Privacy Policy

4. If you are a renter

What happens to your enquiry. The customer you contacted sees your messages, booking details and answers, and uses them to reply, schedule showings and decide whether to rent to you. Automated replies and scheduling are generated by an AI assistant that uses large-language-model providers to understand and answer your messages; the customer can see and change what it does, and you can always ask for a person.

Identity verification. When a customer requires it, you verify your identity through Persona. In Persona's flow you provide a photo of your government-issued ID and a selfie; Persona creates a facial geometry from them to confirm they match, which is biometric information under some laws, and asks for your consent before doing so. Persona returns to us whether the check passed, the name on your ID, the email and phone you entered, and signals about your connection used to detect fraud (IP address, approximate location, whether the network is masked). We keep the result and those details with your showing record for 24 months. We never receive the images. Persona permanently erases the ID images, the selfie and the facial geometry 12 months after the check, or sooner if you ask us, unless the law or a legal process requires it to keep them; the rest of Persona's handling is described in its own policy at withpersona.com/legal/privacy-policy. If you do not want to verify, ask the customer for another way to view the property.

Access codes. If you book a self-guided showing, we issue a lockbox or smart-lock code through the customer's lockbox provider and record when it was used. The code is personal to you.

Messages from the customer and from us. You receive texts and emails about your enquiry and showings, including automated replies and reminders, within what you asked about. To stop automated texts, reply STOP or tell the customer another way; use the unsubscribe link to stop emails. We and the customer apply your request to the messages it covers within the time the law allows. We never send you marketing.

Pre-qualification questions. Some customers have the assistant ask screening questions before a showing. The assistant records your answers and passes them to the customer. The assistant does not make the rental decision, but automated steps, including the result of an identity check, can affect whether or how a showing is arranged. The customer decides, and must give you a person who can review an adverse result; where the law requires it, a decision made only by automated means comes with an explanation and the chance to have a person review it.

We do not: sell your information; use it to advertise to you; or use your messages to train general-purpose AI models.

Your choices and rights. Because we act for the customer you contacted, send requests to see, correct or delete your information to that customer. If you contact us at info@lethub.co instead, we will pass your request to the customer within 5 business days and help it respond, unless the law requires us to respond ourselves. Section 10 describes the rights that may apply to you.

5. If you are a customer

What we use your information for

• Create and run your account and provide the Service. Information used: identifiers, business information, communications, usage data.
• Bill you, prevent fraud and payment abuse. Information used: identifiers, payment information, usage data.
• Provide support. Information used: identifiers, support messages, usage data.
• Secure the Service, investigate incidents, enforce our Terms. Information used: identifiers, usage data, logs.
• Improve the Service and understand how it is used. Information used: usage data, de-identified statistics.
• Send service notices (billing, renewals, security, changes to terms). Information used: identifiers.
• Send product news and offers, with your consent, which you can withdraw at any time. Information used: identifiers.
• Comply with law and legal process. Information used: any of the above.

We rely on your consent, on the need to perform our contract with you, and on our legitimate interest in running and securing a business, as the law of your jurisdiction provides.

Connected accounts. If you connect a Google or Microsoft account, we access only what the feature you turned on needs: reading leads from the connected inbox, and reading and writing showing events to the calendar. We do not use that access for anything else, and our hosting and AI providers process the connected data only as far as those features need. LetHub's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements; our staff read connected inbox content only where that policy permits.

Property-management systems and other tools. If you connect Yardi, Propertyware, AppFolio, Buildium, Rivair, Zapier or another system, we exchange the data needed for the integration you set up, under that system's terms.

Team members. If you invite colleagues, we collect their name and email from you to send the invitation and run their login.

Marketing emails. We send product news and offers only with the consent the law requires or under an exception it allows; creating an account is not by itself consent to marketing. Every marketing email identifies Grit AI Tech Inc. (LetHub), gives our postal address and includes a working unsubscribe link, and you can also email info@lethub.co to withdraw consent. We honour unsubscribes without delay and in any case within 10 business days, across every provider that sends email for us. Service emails (invoices, renewal notices, security and legal notices) are not marketing and continue while you have an account; if we add promotional content to one, the marketing rules apply to it.

