Privacy Policy

1. Who we are

LeasyCo (“LeasyCo,” “we,” “us,” or “our”) operates the platform at leasyco.com and related subdomains. LeasyCo is an AI-native roommate/team formation and rental lead platform that connects renters with compatible teammates and helps licensed real estate agents discover consent-based rental leads.

Questions about this policy? Contact us at privacy@leasyco.com.

2. What data we collect

2.1 Account data

When you register, we collect your email address, hashed password (we never store plaintext passwords), display name, and role (renter or agent). Agents additionally provide license state, license number, and brokerage information for verification.

2.2 Profile and post data

Renters may optionally provide housing preferences, budget range, move timeline, school affiliation, commute targets, and a short bio. This data is used to generate AI-assisted profile and post text and to make recommendations. Profile and post fields are shown to other platform users only to the extent permitted by LeasyCo’s privacy tiers (preview vs. unlocked).

Contact information (phone, email, exact address, social links) is never exposed publicly. It is only shared with a specific licensed agent after that agent pays for an unlock and the renter has given explicit consent to have their contact info included in their profile.

2.3 Usage and analytics data

We collect page views, feature interactions (e.g., post views, team joins, lead searches), session drop-off signals, and optional structured feedback you submit. This data is used to improve the product and is not sold to third parties.

2.4 Payment data

Payment card information is processed directly by Stripe. LeasyCo does not store card numbers, CVVs, or full card data. We store Stripe payment intent IDs and lead unlock records to track what has been purchased.

2.5 AI interaction data

When you use AI features (profile builder, listing builder, team readiness), your input text is sent to our AI provider gateway and processed to generate suggestions. We do not store raw prompts beyond what is required to generate and cache the response. AI-generated content is always presented to you for review before it is published.

When you connect your LeasyCo account to a third-party AI interface (such as a Custom GPT or ChatGPT App), we store the OAuth token and the scopes you authorized. The queries you send to those AI interfaces are governed by the respective AI provider’s privacy policy (e.g., OpenAI Privacy Policy).

2.6 Uploaded files

Profile and post images are uploaded to cloud object storage (Cloudflare R2). We validate MIME type and size before storing. Uploaded files are associated with your account and can be deleted when you delete your account.

2.7 Cookies and local storage

We use an HTTP-only JWT cookie for authentication. We do not use third-party tracking or advertising cookies. Analytics events are first-party and stored in LeasyCo’s own database.

3. How we use your data

• To create and manage your account and provide the platform service.
• To generate AI-assisted profile, post, and team text for your review.
• To make roommate team and rental post recommendations based on your preferences.
• To allow licensed agents to discover anonymized/privacy-gated lead previews, and to deliver contact information only after a paid unlock and your consent.
• To send transactional emails (email verification, receipts).
• To detect fraud, enforce fair-housing compliance, and protect platform integrity.
• To measure product usage and improve the platform.

We do not sell your personal data to third parties. We do not use your data for advertising targeting. We do not use your data to generate tenant approval scores, creditworthiness assessments, or any label that could constitute illegal housing discrimination.

4. Data sharing and third parties

All third-party providers are contractually prohibited from using your data for any purpose other than providing their services to LeasyCo.

5. Data retention

• Account data: retained until you delete your account. After deletion, your personal data is purged within 30 days.
• Lead unlock records: retained for 7 years for billing and compliance purposes (contact information is retained in unlock records as it was at unlock time).
• OAuth tokens: retained until revoked or expired (tokens expire after 30 days). You can revoke tokens at any time in your account settings.
• Usage analytics: retained for up to 24 months, then aggregated or deleted.
• Uploaded files: retained until you delete your account or remove the associated post/profile.

6. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data in your profile at any time.
• Delete your account and associated personal data. Email privacy@leasyco.com with the subject “Delete my account” and we will process your request within 30 days.
• Revoke AI/ChatGPT integration access by revoking the OAuth token in your LeasyCo account settings, or by emailing privacy@leasyco.com.
• Opt out of analytics by emailing privacy@leasyco.com.
• Withdraw consent for contact info sharing at any time by updating your privacy settings in your LeasyCo profile.

7. Security

Passwords are hashed with bcrypt and never stored in plaintext. API authentication uses JWT with server-side validation and expiry enforcement. All API inputs are validated before reaching the database. File uploads are validated for MIME type and size. Stripe webhooks are signature-verified. LeasyCo OAuth tokens are hashed with SHA-256 before storage.

No data transmission or storage system is 100% secure. If you believe your account has been compromised, contact privacy@leasyco.com immediately.

8. AI integrations (Custom GPT and ChatGPT App)

LeasyCo offers optional integration with ChatGPT via a Custom GPT and, in the future, a native ChatGPT App. When you connect LeasyCo to ChatGPT:

• You authorize specific scopes (e.g., reading lead previews, writing lead preferences). LeasyCo enforces these scopes server-side.
• Your ChatGPT queries and the content of tool responses are processed by OpenAI under OpenAI’s Privacy Policy. LeasyCo does not control how OpenAI handles query content.
• LeasyCo returns only privacy-gated data through ChatGPT tools. Contact information, exact addresses, social links, and internal-only fields are never included in tool responses.
• Write actions (saving leads, sending join requests) require explicit confirmation before execution. Unlock checkout requires payment confirmation and is completed on LeasyCo.com, not inside ChatGPT.
• You can revoke ChatGPT access at any time from your LeasyCo account settings or by emailing privacy@leasyco.com.

9. Children’s privacy

LeasyCo is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, contact privacy@leasyco.com and we will delete the account.

10. Changes to this policy

We may update this policy as the platform evolves. Material changes will be communicated by email to registered users and by a notice on the platform. The “Last updated” date at the top of this page reflects the most recent version.

11. Contact

Privacy questions, deletion requests, and data-access requests:

privacy@leasyco.com