Privacy Notice
This page is maintained by ApproveIn to explain how your data is handled. It is a plain-language draft, not legal advice, and will be replaced by a formal notice reviewed by counsel.
What we collect
Account info (email, password hash), profile details you enter (name, target city, budget, etc.), household composition, uploaded documents supporting your credentials, and activity logs about sharing and access.
How we use it
To operate your Profile, let you share verified information with listing managers you choose, provide notifications and audit trails, secure the service, and comply with legal obligations. We do not sell your data, and we do not use it to train AI models without your explicit request.
Who sees your data
Only you, and the specific parties you approve — for the credential types you select, and for the time window you set. Listing managers must accept the Responsible Use Agreement before contacting applicants and are prohibited from reselling or re-sharing what they see. ApproveIn staff access data only when necessary for support, security, or legal compliance.
Your controls
You can view and edit your Profile, revoke any share instantly, see every access event in Shared Activity, and export your Profile and documents at any time. In Settings → Data & privacy you can delete all of your uploaded documents, or delete your account entirely. Revoking access stops future views immediately; recipients are obligated to delete any local copies.
Retention: 12 months, and sooner on request
Uploaded documents are automatically and permanently deleted 12 months after upload. This is a ceiling, not a target — rental credentials go stale quickly, and you can delete any document, or all of them, at any time without waiting for that window.
Deletion means deletion
When you delete a document, the file itself is removed from storage, not merely hidden from view. When you delete your account, we revoke every outstanding share, remove your uploaded files, profile, household, credentials, and login. We keep a minimal record that a deletion occurred — the date, the type of deletion, and how many items — so the audit trail stays honest. We never keep the file, its name, or its contents. Expired and revoked share links are purged so they can never be replayed.
Security
Your data is stored with row-level access controls so only you and recipients you authorize can read it. Documents are held in a private storage bucket. Magic-link shares require a 6-digit code emailed to the recipient, are single-use, and expire. Two-factor authentication is available to everyone and required for listing manager accounts.
Children
ApproveIn is for adults. Do not create an account or upload documents for anyone under 18 other than as a dependent on your household roster.
Contact and requests
Privacy requests (access, correction, deletion): privacy@approvein.com. Most requests you can complete yourself in Settings → Data & privacy without waiting for us.
Version 2026-09-18 — subject to legal review before general availability.