Analytics and support chat inside the app. After you log in we use Mixpanel to understand which features are used and where users run into problems, and Intercom for support chat, which receives your name, email and company so that we know who we are talking to. After you log in, Microsoft Clarity records how you move through the app (pages, clicks, scrolling and mouse movement) so that we can reproduce problems. Clarity runs with its strictest masking, so what you type and the personal information shown on screen are masked. Microsoft may use the data Clarity collects for its own purposes, including to improve Microsoft products and for Microsoft Advertising, as described in the Microsoft Privacy Statement at privacy.microsoft.com/privacystatement. You can opt out of session recording in the app at any time by emailing info@lethub.co, and we stop it for your account within 5 business days. We do not record anything before you log in. Clarity on our public website, which you control from the cookie banner, is described in section 6.

6. If you visit our website

Hosting and logs. Our website runs on Webflow, our application on Amazon Web Services, and uploaded files are stored on DigitalOcean. Web servers record your IP address, browser type, the pages you request and timestamps, which we keep for security and troubleshooting.

Cookies and similar technologies. We use essential cookies and local storage that make the site and app work and remember your cookie choice. Everything else on lethub.co loads only after you accept it in the cookie banner, in three groups you can turn on or off separately: Functional (Intercom support chat), Analytics (Google Analytics, Microsoft Clarity, Mixpanel, and a first-party cookie that records how you first found us), and Marketing (HubSpot and Google Ads conversion tracking, which recognise returning leads and measure our campaigns). Clarity on the website masks all text. You can change your choice at any time from the "Cookie settings" link in the footer. Declining both Analytics and Marketing, or using the "Do Not Sell or Share My Personal Information" link, opts you out of the sale or sharing of personal information and of targeted advertising under California and similar laws, whether or not you have an account.

Global Privacy Control and Do Not Track. We do not sell personal information for money. Because Microsoft may use Clarity data for its own advertising purposes, and because Google Ads and HubSpot measure and follow up on campaigns, California law may treat those tools as "sharing". On the website anyone can opt out at any time through the "Do Not Sell or Share My Personal Information" link in the footer or by declining Analytics and Marketing, and we treat a Global Privacy Control signal from your browser as that opt-out, with no account or verification needed; for Clarity inside the app, email info@lethub.co. We do not respond to Do Not Track signals, which have no agreed meaning.

7. Who we share information with

We do not sell personal information for money. With your permission, the analytics and marketing tools in sections 5 and 6 receive online identifiers and usage information, and Microsoft may use Clarity data for its own advertising purposes; under some privacy laws that counts as "sharing" or targeted advertising, and sections 6 and 10 explain how to opt out. Otherwise we share personal information only as follows.

With the customer you contacted (Renters): the property manager or landlord sees your enquiry, messages, bookings, answers, verification result and access-code use.

With service providers (the list below). Most work only on our instructions, under a contract that requires appropriate security. A few have a role of their own: Microsoft uses Clarity data for its own purposes (sections 5 and 6), Stripe processes payments under its own rules, and an integration you connect handles information under your agreement with it. Being on this list never lets a provider use renter conversations for advertising. The current list:

