Privacy Notice

1. Who we are

The RUMA property-management portal (the "Service") is operated by StatGazer LLC, a New York limited liability company. This Privacy Notice explains how we collect, use, and protect information across the Service — the website, the app, workspaces, invitations, subscription billing, and support. Registered address: 418 Broadway, STE R, Albany, NY 12207, USA. Privacy requests: privacy@ruma.rent. Legal notices: legal@ruma.rent.

2. Our roles: controller and processor

RUMA is a two-sided service, so our role depends on the processing activity — we are not "only a controller" or "only a processor":

Where we process Workspace content on a Customer's behalf, the Customer decides what is stored and why, and we act on the Customer's instructions under our Data Processing Addendum, which applies automatically to business Customers whose Customer Data includes personal data.

3. Information we collect

• Account details — your name, email address, optional company name, and (if you upload one) a profile photo.
• Workspace data you enter — properties, leases, tenants you invite, rent obligations and payment records, utility charges, documents, messages, and internal notes.
• Files you upload — lease documents, receipts, and message attachments.
• Security data — a hashed password, optional two-factor (TOTP) settings, and active session records (device/browser label and timestamps).
• Subscription billing data — if you buy a paid plan, our payment processor (Stripe) collects your card details directly; RUMA receives your plan, billing status, subscription period, invoice amounts and dates, and limited card metadata (brand, last four digits, expiry — so you can recognize the card in Settings) — never the full card number.
• Technical data — a session cookie required to keep you signed in, and basic request logs used for security and reliability.

Rent itself is never processed by RUMA: rent payments are recorded on an honor-system basis (a tenant reports a payment and the landlord confirms it), and no rent money, card number, or bank credential passes through the Service.

4. How we use information; legal bases

We use the information to operate the Service: authenticate you, run your workspace, deliver rent reminders and notifications, generate reports and receipts, process your subscription, provide support, keep the Service secure, and comply with law. We do not use your data for advertising, and we do not train machine-learning models on your workspace content.

Where a legal basis is required: we process account and workspace data to perform our contract with you; security, fraud-prevention, and product-integrity processing rests on our legitimate interests; tax and accounting records are kept under legal obligation; and we ask for consent only where it is genuinely needed (it is not the blanket basis for this Notice).

5. Product analytics (announced — not yet active)

RUMA is introducing first-party product analytics to understand how the Service is used — which features help, where sign-up and set-up stall, and whether the product is reliable. As of this version of the Notice, analytics collection is not active: no analytics identifier is set and no analytics events are collected or shared.

When activated, it works like this. Usage events are sent to RUMA itself first — no third-party analytics script runs on RUMA pages and no third-party cookie is set. Events describe actions, never content: they do not include message or document text, uploaded files, names, email addresses, street addresses, precise location, or payment details. Before any analytics processor sees an event, account-level identifiers are replaced with keyed pseudonyms that the processor cannot reverse.

The analytics processor will be PostHog, Inc. (hosted in the United States), announced in advance on the Subprocessors page and engaged only when analytics activates. RUMA is used globally, and analytics is not limited to any one country: collection is enabled region by region only as applicable law permits, and where consent is required it will be obtained before activation in that region.

Retention: raw analytics events are kept at most 12 months at the analytics processor; operational counters at most 90 days; anything kept longer exists only in de-identified, aggregate form.

Your choice, honored from day one: RUMA treats Global Privacy Control (Sec-GPC), the Do Not Track browser signal, and a manual analytics opt-out as one analytics preference. Opting out stops collection, removes the local analytics identifier and stored campaign attribution, and is never overridden or silently reset. Security, fraud-prevention and reliability logging (section 11) is separate from product analytics and continues — it is what keeps accounts safe and the Service running.

Deletion: when you opt out or erase an account, RUMA derives the analytics pseudonyms and carries a deletion obligation through to the analytics processor. Requests and questions: privacy@ruma.rent.

6. Cookies

The Service uses a single essential session cookie to keep you signed in. RUMA pages set no advertising cookies, no cross-site tracking cookies, and no third-party analytics cookies or scripts. First-party product analytics has been announced (see the "Product analytics" section above) and is not yet active; when it activates it will not use third-party cookies and will honor the analytics preference — Global Privacy Control, Do Not Track, or a manual opt-out. Because the only cookie in use today is strictly necessary, there is currently no cookie-consent banner; where an applicable regional rule requires consent for analytics, consent will be asked before analytics is activated there. Details: Cookie Notice.

7. Service providers (subprocessors) & international transfers

Active providers that may receive Service data, providers announced in advance and explicitly marked not yet active, and former providers still listed for deletion or retention verification are shown below:

Active providers process data for their stated functions under the applicable terms; a provider or function marked announced or pending does not process public visitor data for that feature until activation. A row may separately disclose controlled, access-restricted staging verification using synthetic test prompts. A provider marked former receives no new Service data and remains listed while RUMA verifies completion of its contractual deletion or retention period. We do not sell your personal information. The Service is operated from the United States; if you access it from elsewhere, data sent to active providers may be processed in the United States and other countries where they operate. The canonical, always-current list — with data categories, privacy links, and our update-before-adding commitment — lives at Subprocessors.

