Privacy Notice

1. Who we are

The RUMA property-management portal (the "Service") is operated by StatGazer LLC, a New York limited liability company. This Privacy Notice explains how we collect, use, and protect information across the Service — the website, the app, workspaces, invitations, subscription billing, and support. Registered address: 418 Broadway, STE R, Albany, NY 12207, USA. Privacy requests: privacy@ruma.rent. Legal notices: legal@ruma.rent.

2. Our roles: controller and processor

RUMA is a two-sided service, so our role depends on the processing activity — we are not "only a controller" or "only a processor":

Where we process Workspace content on a Customer's behalf, the Customer decides what is stored and why, and we act on the Customer's instructions under our Data Processing Addendum, which applies automatically to business Customers whose Customer Data includes personal data.

3. Information we collect

• Account details — your name, email address, optional company name, and (if you upload one) a profile photo.
• Workspace data you enter — properties, leases, tenants you invite, rent obligations and payment records, utility charges, documents, messages, and internal notes.
• Files you upload — lease documents, receipts, and message attachments.
• Security data — a hashed password, optional two-factor (TOTP) settings, and active session records (device/browser label and timestamps).
• Subscription billing data — if you buy a paid plan, our payment processor (Stripe) collects your card details directly; RUMA receives your plan, billing status, subscription period, invoice amounts and dates, and limited card metadata (brand, last four digits, expiry — so you can recognize the card in Settings) — never the full card number.
• Technical data — a session cookie required to keep you signed in, and basic request logs used for security and reliability.

Rent itself is never processed by RUMA: rent payments are recorded on an honor-system basis (a tenant reports a payment and the landlord confirms it), and no rent money, card number, or bank credential passes through the Service.

4. How we use information; legal bases

We use the information to operate the Service: authenticate you, run your workspace, deliver rent reminders and notifications, generate reports and receipts, process your subscription, provide support, keep the Service secure, and comply with law. We do not use your data for advertising, and we do not train machine-learning models on your workspace content.

Where a legal basis is required: we process account and workspace data to perform our contract with you; security, fraud-prevention, and product-integrity processing rests on our legitimate interests; tax and accounting records are kept under legal obligation; and we ask for consent only where it is genuinely needed (it is not the blanket basis for this Notice).

5. Cookies

The Service uses a single essential session cookie to keep you signed in. We do not use advertising, analytics, or cross-site tracking cookies, and the Service contains no third-party trackers. Because the only cookie is strictly necessary, there is no cookie-consent banner to click through — there is nothing to opt out of.

6. Service providers (subprocessors) & international transfers

We share information only with the processors that make the Service work:

These providers process data on our behalf under their own terms and are not permitted to use it for their own purposes. We do not sell your personal information. The Service is operated from the United States; if you access it from elsewhere, your data may be processed in the United States and other countries where these providers operate. The canonical, always-current list — with data categories, privacy links, and our update-before-adding commitment — lives at Subprocessors.

7. Tenants, invitees & landlord-entered data

A landlord may enter information about a tenant (name, email, lease terms, charges) before that tenant ever signs in. For that data, the landlord decides what is stored and why, and RUMA processes it on the landlord's behalf to operate their workspace.

If you received an invitation: the invitation email names the workspace that invited you and explains that RUMA uses your email address only to deliver and complete the invitation. Invitations are single-use and expire automatically; if you don't accept, the invitation (and its contact data) is pruned and no account is created for you.

If you are a tenant: once you accept an invitation you can see your own lease, balance, documents, and messages directly in the app, and you can delete your RUMA account at any time from Settings. For corrections to records your landlord created (for example a charge you dispute), contact your landlord first — those are their business records. You can always reach us at privacy@ruma.rent about data RUMA itself controls.

8. Data retention & deletion

Your records (obligations, documents, and every report) export to CSV throughout the app, and tenants can download their own statement. Tenants can delete their account and workspace owners can close their workspace from Settings; for other account-removal requests (for example a team member's account), contact us.

Deleting your account does not automatically delete Shared Records lawfully held by the other side of your lease (see the Terms), and some records may be retained where required for legal, tax, or fraud-prevention purposes. Backups are deleted on a rolling schedule rather than instantly.

9. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. RUMA provides CSV export of your records and self-service deletion (tenant accounts and owner workspaces) directly in the app; for any other request, contact us at privacy@ruma.rent — we will verify your identity and respond within the timeframe applicable law requires. You may also lodge a complaint with your local supervisory authority.

California residents: the CCPA/CPRA gives you the right to know what personal information we collect (see section 3), to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. Requests: privacy@ruma.rent.

10. Security

Passwords are hashed, traffic is encrypted in transit, optional two-factor authentication is available, and you can review and revoke active sessions from Settings. We follow least-privilege access, keep audit and security logs, and maintain backups and an incident-response process. No system is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law.

11. Children

The Service is intended for businesses and adults. It is not directed to children, and we do not knowingly collect data from anyone under 18.

12. Changes

We may update this Notice. Each version carries a version number and effective date; material changes will be announced by in-app or email notice before they take effect.

13. Contact

Questions about this Notice or your data: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.