• Amazon Web Services. Application hosting and database. United States.
• DigitalOcean. Storage of uploaded files and images. United States.
• Persona. Identity verification (ID and selfie comparison, fraud signals). United States.
• Telnyx and Twilio. Text messages and phone numbers. United States.
• SendGrid (Twilio). Email delivery. United States.
• Stripe. Payments. United States.
• OpenAI, Anthropic, Google (Gemini), Groq and OpenRouter. Language models that power the assistant's replies and summaries. United States.
• Google and Microsoft. Inbox and calendar connections you set up. United States.
• Rently and CodeBox. Lockbox and smart-lock codes for self-guided showings. United States.
• Yardi, Propertyware, AppFolio, Buildium, Rivair, Zapier. Property-management and automation integrations you set up. United States.
• Intercom. Support chat and customer messaging. United States.
• HubSpot. Customer relationship management for our sales and onboarding, and website marketing tracking after you accept marketing cookies. United States.
• Mixpanel. Product analytics in the app, and website analytics after you accept analytics cookies. United States.
• Microsoft Clarity. Session recordings and heatmaps on the website after you accept analytics cookies (all text masked), and inside the app for logged-in customers (strictest masking, opt out by email); Microsoft may also use this data for its own purposes, including advertising and improving its products, under the Microsoft Privacy Statement. United States.
• Google (Analytics, Tag Manager, Ads). Website analytics and conversion measurement, after consent. United States.
• Webflow. Website hosting. United States.
• Utter (our own voice product, built on VAPI and the providers listed in the Utter Privacy Policy). Voice calls, if the customer turns them on. United States.

We update this list at least 15 days before adding a provider that processes renter information, and we email customer account owners about the change.

With listing sites. If a customer asks us to syndicate a listing, the listing and the customer's contact details go to the sites the customer chose.

When the law requires it. We disclose information to respond to a subpoena, court order, lawful request from a public authority, or to protect our rights, our users or the public. Where the law allows, we tell the affected customer first.

In a business transfer. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction under this policy; we will tell you before your information becomes subject to a different policy.

With your direction or consent.

8. How long we keep information

• Leads, messages, bookings, pre-qualification answers: the life of the customer's account, then deleted within 90 days of account closure (the customer has 30 days to export first).
• Identity-verification results and fraud signals: 24 months from the check, or 90 days after the customer's account closes if sooner.
• ID images, selfie and facial geometry (held by Persona, never by us): erased by Persona 12 months after the check.
• Access codes and usage records: 24 months from the showing, or 90 days after the customer's account closes if sooner.
• Customer account information: the life of the account, then deleted within 90 days of closure.
• Billing and tax records: 7 years, or longer where a specific legal obligation or a documented legal hold requires it.
• Website and app logs: 90 days.
• Support conversations: 3 years.
• Backups: kept apart from everyday use and deleted within 35 days after the live copy is deleted (a record deleted 90 days after closure is gone from backups by day 125); if a backup is ever restored, earlier deletion requests are applied again.

The periods above are maximums for the purposes stated, not a reason to keep every record that long: we delete information sooner when it is no longer reasonably needed, subject to legal minimums, requests we are still handling, and documented legal holds, which cover only the relevant records and end when the reason for them ends. Information that could still identify someone indirectly stays under this policy. We keep information beyond these periods only once it is irreversibly anonymized.

9. How we protect information

We use measures appropriate to the sensitivity of the information, including: encryption in transit (TLS) for web, app and API connections (text messages and phone calls travel over the telephone carriers' networks); encryption at rest provided by our hosting provider; role-based access so that only staff who need it can reach customer data; access logging; and contracts with every sub-processor. Identity-document images and selfies never reach our servers. No system is perfectly secure. If a security incident affects your information we will notify affected customers without undue delay and, where the law requires, regulators and individuals.

10. Your rights

Everyone. You can ask us what personal information we hold about you, ask us to correct it, ask us to delete it, ask for a copy, object to or restrict certain uses, and withdraw consent you gave. We will not treat you differently for exercising your rights. If you are a renter, section 4 explains that we route your request to the customer you dealt with.

How to ask. Email info@lethub.co or write to the address in section 1. We may need to verify who you are, usually by confirming the phone number or email we hold; an opt-out from sale or sharing and a Global Privacy Control signal need no account and no identity check. You may use an authorized agent if they can show your written permission. We acknowledge every request within 10 business days and respond within the time the law sets for that request and place (usually 30 days in Canada and 45 days in California); if we need an extension the law allows, we tell you why and when within that time. If we refuse a request we say why, you can ask us to review the decision, and we tell you how to reach the regulator. If a request method does not work for you, contact us as set out in section 14 and we will help.

