Privacy Notice

Our role and the PHA’s role

The PHA is the controller and owner of the resident and household records it places in RentSpire. RentSpire acts as a service provider and processor: it processes that information only on the PHA’s documented instructions and to provide the portal and related support.

Nothing in this notice transfers ownership of PHA records to RentSpire. The PHA remains responsible for its own notices, legal bases, records policies, and determinations concerning its programs and residents.

Information processed

Depending on how a PHA uses the service, RentSpire may process:

• PHA staff account and access data, such as name, work email, role, sign-in and account-security information;
• resident and household data supplied by the PHA, including HUD Form 50058 data and casework records;
• EIV-derived income information supplied or made available by the PHA through an authorized workflow;
• community, owner, unit, rent, and comparable-unit information used for rent-reasonableness and casework; and
• site analytics and technical data, such as browser, device, IP-address, log, and service-use information.

EIV and Privacy Act information

Where EIV-derived information is in scope, it is subject to applicable HUD EIV security rules, 24 CFR 5.212, and the Privacy Act of 1974. Access must be limited to authorized users with a legitimate need to know. The PHA is responsible for determining authorization and for meeting its HUD and Privacy Act obligations.

Purposes and legal basis

RentSpire processes personal information to provide, secure, maintain, troubleshoot, and support the service; to comply with applicable law; and as otherwise instructed by the PHA. The PHA determines the lawful basis for its collection and use of resident and household information. RentSpire does not use that information for purposes incompatible with the PHA’s instructions.

Sale, sharing, and model training

RentSpire does not sell resident data. RentSpire does not use resident or household data to train third-party models. RentSpire processes resident and household data solely to provide the service to the applicable PHA and as directed by that PHA.

For California-specific information, see our Do Not Sell or Share Personal Information notice.

Service providers

RentSpire may use service providers that perform functions such as cloud hosting, database infrastructure, and site analytics. Those providers may process information only to perform services for RentSpire and subject to appropriate contractual restrictions. We do not publish a brand list here because providers may change; a PHA may request current subprocessor information through its contracting channel or privacy@rentspire.com.

Cookies and browser storage

This site does not use advertising cookies, cross-site tracking cookies, or third-party marketing tags. It uses the following, and nothing else:

• A strictly necessary rate-limiting cookie (rs_rl_sid). This holds a random value with no meaning outside this site. It exists only so that automated request floods can be slowed per browser instead of per network address — which is what allows an entire housing authority office sharing one internet connection to keep working while a single abusive client is paused. It is HttpOnly, so page scripts cannot read it; it is Secure; and it carries no expiry date, so it is discarded when the browser session ends. It is not used for analytics, profiling, or advertising, and it is not sent to our database provider.
• Local browser storage for your own preferences, including whether this device has previously used the staff sign-in tab, so returning staff land on the sign-in screen instead of the public browse screen. This stays on your device.
• An analytics preference, if you express one. Product analytics are off by default, are cookieless when enabled, and are disabled entirely when your browser sends a Global Privacy Control or Do Not Track signal.

Because the rate-limiting cookie and preference storage are strictly necessary or set at your direction, they do not require consent. Clearing your browser storage removes all of them; the site continues to work.

Security

RentSpire uses safeguards designed for the service, including TLS encryption in transit, encryption at rest, role-based access control, audit logging, and multifactor authentication for privileged access. No method of transmission or storage is completely secure, and this notice does not promise absolute security.

Retention and deletion

Resident and household data is retained in accordance with the PHA customer’s own record-retention schedule, applicable HUD requirements, and the governing contract or purchase order. RentSpire does not state a uniform retention period because that period depends on the PHA’s program, records obligations, and instructions. On termination, data handling is governed by the applicable contract, PHA instructions, and legal obligations.

Rights and requests

Individuals may have rights to access, correct, delete, restrict, or object to certain processing, depending on applicable law. Because the PHA is the controller of resident and household data, resident and household requests should ordinarily be directed to the relevant PHA. RentSpire will assist the PHA as required by the applicable contract and law.

California residents may have rights under the CCPA/CPRA to know, access, correct, delete, and limit certain uses of sensitive personal information, as well as the right to opt out of sale or sharing. RentSpire does not sell personal information. See the Do Not Sell or Share Personal Information notice for request instructions.

Children’s data

The portal is not directed to children. RentSpire does not knowingly collect personal information directly from children through the portal. If resident or household records include information about minors, RentSpire processes it only as part of the PHA’s records and on the PHA’s instructions.

Security incidents

If RentSpire confirms a security incident involving PHA data, it will notify the affected PHA without undue delay in accordance with the applicable contract and law. The PHA remains responsible for deciding whether and how to provide notices to residents, regulators, or other parties, except where applicable law requires otherwise.

Contact

For privacy questions or a request, contact privacy@rentspire.com.