rocketrent.com. We will verify your identity (and authority, if acting as an agent) and respond within the timeframes required by law. If we deny your request, you may appeal by replying to our decision email or emailing privacy@rocketrent.com with subject line “Privacy Appeal.”

Do Not Sell or Share / Targeted Advertising. RocketRent does not sell personal information for money. We may “share” personal information with advertising/analytics partners for cross‑context behavioral advertising; you may opt out via Do Not Sell or Share My Personal Information at rocketrent.com/do‑not‑sell and by enabling a recognized browser‑level opt‑out signal such as Global Privacy Control (GPC), which we honor where required.

Sensitive personal information. We use sensitive personal information (e.g., SSN used for screening) only for permitted, limited purposes (e.g., to perform tenant screening and prevent fraud) and do not use it to infer characteristics.

7) Rights under the GDPR (EEA/UK)

Where the GDPR applies, you may have the rights to access, correct, delete, restrict, or object to processing, and to data portability. You may also withdraw consent at any time without affecting prior processing. You can contact our EU/UK representatives (if appointed) at privacy@rocketrent.com. You also have the right to complain to your local supervisory authority.

8) Cookies, Analytics & Advertising

We use first‑ and third‑party cookies/SDKs for:

• Essential (authentication, security, fraud prevention);

• Functional (preferences);

• Analytics (product usage, performance);

• Advertising (retargeting and measurement).

Manage preferences through our cookie banner or your browser. Some third parties provide their own opt‑out mechanisms and industry tools (e.g., NAI/DAA). Where required, we will request consent for non‑essential cookies.

9) How We Share Information

We disclose personal information as follows:

• Service providers & processors who perform services on our behalf (hosting, cloud storage, analytics, communications, support, identity verification, screening, payments, mailing, and marketing). These parties are bound by contractual confidentiality and data‑protection obligations.

• Payment processing & banking partners (e.g., Stripe for cards/ACH/payouts; card networks; ACH facilitators; payout providers; and open‑/open‑banking partners) to process subscriptions and rent payments, verify accounts, prevent fraud, and resolve chargebacks. See Stripe’s Privacy Policy: https://stripe.com/privacy.

• E‑signature, e‑notary, and e‑recording vendors to facilitate document execution, identity checks, audit trails, and (where available) electronic notarization and county e‑recordings.

• Screening providers/credit bureaus to obtain background/credit/eviction reports with the applicant’s authorization and as permitted by law.

• Counterparties to a transaction (e.g., a landlord receives an applicant’s information and screening results as part of the application process).

• Compliance & legal: to comply with law, respond to lawful requests, protect our rights, users, or the public, and enforce agreements/policies.

• Business transfers: in connection with mergers, acquisitions, financing, or sale of assets. Successors will be bound by this Policy.

• Aggregated/de‑identified data as described in Section 3.

We do not allow third‑party ad networks to access full payment or screening report contents for advertising purposes.

10) Payments, PCI DSS & Financial Data

RocketRent uses Stripe and other vetted payment partners to collect payments for subscriptions, rent and related fees, security deposits, and to route payouts to landlords/property managers (collectively, “Payments”). We use Stripe as our primary processor and platform (including, where applicable, Stripe Connect for marketplace payouts). Payment credentials are tokenized by Stripe; RocketRent does not store full card numbers or bank account credentials on our servers. Our payment partners maintain PCI DSS compliance. If you choose bank payments (e.g., ACH), Stripe or its banking partners may provide account verification or bank‑linking services and present their own terms and privacy notices. See Stripe’s Privacy Policy: https://stripe.com/privacy.

KYC & compliance for payouts. For landlords/property managers who receive payouts, our payment partners (e.g., Stripe) may require identity verification (e.g., name, date of birth, business information, SSN last 4/EIN, and government ID images) to satisfy Know Your Customer (KYC), Anti‑Money Laundering (AML), and sanctions screening obligations. We receive status updates and limited outputs from these checks.

Tax reporting. Where applicable, we or our payment partners may issue and file required tax forms (e.g., Forms 1099‑K/1099‑MISC) to payees on behalf of landlords/property managers.

Tax reporting. Where applicable, we may use third‑party vendors to issue and file required tax forms (e.g., Forms 1099) to payees on behalf of landlords/property managers.

10A) E‑Signatures, Audit Trails & Regional Hosting

When you use RocketRent to execute documents, we collect and store: (a) document contents; (b) signer names, emails, and phone numbers; (c) signatures/initials, consent records, and (if used) notary seals; and (d) audit‑trail metadata (timestamps, IP addresses, device information, and cryptographic hashes/certificates). We use this data to operate the service, prevent fraud, and maintain evidentiary records.

