The short version. We collect what we need to run a room-rental platform: who you are, your listing or application, and your payments. We verify identity using your government ID and a selfie, and we delete those images 30 days after verification. We never see your full card or bank numbers. We do not sell your information. We run no advertising trackers on this site; we use one analytics provider, HeyCatch, to see how the site is used. A host reviewing your application never sees your ID or your selfie.
This policy explains how CoRent Trust, a Virginia business trust (“CoRent”, “we”, “us”), 15430 Pouncey Tract Rd, Rockville, VA 23146, collects, uses, discloses and safeguards your information when you use corent.ai, its subdomains, and the CoRent room-rental platform and API.
CoRent is a United States only service. We do not offer it to residents of the EU, UK or Switzerland.
1. Who this covers
Hosts listing rooms, tenants and applicants searching and booking, team members a host invites, and visitors who submit a form without creating an account.
2. What we collect
You give us
- Account: first and last name, email, password (stored only as a bcrypt hash — we never see or store your password), phone number, mailing address.
- Profile: avatar, profession, a short “about”, and, for tenant applicants, narrative fields about your situation.
- Identity documents: a photograph of a government-issued ID, and a selfie. See section 3.
- Listing and tenancy content: property and room details, photos, house rules, lease documents, inspection records, move-in and move-out checklists, maintenance requests, messages you send other users through the platform, and ratings you leave.
- Payment setup: bank or card details go directly to Stripe. We store Stripe’s identifiers for your account, never your full card or bank numbers. If you link a bank account, that connection is made through Plaid, which returns tokens to us, not your banking credentials.
Collected automatically
- The IP address and browser user-agent of your most recent sign-in, sign-in timestamps, and failed-attempt counts, used to lock accounts against password guessing.
- Server logs of API requests.
From other sources
- Google, if you sign in with a Google account: your Google account identifier and the email on it.
3. Identity verification and biometric information — please read
To confirm that the person creating an account is the person on the ID they submitted, we use Face++, operated by Megvii, to compare a selfie you take against the photograph on your government ID. That comparison produces a biometric identifier.
- Purpose: one thing only — confirming your identity so the people on this platform are real. We do not use it for advertising, we do not sell it, and we do not use it to identify you in any other context.
- Retention: the ID image and the selfie are deleted within 30 days of the verification being completed or abandoned. We keep only the result of the comparison and a record that an attempt occurred.
- Access controls: ID images are hidden by default in our own systems, and every access to one by our staff is written to an audit record.
- Who receives it: Megvii (Face++) processes the comparison.
- A host never sees your ID or your selfie.
If you are a resident of Illinois, Texas or Washington, you have additional rights regarding biometric information. Contact us at support@corent.ai and we will honour them.
4. Why we use it
- Providing the service: creating your account, publishing listings, taking applications, confirming bookings, issuing door codes, collecting rent and paying hosts.
- Verifying identity: section 3.
- Safety and fraud prevention: login lockouts, verifying hosts before their listings go live, keeping street addresses private until a booking is confirmed.
- Payments: Stripe and Plaid, the 5% platform fee, wallet balances and payout records.
- Communication: transactional email and text messages about your account, applications and bookings. See our SMS Policy.
- Legal and accounting: tax records, responding to lawful requests, enforcing our Terms.
5. Who we share it with
We do not sell your personal information. We share it with:
- Service providers, each for the purpose named: Stripe (payments and payouts), Plaid (bank linking), Face++/Megvii (identity), Cloudinary (images and files), Amazon Web Services (hosting, storage and email), Mailgun (email), Twilio (text messages), Seam and RemoteLock (door codes), OpenAI (AI features), Google (sign-in and maps), MongoDB Atlas and Amazon RDS (databases), HeyCatch (site usage analytics).
- Other users, only as the service requires. A host reviewing your application sees your name, email, phone, address, avatar, profession, the narrative fields you filled in, and when you joined. A host does not see your government ID or your selfie.
- Tenants and applicants see a host’s listing details. A room’s exact street address is revealed only after a booking is confirmed.
- Law enforcement and legal process, when we are legally required to respond.
- A successor, if the business is sold or merged.
6. Where it is stored
In the United States, in Amazon Web Services’ us-east-1 region, plus the third parties named in section 5, which may process data elsewhere.
7. How long we keep it
| Data | Retention |
|---|
| Government-ID images and selfies | 30 days after verification completes or is abandoned |
| Verification result and attempt record | 3 years |
| Account records | 7 years after account closure (tax and accounting) |
| Payment, wallet and ledger records | 7 years (tax and accounting) |
| Lease, inspection, move-in/out and tenancy records | 7 years after the tenancy ends |
| Messages between users | 3 years |
| Server and access logs | 90 days |
| Marketing lists | Until you unsubscribe, then 30 days |
We may keep records longer where a law, a tax obligation, or an active dispute requires it.
8. Cookies, analytics and advertising
Analytics. We use HeyCatch as our site usage analytics provider. On corent.ai it records the pages you visit, the links and buttons you click, how you move between pages, and basic device and browser information, so we can see which pages help people and which need work. HeyCatch may set a cookie or use browser storage to recognise a returning browser. We do not use it for advertising and we do not sell this information.
Advertising. CoRent runs no advertising pixels on its public pages. Beyond analytics, we use only the cookies necessary to keep you signed in and to keep the site secure. We will update this section before any advertising technology is added, and we will add a consent notice where the law requires one.
9. Email and text messages
We send transactional messages about your account and bookings because you have an account with us. Marketing email includes an unsubscribe link and our postal address. Text messaging, including how to stop it, is covered in our SMS Policy.
10. Security — what we actually do
- Passwords are stored as bcrypt hashes. We cannot read them.
- Sessions use short-lived access tokens with refresh tokens. Deactivating an account invalidates existing sessions.
- Government-ID images are hidden by default in our systems, and every staff access is written to an audit log.
- Street addresses on public listings are masked to an approximate area until a booking is confirmed.
- Traffic to corent.ai is encrypted in transit (HTTPS).
- Real-time chat requires an authenticated session.
We do not claim our systems are impenetrable, and we make no certification claim — we are not SOC 2 certified. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.
11. Your choices and rights
- Access and correction: view and edit your profile in your account, or write to us.
- Deletion: ask us and we will delete your account and associated personal data, except records we must keep for tax, accounting or legal reasons, or that belong to a completed tenancy involving another party.
- Marketing opt-out: unsubscribe link in every marketing email; reply STOP to marketing texts.
- Virginia residents (VCDPA): you may confirm whether we process your personal data and access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, or profiling with legal effects. We do not sell personal data and do not conduct targeted advertising. You may appeal a refused request by writing to support@corent.ai.
- California residents (CCPA/CPRA): you have rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined. A government ID and biometric information are sensitive personal information, and you may request that we limit their use — we already use them only to verify identity, as described in section 3.
- Other states: if your state grants similar rights, write to us and we will honour them.
We will not discriminate against you for exercising any of these rights.
12. Children
CoRent is not for anyone under 18, and we do not knowingly collect information from children. If you believe a minor has created an account, contact us and we will remove it.
13. Changes to this policy
We will post changes here and update the “Last updated” date. For material changes we will give notice through the Services.
14. Contact
CoRent Trust, a Virginia business trust
15430 Pouncey Tract Rd, Rockville, VA 23146
Email: support@corent.ai
Phone: +1 (774) 426-7368