8. Tenants, invitees & landlord-entered data

A landlord may enter information about a tenant (name, email, lease terms, charges) before that tenant ever signs in. For that data, the landlord decides what is stored and why, and RUMA processes it on the landlord's behalf to operate their workspace.

If you received an invitation: the invitation email names the workspace that invited you and explains that RUMA uses your email address only to deliver and complete the invitation. Invitations are single-use and expire automatically; if you don't accept, the invitation (and its contact data) is pruned and no account is created for you.

If you are a tenant: once you accept an invitation you can see your own lease, balance, documents, and messages directly in the app, and you can delete your RUMA account at any time from Settings. For corrections to records your landlord created (for example a charge you dispute), contact your landlord first — those are their business records. You can always reach us at privacy@ruma.rent about data RUMA itself controls.

9. Data retention & deletion

Your records (obligations, documents, and every report) export to CSV throughout the app, and tenants can download their own statement. Tenants can delete their account and workspace owners can close their workspace from Settings; for other account-removal requests (for example a team member's account), contact us.

Deleting your account does not automatically delete Shared Records lawfully held by the other side of your lease (see the Terms), and some records may be retained where required for legal, tax, or fraud-prevention purposes. Backups are deleted on a rolling schedule rather than instantly.

10. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. RUMA provides CSV export of your records and self-service deletion (tenant accounts and owner workspaces) directly in the app; for any other request, contact us at privacy@ruma.rent — we will verify your identity and respond within the timeframe applicable law requires. You may also lodge a complaint with your local supervisory authority.

California residents: the CCPA/CPRA gives you the right to know what personal information we collect (see section 3), to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of. When first-party product analytics activates, RUMA will honor Global Privacy Control as an analytics opt-out signal everywhere (see section 5). Requests: privacy@ruma.rent.

11. Security

Passwords are hashed, traffic is encrypted in transit, optional two-factor authentication is available, and you can review and revoke active sessions from Settings. We follow least-privilege access, keep audit and security logs, and maintain backups and an incident-response process. No system is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law.

12. RUMA Assistant (provider migration — not publicly active)

Migration status. RUMA Assistant is disabled for public use while RUMA replaces its former model path with Cloudflare Workers AI using a Cloudflare-hosted Qwen model. No public visitor can start an Assistant chat, and no public visitor message is sent to Workers AI, until RUMA completes the privacy, license, safety, and release checks and deliberately enables both server-side activation controls. Controlled, access-restricted staging validation may process synthetic test prompts before public activation. The description below gives advance notice of the processing that will occur after approval.

What it is and your choice. RUMA Assistant is an automated AI product concierge on RUMA's public marketing pages; it is not a human and it does not provide legal, financial, tax, tenant-screening, or fair-housing advice. Before your first message is sent, the chat identifies itself as AI, tells you the conversation will be recorded, links to this Notice, and requires you to select Start chat. Selecting that button is your affirmative consent to the processing described here. You can browse the site without starting a chat.

Please do not share sensitive or private data. Do not enter Social Security or government-ID numbers, payment-card or bank details, passwords, health information, tenant or applicant names, protected characteristics, lease terms, documents, or other confidential records. The Assistant is only for questions about RUMA's product, features, pricing, and getting started. Before model processing, RUMA rejects messages that match selected recognizable identifier, secret, or explicit personal-data disclosure patterns. This automated check is not comprehensive, so do not rely on it to remove or protect information you enter.

Operational measurement outside an active chat. Where RUMA has enabled Assistant operational measurement for a region, RUMA sends narrow first-party operational events to its own Cloudflare Worker and Analytics Engine when the Assistant is available, its launcher is opened, or a desktop teaser is shown or dismissed. If a signup URL is markedref=assistant, RUMA also sends one attributed signup-start event when focus first enters any control inside the signup form; this can occur even if that URL was opened without starting a chat. Marketing-page events contain only the event name, the applicable one of the six approved marketing-page identifiers, and, where applicable, the teaser trigger type; the signup event contains only source=assistant. The event payload and Analytics Engine row contain no prompt, reply, email address, IP address, Assistant session ID, account ID, cookie, or other persistent browser identifier. RUMA uses these counters only to measure availability, the status-to-launcher and Assistant-attributed signup-start funnels, and to operate the teaser safely. Cloudflare Analytics Engine retains these raw counters for up to three months; anything kept longer is de-identified and aggregate. Cloudflare processes them as RUMA's infrastructure provider. This narrow measurement is separate from the site-wide product analytics described in section 5 and does not activate that analytics system. Where applicable law requires consent for these counters, RUMA does not enable them in that region until the required consent has been obtained.

Completed-signup attribution. If you complete registration from a URL markedref=assistant, RUMA stores the closed value assistant as the acquisition source on the new workspace so it can measure completed registrations attributed to this funnel. That workspace field contains no chat transcript or message content and follows the account/workspace retention and deletion rules in section 9.