Canada. Federal and provincial privacy laws govern how we handle personal information, including the Personal Information Protection and Electronic Documents Act and the private-sector laws of British Columbia, Alberta and Quebec. Our Privacy Officer (section 14) is accountable for our privacy practices: who can access information, how long we keep it, how we assess privacy risks, how we handle incidents and how we answer complaints. Send a complaint to the Privacy Officer; we investigate and reply with the outcome and your options. Information is processed outside Quebec and outside Canada, mainly in the United States, by the providers in section 7, where local authorities may have lawful access to it; we assess those transfers and put contractual safeguards in place. In Quebec you can ask for computerized information you gave us in a structured, commonly used format, or have it sent to another organization where the law provides. You may complain to the Office of the Privacy Commissioner of Canada, your provincial commissioner, or Quebec's Commission d'accès à l'information.

United States. Residents of California and other states with comprehensive privacy laws have the rights above, including the right to know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties it is disclosed to (this policy provides them); the right to delete; the right to correct; the right to opt out of sale and sharing (we do not sell for money; to opt out of sharing and targeted advertising on the website, use the "Do Not Sell or Share My Personal Information" link, decline Analytics and Marketing in Cookie settings, or send a Global Privacy Control signal; for the app, email info@lethub.co); the right to limit use of sensitive personal information (section 3 says what we hold; we use it only to provide the Service, never to infer characteristics about you, and you can ask the Privacy Officer to restrict it further); and the right not to be discriminated against. Which provider receives what depends on the feature: hosting and storage providers hold the records they host; messaging and AI providers receive the identifiers and messages needed to deliver and answer them; Persona receives identity documents and biometric information for the check; lockbox providers receive what they need to issue a code; Stripe receives billing details; Intercom receives account details and support conversations; analytics and marketing providers receive usage and device information; and integrations you connect receive the records needed for that integration. The property manager you contacted receives your enquiry. Section 7 names each provider. In the past 12 months the website shared identifiers and browsing activity with analytics and advertising providers (Microsoft Clarity, Google Analytics and Google Ads, HubSpot, Mixpanel) and with visitor-identification tools (Apollo, Koala, RB2B, Ortto and ActiveCampaign) that we removed in October 2026; under California law this may count as "sharing". Inside the app, usage and device information from logged-in customers went to Microsoft through Clarity as described in section 5. We have not sold personal information for money.

Biometric information (Illinois and similar laws). Persona performs the facial comparison described in section 4. Before it collects anything, Persona's flow shows you the notice and obtains the written consent the law requires. The images and facial geometry are kept for 12 months (section 4); Illinois law in any case requires their destruction within three years of your last interaction with us. We never receive them. You may decline and ask the customer for another way to view the property.

11. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, email info@lethub.co. We delete it unless the law requires us to keep it or we have documented another lawful reason; a customer's instruction alone is not enough. If a child used a part of the Service that needs a parent's consent, we stop processing until we have that consent or delete the information. We never use children's information for advertising. Parents and guardians can contact the Privacy Officer in section 14.

12. Automated decisions and AI

The assistant uses large language models to understand and answer messages and to schedule showings. It answers from the information the customer provided, collects your answers and books appointments. Those automated steps, and the pass or fail result of an identity check that a customer uses to release access for a showing, can affect whether or how a showing happens. Any decision about renting is made by the customer. If a decision that affects you is made only by automated means, you can ask the customer, or us at info@lethub.co, for the information used, the main reasons, a correction and a review by a person; where the law requires it, we and the customer tell you that the decision was automated.

13. Changes to this policy

When we change this policy we update the date at the top. For a material change in how we use personal information we email customers' account owners and post a notice in the app at least 30 days before it takes effect, and where the law requires it we ask for consent again.

14. Contact

Privacy Officer, Grit AI Tech Inc. (LetHub)
722 Cormorant Street, Victoria, British Columbia V8W 1P8, Canada
info@lethub.co

We aim to acknowledge every privacy request within 10 business days.