Privacy Policy

This policy applies to renters who create a Gravadee account and to anyone who views a rental application shared with them through a Gravadee link or document. Gravadee is the business responsible for the personal information described here.

• Information you enter. Your name, contact details, declared state of residence, rental history, household details, and the answers you give in the questionnaire. We collect only what you type — we do not buy renter data or infer answers from third-party sources.
• Verification outcomes. When you choose to verify identity or income, we store the result (for example, “identity verified,” the verification date, the verifying provider, and a reference number) and an income band — not the underlying documents.
• Sharing records. Recipient name and company you enter, the links you create, when they were created, and when they expire or are revoked.
• Account and technical data. Login credentials handled by our authentication provider, and ordinary security and reliability logs.

• Credit reports. Gravadee never obtains, displays, stores, or shares your credit report. If a landlord requires one, we simply point you to the bureaus and to AnnualCreditReport.com; the report goes from you to them, never through us.
• Exact income figures. We derive an income band and discard the exact amount. If you authorize it, an exact figure can be fetched live from your bank connection at the moment a landlord views your application, rather than being stored by us.
• Identity document images. Photos of government IDs and selfies are handled by the verification provider. We keep the outcome, not the images.
• Bank credentials. We never see your bank username or password. Bank connections are read-only and held as provider tokens.

We use your information to build and display your rental application, to run the verifications you request, to create and expire the links you share, to keep accounts secure, and to comply with law. We do not use your information for advertising, we do not sell or share it for cross-context behavioral advertising, and we do not use it to train AI models.

A small number of vetted providers process data on our behalf under contract:

• Plaid — read-only bank connections for income and residency signals.
• Stripe — identity verification and payment processing.
• Cloud hosting and database — storage of your account and application data, encrypted in transit and at rest.

These companies keep their own records under their own terms. When you delete your Gravadee account we revoke our access where revocation is supported and request deletion where deletion is supported, but we do not claim to delete records we do not control.

Nothing is shared unless you initiate it. You choose the recipient and the delivery method (email, text, print, or a link). Share links expire automatically after 90 days and can be revoked earlier from your account. Once a link is revoked or expired, the recipient can no longer view your application through it.

We keep your information while your account is active. You can edit or remove information at any time. Deleting your account is immediate and irreversible: we remove the account information we retain, revoke connected bank access, and end your session.

We keep one minimal, anonymous ledger entry recording that an account existed and was deleted, along with a receipt number in the form GD-XXXX-XXXX. That entry contains no name, email, or application content and exists only to prove compliance with deletion obligations. It is never used to recreate your profile, evaluate you, or market to you.

Depending on where you live — including under the California Consumer Privacy Act as amended — you have the right to know what personal information we hold, to access or receive a copy of it, to correct it, to delete it, to opt out of sale or sharing (we do neither), and to be free from retaliation for exercising these rights. Most of these rights are exercised directly in the product: your application is visible and editable in your account, and deletion is available on this page. You may also contact us and we will respond within the timeframe the law requires.

You may designate an authorized agent to make a request on your behalf. We may need to verify your identity before acting on a request.

Data is encrypted in transit and at rest. Access to renter records is restricted at the database level so that each account can reach only its own data. Administrative access is limited and logged. No system is perfectly secure, but we design for the smallest possible amount of sensitive data at rest.

Gravadee is intended for adults renting housing. We do not knowingly collect personal information from anyone under 16. If we learn we have, we delete it.

If we make a material change, we will update the date at the top of this policy and, where appropriate, notify you in the product. Continued use after an update means the updated policy applies.

Questions, requests, or complaints: hello@gravadee.com.