Regional hosting (US/EU). Where available, RocketRent may allow you to select a hosting region (e.g., U.S. or EU). If you choose an EU region, we will store primary document data in the EU when technically feasible. Cross‑border transfers (e.g., to sub‑processors or for support) will be protected by appropriate safeguards such as Standard Contractual Clauses (SCCs), where required by law.

No legal advice; no privilege. RocketRent is not a law firm and does not provide legal advice. Using the document features or communicating with us does not create an attorney–client relationship and communications are not privileged.

Roles of the parties. For documents a landlord or property manager initiates about tenants/applicants, RocketRent generally acts as a service provider/processor to that business. The landlord/property manager is the business/controller of those data outside of RocketRent.

AI‑assisted drafting (if enabled). If you choose to use any AI drafting tools we offer, we do not use your document contents to train generalized models for other customers unless you expressly opt‑in. Providers we use will be bound by contractual confidentiality and data‑protection terms.

11) Data Retention

We retain personal information for as long as needed to provide the Services; to comply with legal, accounting, and audit obligations; to resolve disputes; and to enforce our agreements. Tenancy and payment records may be retained for at least the period required by applicable law. We may retain cached or backup copies for a limited period.

12) Security

We implement measures designed to protect personal information, including encryption in transit and at rest, access controls, and continuous monitoring and review. No method of transmission or storage is 100% secure; you are responsible for maintaining the secrecy of your credentials and for the information you choose to share through the Services.

13) Children’s Privacy

Our Services are not directed to children, and we do not knowingly collect personal information from individuals under 18. If you believe a child has provided personal information, contact us and we will delete it.

14) International Transfers

We and our service providers may process information in the United States and other countries that may not provide the same level of data protection as your home jurisdiction. When required, we use appropriate safeguards (e.g., standard contractual clauses) for cross‑border transfers. Where personal data are transferred outside of the EEA/UK (for example, to U.S. service providers), we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and data processing agreements, as required.

15) User‑Generated Content & Messaging

Information you share through listings, applications, messages, or legal documents may be visible to intended recipients (e.g., a landlord or tenant). Do not include confidential information unless necessary. You are responsible for the content you submit and must comply with law and our Terms of Service.

16) Links to Third Parties

The Services may link to third‑party sites and services. Their privacy practices are governed by their own policies, not this one.

17) Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by posting the updated Policy and, where required, by additional notice. The “Last updated” date will reflect the effective date.

18) Contact Us

RocketRent, Inc.







Attn: Privacy Team







1712 Pioneer Ave, Suite 500







Cheyenne, WY 82001







Email: privacy@rocketrent.com







Privacy Requests: email privacy@rocketrent.com

If you are in the EEA/UK and wish to contact a data protection representative, email privacy@rocketrent.com.

19) Jurisdiction‑Specific Disclosures

California

• We provide the disclosures and rights described in Section 6.

• The categories of personal information we collect, disclose, and our purposes substantially correspond to those described in Sections 2–3 and 9.

• We do not sell personal information for monetary consideration. We may “share” personal information with advertising partners for cross‑context behavioral advertising; you may opt out at rocketrent.com/do‑not‑sell and via GPC.

Colorado, Connecticut, Utah, Virginia, and other U.S. state laws

• You have the rights described in Section 6, including rights to opt out of targeted advertising and certain profiling. You may appeal a refusal as described above.

Nevada

• We do not sell “covered information” as defined by Nevada law, but Nevada residents may submit sale opt‑out requests at privacy@rocketrent.com.

20) Notices for Screening Reports (U.S.)

When tenant screening is requested, RocketRent will provide required disclosures and obtain any necessary authorizations. Screening reports are provided by third‑party consumer reporting agencies (CRAs). If information in a report is used to take adverse action, the subject will receive required notices, including the CRA’s contact details and instructions for disputing inaccuracies. Do not use screening reports in violation of equal opportunity or fair housing laws.

21) Data Protection Addendum (B2B)

For business customers who require a Data Processing Addendum (DPA), please contact privacy@rocketrent.com. Our DPA includes standard contractual clauses where appropriate and outlines our processor/sub‑processor commitments. A current list of sub‑processors is available upon request at privacy@rocketrent.com; where required, we will give advance notice of material changes.

22) Definitions

• Personal Information: any information that identifies, relates to, describes, or can reasonably be linked to an individual or household.

• Sell: disclosing or making available personal information to a third party for monetary or other valuable consideration, as defined by applicable law.

• Share: disclosing personal information to a third party for cross‑context behavioral advertising.

• Targeted Advertising: displaying ads based on personal information obtained from a consumer’s activities across non‑affiliated websites or applications.

Helpful Links (for your site footer)

• Privacy Policy (this page)

• Terms of Service

• Cookie Preferences

• Do Not Sell or Share My Personal Information