Privacy Policy
Last updated: September 5, 2026
At Leaseswap, your privacy matters. This Privacy Policy explains how Dabudage LLC ("we," "us," or "our") collects, uses, shares, and protects your information when you use our apartment search and alert service and our rental application packet feature ("Packet").
Our Privacy Commitment
We don't sell your data. We never have and never will sell your personal information to advertisers or data brokers.
No tracking ads. We don't show advertisements or track you across other websites.
You control your data. You can access, export, or delete your data at any time.
Minimal data collection. We only collect what's necessary to provide and improve the service.
1. Information We Collect
Information You Provide
- •Account Information: Email address and, if you choose password sign-in, a password securely managed by our authentication provider
- •Search Queries: Your apartment search queries, including natural language searches and filter selections
- •Alert Preferences: Saved search criteria, notification frequency (instant, daily, weekly), and alert names
- •SMS Alert Information: If you choose SMS delivery, we collect your phone number, SMS consent text and version, consent timestamp, verification status, opt-out status, and SMS delivery metadata.
- •Saved Listings: Listings you bookmark and any personal notes you add
- •Location Preferences: Addresses or locations you search for (e.g., workplace address for commute calculations, points of interest like gyms or grocery stores)
Information Collected Automatically
- •Device Information: Browser type, operating system, device type (mobile/desktop)
- •Usage Data: Pages visited, features used, search patterns, and interaction with listings
- •Log Data: IP address, timestamps, and error logs for security and debugging
Information We Do NOT Collect
- ✕Precise real-time GPS location
- ✕Payment card numbers (paid features are processed by Stripe; your card details never touch our servers)
- ✕Social Security numbers, income documents, or credit information as part of the search and alert service
One important exception: if a licensed real estate agent invites you to complete a rental application packet, we collect the application documents you choose to upload, which can include income and identity documents. Section 2 explains exactly what we collect there, who can see it, and when it is deleted. If you never use the Packet feature, none of that collection applies to you.
2. Rental Application Packets
The Packet feature helps you assemble a rental application when a licensed real estate agent invites you to apply for a specific apartment, whether as the primary applicant, a co-applicant, or a guarantor. Because an apartment application involves sensitive documents, this section describes our practices for Packet data in detail. The Packet Terms govern your use of the feature.
What We Collect
- •Application documents you upload: depending on the requirements the agent sets, these can include a completed application form, government photo ID, pay stubs, employment letters, bank statements, W-2s, tax returns, credit reports, credit check authorization forms, landlord references, and the equivalent documents for a guarantor
- •Application details you provide: your legal name, annual income, employment or income type, and notes you share while assembling your packet
- •Verified phone number: collected with your separate, recorded consent so the agent and our service can reach you about your application
Documents you upload may inherently contain sensitive identifiers such as Social Security numbers or bank account numbers. We never ask for these as standalone fields, and we automatically strip them from any structured data our systems extract from your documents.
AI-Assisted Document Review
- •We use AI to check your documents for completeness, legibility, and consistency, and to help assemble the final packet. This processing runs on Amazon Bedrock (Anthropic Claude models) under a zero data retention configuration: the model provider does not store your documents and does not train on them
- •The AI never evaluates you as a tenant. It performs clerical checks only, and it is designed to refuse questions about your likelihood of approval. Decisions about your application are made by people, not by our software
- •If you upload a credit report, the zero-retention AI check processes only clerical document facts needed to confirm the bureau, your name, the report date, and legibility. We do not extract, store as metadata, summarize, score, or evaluate credit scores, tradelines, balances, or account details
Who Can See Your Packet
- •The agent who invited you can review your documents and the assembled packet
- •The landlord receives the assembled packet when the agent forwards your application
- •Nobody else on your application. Each applicant, co-applicant, and guarantor uploads their own documents through their own private link. A guarantor's files never pass through the applicant, and vice versa
Packet documents are stored in private, access-controlled storage. They are never used for advertising, never sold, and never shared with anyone beyond the agent and landlord your application is addressed to, except as required by law.
How Long We Keep Packet Data
We delete your uploaded documents and the compiled packet 30 days after your application reaches a final state (forwarded, accepted, rejected, withdrawn, or expired), and we purge the personal data our systems extracted from them at the same time. Deleting your account also deletes your packet documents.
