Privacy policy
Last updated 24 August 2026.
We collect as little as we can and still do the job.
- No advertising, and nothing that follows you to any other website. We do count page views and measure how fast pages load, with tools that set no cookie and cannot recognise you anywhere else — described in full below.
- We never see your card number, your passport or your bank details. Those go to Stripe, on Stripe's own pages. We could not show them to anyone if we wanted to, because we have never had them.
- We do not sell anything about you to anybody. There is no version of this business where that changes.
- Everything else we hold is either something you typed in, or a record we are obliged to keep in order to prove a payment happened.
The rest of this page is the detail behind those four lines.
Who is responsible
Controller: No Rent Scam and postal address same as Impressum
Email: support@norentscam.com
What we hold, and where it came from
If you have an account
| What | Where it came from |
|---|---|
| Your email address | You, when you signed in. There is no password, so the address is the account. |
| Your name, if you gave one | You |
| Which deals you are a party to | Created as you use the service |
If you are paying — the tenant
| What | Where it came from |
|---|---|
| The amount, the move-in date, and the cancellation terms you wrote | You, on the create-deal form |
| The other party's email address | You |
| A record that you confirmed the refund terms, and that you had saved your own copy of the advert, each with the time you did it | Your own ticks on the form |
| A payment reference, and the fee the card networks charged | Stripe, after you paid |
Your card details are not on this list and never will be. The payment page is Stripe's, not ours.
If you are being paid — the landlord or agent
| What | Where it came from |
|---|---|
| Your email address | The invitation, or your own account |
| An identifier for your Stripe account, and whether Stripe passed you | Stripe |
Your identity documents and your bank details are not on this list. Stripe asks for them, on Stripe's pages, and tells us one thing: whether you passed.
If you report a problem
What you picked from the list and what you wrote in your own words, so that a person can work out what to do. It is not shown to the other party.
If a move-in date changes
Both dates, who asked, when, and any reason given. We keep these even when a request is declined, because "who asked to move it, and when" is the first question in any later argument about a date.
The emails we have sent you
Which email, to which address, when, and our provider's reference for it. This is how we can answer "I never received that" with a record rather than an opinion.
If you appear in a testimonial
Your name, whatever title you gave, your photograph and your words. All of it because you gave it to us for that, and all of it removable whenever you say so.
Why, and on what legal basis
| What for | Basis under Article 6 GDPR |
|---|---|
| Running the deal you signed up to | 6(1)(b) — performing a contract |
| Sending the emails the service is made of | 6(1)(b) |
| Keeping accounting and payment records | 6(1)(c) — a legal obligation |
| Preventing fraud, and keeping the site standing up | 6(1)(f) — our legitimate interests |
| Counting page views and measuring page speed, as described below | 6(1)(f) — our legitimate interests |
| Publishing a testimonial | 6(1)(a) — your consent, which you can withdraw |
Who else sees it
We use a small number of companies to run this. Each one gets only what it needs to do its part.
| Who | What for | Where |
|---|---|---|
| Supabase | The database, and signing you in | EU (Frankfurt) |
| Stripe | Taking the payment, verifying the recipient, paying them out | EU and United States |
| Resend | Sending you the emails this service depends on | EU (Ireland) |
| Vercel | Hosting the website, counting page views, and measuring page speed | EU (Frankfurt) |
| Hostinger | The domain, and the support@ mailbox a person reads | EU (Frankfurt) |
Stripe is not only working for us. For identity checks and anti-money-laundering it decides for itself what it needs and is responsible for that in its own right. What it does with your documents is governed by its privacy policy at stripe.com/privacy, not by this one.
We do not sell, rent or trade any of this, and nobody outside that table receives it unless the law requires it of us.
Data leaving the EU
Some of the companies above are American. Where your data reaches them, the transfer relies on the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.
How long we keep it
| What | How long |
|---|---|
| Deal and payment records | Ten years, under §147 AO |
| The log of emails sent about a deal | The same, since it is part of that record |
| Your account | Until you ask us to close it, less anything we are obliged to keep |
| What you wrote when reporting a problem | Until it is resolved, and then for the same period as the deal record |
| A testimonial | Until you withdraw your consent |
Where we are obliged to keep a record of a payment, we keep the record and not the rest.
Cookies
One, and it is the one that keeps you signed in. It is set when you use a sign-in link and it is strictly necessary — without it, clicking that link would not sign you in.
There are no advertising cookies and no cookies that follow you to other sites. The two measurement tools described in the next section set no cookie at all and store nothing on your device.
Counting page views, and how fast they load
We use two measurement tools, both from Vercel, who also host this site. We would rather tell you exactly what they do than write "we use analytics" and leave you to assume the worst.
Vercel Web Analytics counts page views. For each one it records the page address, the page you came from, the time, your country, region and city worked out from your connection, and your device type, operating system and browser with their versions.
Vercel Speed Insights measures how quickly a page appeared and became usable on your device. Alongside the address and the timing figures it records your country as a two-letter code, your network speed, and your device, operating system and browser. It also notes which part of the page was the slow one — as a position in the layout, never as anything you typed.
Neither of them:
- sets a cookie, or stores anything at all on your device;
- follows you to any other website, because there is no identifier that works anywhere but here;
- ever sees your name, your email address, or anything you have typed.
Visitors are told apart by a value worked out from the request itself, which is discarded after 24 hours. Nobody can be recognised from one day to the next, and we cannot reconstruct any individual person's path through the site.
We strip identifiers out of the address before anything is sent. Some pages here carry a deal reference or an invitation code in the address, and an invitation code is a key that opens a deal. Those are replaced with a placeholder in your browser, before anything leaves it, so what gets recorded is "somebody opened an invitation page" and never which one. Anything else in the address that is not a campaign tag is dropped for the same reason.
Legal basis: our legitimate interest in knowing whether the site works, how people find it, and whether it is fast enough to be usable (Art. 6(1)(f)).
Any ordinary content blocker stops both of them, and nothing on this site behaves differently if you use one.
Decisions about your money are made by people
There is no automated decision-making and no profiling on this site. When a problem is reported, a person reads it and decides. The 48-hour window is a clock, not a judgement.
Your rights
You can ask us to:
- show you what we hold about you (Art. 15);
- correct it if it is wrong (Art. 16);
- delete it, where we are not obliged to keep it (Art. 17);
- restrict what we do with it (Art. 18);
- hand it over in a portable form (Art. 20);
- stop processing based on our legitimate interests (Art. 21);
- withdraw consent you have given, without affecting what we did before you withdrew it (Art. 7(3)).
Write to support@norentscam.com. We answer within one month, and sooner in practice.
You can also complain to a data protection authority — the one where you live or where you work. We would rather you told us first, but it is your right and you do not need our permission.
Children
This service is not for people under 18 and we do not knowingly hold anything about anyone younger.
Changes to this page
If we change how any of this works, we change this page, and the date at the top of it moves. If a change matters to you, we will email you about it rather than rely on your noticing.
Questions about any of this go to support@norentscam.com, and a person answers.