What we process after you select Start chat. If you start a chat, RUMA processes your messages and the Assistant's responses. If you ask to pass a question to the team, we also process the email address and transcript you choose to send. The service uses a random, opaque session identifier and limited technical and operational metadata, such as timestamps, turn count, model and prompt/knowledge-base versions, request and refusal status, guardrail or error signals, and token, cost, and latency measures. An IP address and Turnstile result may be processed transiently for abuse prevention and rate limiting; the saved transcript is not keyed to a RUMA account or advertising cookie. RUMA uses Cloudflare Turnstile in invisible mode for this abuse-prevention check; Cloudflare's handling of Turnstile signals is described in its Turnstile Privacy Addendum.

Why we process it. We use the narrow operational counters and closed acquisition-source value to measure Assistant availability, launcher use, teaser operation, and the Assistant-attributed signup funnel. After you start a chat, we use the conversation information to answer your questions, maintain context, provide a human follow-up you request, enforce abuse and cost limits, troubleshoot and audit answers, and improve the Assistant's approved knowledge base and safety controls. We do not use Assistant data for advertising or cross-site profiling.

Service providers during controlled verification and after activation. Synthetic messages used during access-restricted staging validation follow the same provider path described here. After public activation, a visitor message will first reach RUMA's Cloudflare Worker, pass through Cloudflare AI Gateway, and be processed by Cloudflare Workers AI. The provider context contains the current visitor message and, for at most five eligible earlier turns, only a server-owned trusted plan/topic marker and the corresponding deterministic RUMA answer. Prior raw visitor messages are never replayed to Workers AI. Cloudflare also receives a keyed, per-session pseudonymous safety identifier for abuse monitoring; it contains no raw IP address, raw Assistant session identifier, or RUMA account identifier. Workers AI will run the Cloudflare-hosted @cf/qwen/qwen3.8-27b model to produce a closed answer plan; the model will not write the text shown to visitors. RUMA's Worker will validate that plan and render approved, repository-owned English or Russian product copy. Cloudflare is the processor for this path and also provides Turnstile, storage, and operational infrastructure. Alibaba's Qwen team is identified only as the model developer and provenance, not as a recipient of Assistant messages: RUMA does not call Alibaba Cloud or Model Studio in this architecture. Cloudflare states that it does not use Workers AI Customer Content to train models or improve Cloudflare or third-party services without explicit consent; RUMA has not provided that consent. If this changes, RUMA will update this Notice and obtain any consent required by applicable law before the change. Before activation, RUMA will verify and record the applicable Cloudflare agreement, Data Processing Addendum, Workers AI data-use terms, model license, and actual account and Gateway settings. RUMA's public list names only direct providers and incorporates Cloudflare's current downstream subprocessor list by reference through Cloudflare's published subprocessor list. If you request and confirm a human handoff after activation, the email and transcript will be delivered to the RUMA team through Resend.

Former provider offboarding. Anthropic, PBC was the former RUMA Assistant API provider. No new Assistant messages are sent to Anthropic. It remains listed on the Subprocessors page while RUMA verifies completion of any contractual deletion or retention period that applies to historical Assistant API data.

Retention and recording controls after activation. RUMA will store each chat turn and D1 handoff record under the opaque session identifier. When a row reaches 90 days, RUMA will exclude it from chat replay, model context, delivery, and every other active read. The next successful daily purge will physically delete the expired row, normally within 24 hours. Backup copies age out on a separate rolling cycle and are not restored into active service after expiry. A handoff copy delivered to support will become support correspondence and be kept only as long as reasonably necessary to answer you and meet legal or security obligations. Before activation, RUMA must verify that AI Gateway payload logging is disabled so the Gateway records operational measures such as tokens, cost, and latency but not message or response bodies. RUMA must also verify the actual fields, retention, and export destinations for Cloudflare Workers invocation logs and disable or disclose any behavior that does not match this Notice before public activation. RUMA will not run session-replay technology over the chat pane. Cloudflare's handling is governed by the agreement, Data Processing Addendum, Workers AI data-use terms, and account settings RUMA confirms before activation. This Notice does not claim zero provider-side retention; Cloudflare's verified handling is separate from RUMA's 90-day transcript period.

Your rights. Depending on where you live, you may ask to access or delete Assistant data. Contact privacy@ruma.rent and include the opaque session identifier shown in the chat, or the handoff email address if you provided one, so we can locate the record. The conversation ID is enough to request irreversible deletion, but access or export requires stronger verification, such as a verified handoff email that matches the record or another approved identity check. Do not send us the transcript as proof. We do not sell Assistant data or share it for cross-context behavioral advertising.

13. Children

The Service is intended for businesses and adults. It is not directed to children, and we do not knowingly collect data from anyone under 18.

14. Changes

We may update this Notice. Each version carries a version number and effective date; material changes will be announced by in-app or email notice before they take effect.

15. Contact

Questions about this Notice or your data: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.