3. How We Use Your Information
We use your information to:
Provide the Service
- •Process and display apartment search results based on your queries
- •Calculate commute times and distances to locations you specify
- •Send you email alerts when new listings match your saved searches
- •Send apartment alert text messages if you explicitly opt in to SMS delivery and verify your phone number
- •Store and sync your saved listings and notes across devices
- •Authenticate your account and maintain your session
Improve the Service
- •Analyze usage patterns to improve search quality and features
- •Debug errors and improve platform stability
- •Develop new features based on aggregate user behavior (not individual tracking)
Communicate With You
- •Send alert notifications you've configured
- •Respond to support requests
- •Send important service announcements (security issues, Terms changes)
Protect the Service
- •Detect and prevent fraud, abuse, and security threats
- •Enforce our Terms of Service
- •Comply with legal obligations
4. Search Query Processing
Leaseswap uses AI (large language models) to understand your natural language search queries and convert them into structured filters. When you search:
- •Your query is sent to our AI provider (Groq) to parse search intent
- •Queries are processed in real-time and not stored by the AI provider for training
- •We may retain anonymized query patterns to improve our parsing accuracy
5. Location Data
When you use commute or distance filters, we process location data as follows:
- •Geocoding: We convert addresses you enter into coordinates using OpenStreetMap/Nominatim
- •Commute Calculation: We use the Valhalla routing engine to calculate travel times by transit, walking, cycling, or driving
- •Caching: Calculated isochrones (commute areas) may be cached to improve performance
- •No GPS: We do not access your device's real-time GPS location
6. How We Share Your Information
Service Providers
We use trusted third-party services to operate Leaseswap:
| Provider | Purpose | Data Shared |
|---|---|---|
| Hetzner | Application Hosting | Encrypted application traffic, request metadata, and transient Packet processing |
| Cloudflare | Network Security & Traffic Delivery | IP address, request metadata, and web request contents in transit |
| Supabase | Database, Authentication & Private File Storage | Account data, searches, alerts, packet documents (private storage) |
| Amazon Web Services | AI Document Review (Packet, via Amazon Bedrock) | Packet documents and messages processed for review; model invocation logging is disabled |
| Stripe | Payment Processing | Payment details for paid features (card numbers are handled by Stripe and never reach our servers) |
| Resend | Email Delivery | Email address for alerts |
| Twilio | SMS Verification & Delivery | Phone number, consent status, SMS delivery data |
| Groq | AI Query Parsing | Search queries (not stored) |
| PostHog | Analytics | Account identifier, email address, and usage events outside Packet; no Packet page analytics or Packet session recordings |
| Upstash (Redis) | Caching, Rate Limiting & Scheduled Jobs | Cached commute calculations, pseudonymous account identifiers, IP addresses, and scheduled-job metadata |
We Do NOT Share With
- ✕Advertisers or marketing companies
- ✕Data brokers or aggregators
- ✕Landlords, brokers, or property managers, with one exception you control: if you complete a rental application packet, it is shared with the agent and landlord your application is addressed to (see Section 2). Your search and alert activity is never shared with listing sources
- ✕Social media platforms
Text messaging originator opt-in data and consent will not be shared with any third parties except as needed to provide messaging services. We do not sell or share SMS opt-in data or consent for marketing purposes.
Legal Requirements
We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
7. Cookies & Analytics
Essential Cookies
We use essential cookies to maintain your session and authentication state. These are required for the service to function and cannot be disabled.
Analytics (PostHog)
We use PostHog, a privacy-focused analytics platform, to understand how users interact with Leaseswap. This platform:
- •Is privacy-respecting and GDPR-friendly
- •Does not sell data to third parties
- •Collects account-linked usage events outside Packet, including your email address when you are signed in
- •Is disabled on Packet applicant, broker, and administrative pages, including session recording
- •Respects Do Not Track browser settings
8. Data Security
We implement industry-standard security measures to protect your data:
- •Encryption in Transit: All data is transmitted over HTTPS/TLS
- •Encryption at Rest: Data is encrypted in our database
- •Row-Level Security: Database policies ensure you can only access your own data
- •Passwordless Auth: Magic links eliminate password-related security risks
- •Regular Monitoring: We monitor for security threats and unauthorized access
While we take security seriously, no system is 100% secure. We encourage you to use a secure email account and notify us immediately if you suspect unauthorized access.
9. Data Retention
- •Account Data: Retained while your account is active and deleted upon account deletion
- •Search History: Retained to power your alerts; deleted with your account
- •Saved Listings: Retained until you remove them or delete your account
- •Analytics Data: Anonymized and aggregated; may be retained indefinitely
- •Packet Documents: Deleted 30 days after your application reaches a final state, along with the compiled packet and the data extracted from your documents (see Section 2)
- •Backup Data: May persist for up to 30 days after deletion for disaster recovery
10. Your Rights & Choices
You have control over your data:
- •Access: View your saved data through your account profile
- •Correction: Update your profile information anytime
- •Deletion: Delete your account and all associated data through profile settings
- •Export: Request a copy of your data by contacting [email protected]
- •Email Preferences: Manage alert frequency or disable notifications in your account settings
California Residents (CCPA)
California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and the right to opt-out of the sale of personal information. We do not sell personal information.
11. Children's Privacy
Leaseswap is not intended for users under 18 years old. We do not knowingly collect information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected].
12. International Users
Leaseswap is operated from the United States and focused on New York City rentals. If you access the Service from outside the US, your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.
By using Leaseswap, you consent to the transfer of your information to the United States.
13. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes:
- •We will notify you via email (if you have an account)
- •We will update the "Last updated" date at the top
- •Material changes will be highlighted on the website for 30 days
Your continued use of Leaseswap after changes constitutes acceptance of the updated Privacy Policy.
14. Contact Us
Questions about this Privacy Policy or your data? Contact us:
Company: Dabudage LLC
131 Continental Dr, Suite 305
Newark, DE 19713
Privacy Email: [email protected]
General Support: Visit our support page
TL;DR: We collect minimal data needed to help you find apartments in NYC. If an agent invites you to apply through a packet, we also handle the application documents you upload: they go only to that agent and landlord, AI checks run under zero data retention, and everything is deleted 30 days after your application closes. We don't sell your data, don't show ads, and give you full control over your information.