Privacy Policy.

RentCaliber can be used without an account. This notice explains what is processed when you visit the site or choose to synchronize saved work.

Controller and contact

The data controller is Javier Castellanos Serrano, Spain, operator of RentCaliber (rentcaliber.com). Privacy and account requests can be sent to [email protected]. No data protection officer has been appointed because RentCaliber’s present processing does not require one.

Data we process

  • In your browser: calculator assumptions, property nicknames, save dates, deal stages, shortlisted markets and the last selected city may be stored locally on your device.
  • With an account: your email address, one-way password hash and salt, session records, Terms acceptance date and version, saved property assumptions, deal stages and shortlisted market identifiers.
  • Technical and security data: Cloudflare may process IP address, request time, requested URL, browser or device information and security signals when delivering and protecting the site. Rate-limit records use a one-way hash derived from IP address, action and email.
  • Messages: if you email RentCaliber, the message, your address and related correspondence are processed to answer you.

Do not put tenant names, exact property addresses, financial-account details or other sensitive personal information in property nicknames or calculator fields.

Purposes and legal bases

  • Provide the account and synchronization: necessary to perform the account service you request and enforce the Terms.
  • Protect the service and prevent abuse: legitimate interests in authentication, availability, fraud prevention and security.
  • Operate and understand the site: legitimate interests in reliable delivery and aggregate performance measurement, balanced against user privacy.
  • Answer requests and meet legal duties: legitimate interests and, where applicable, compliance with legal obligations.

RentCaliber does not use account data for automated decisions with legal or similarly significant effects.

Local storage and cookies

Local browser storage supports saved deals, preferences and calculator continuity. You can remove individual saved items in RentCaliber or clear this site’s data in browser settings. Signing in sets one essential Secure, HttpOnly and SameSite=Lax session cookie for up to 30 days. It is required for the account service and is not used for advertising.

Cloudflare Web Analytics measures aggregate traffic and performance without placing application analytics cookies. RentCaliber also counts a limited set of product actions—such as opening a market, completing a calculation, using a stress test, saving a deal or generating a report—in daily aggregate totals. These events contain the page path and experiment group, but no property inputs, address, email, user identifier or persistent analytics identifier. External reference and partner links open third-party sites governed by their own privacy choices.

Recipients, hosting and international processing

Cloudflare provides hosting, security, account functions, analytics and database infrastructure as a service provider. The account database is configured for storage in the European Union. Cloudflare’s global network may process ordinary request and security data in other locations under its applicable contractual and data-transfer terms. See Cloudflare’s privacy policy and Data Processing Addendum.

Resend processes an account email address and transactional message metadata to deliver verification and password-recovery emails. See Resend’s privacy policy and Data Processing Addendum. Account and email data is not sold, rented or disclosed for cross-context behavioral advertising.

Retention

  • Browser data stays on the device until you remove it or clear site data.
  • Account and synchronized data remain until you delete the account or request deletion.
  • Aggregate product-event totals are retained for up to 24 months. They do not contain property inputs, email addresses or event-level identifiers.
  • Sessions expire after 30 days; expired sessions and expired rate-limit records are removed during routine account activity.
  • Verification links expire after 24 hours and password-reset links after one hour. Used and expired token records are removed during routine account activity.
  • Transactional email delivery records are retained according to the email provider’s documented settings and retention practices.
  • Support correspondence is kept only as long as reasonably needed to answer the request, maintain necessary records or meet legal obligations.
  • Cloudflare may retain network and security logs under its own documented retention practices.

Your privacy rights

Depending on where you live, you may have rights to know or access personal data, correct it, delete it, restrict or object to processing, receive portable data, withdraw consent where consent is used, and complain to a regulator. Account holders can download synchronized data and delete the cloud account directly. Other requests can be emailed to the address above. RentCaliber may need to verify that the requester controls the relevant email account and normally responds within the period required by applicable law.

People in the European Economic Area may complain to their local supervisory authority; in Spain this is the Agencia Española de Protección de Datos. U.S. residents whose state law applies may also request access, correction, deletion or portability and may appeal a refused request by replying to the decision. RentCaliber does not sell or share personal information for targeted advertising and therefore has no sale or sharing opt-out to process. RentCaliber will not discriminate against someone for exercising an applicable privacy right.

Children

RentCaliber is a general-audience service for rental investors and landlords. Accounts are for people aged 18 or older and the service is not directed to children. If you believe a child has supplied personal information, contact us so it can be investigated and deleted.

Security and changes

Passwords are not stored in readable form. RentCaliber uses salted password derivation, hashed session tokens, encrypted transport, restricted cookies, request-origin checks, rate limits and account export and deletion controls. No online service can guarantee absolute security. Material changes to this notice will be posted here with a new update date.

Last updated October 8, 2026.