Privacy Policy

1. Information We Collect

1.1 Personal Identification Information

When you use LunaHub, we collect:

• Full name (first and last)
• Email address
• Phone number
• Current residential address
• Date of birth
• Social Security Number (SSN) - We collect your full 9-digit SSN for identity verification and credit checks. Your SSN is encrypted using industry-standard encryption and stored securely.
• Driver's license or state ID photos
• Passport information (for international students)
• Digital signature (captured via electronic signature pad)

1.2 Financial Information

• Credit Reports: We obtain your credit report from Experian credit bureau, which may include your credit score, credit history, payment history, account details, and risk factors. Credit checks may be either "soft pulls" (which do not affect your credit score) or "hard pulls" (which may temporarily impact your credit score). We will clearly indicate which type of check will be performed.
• Annual income and income sources
• Employment information (employer name, position, duration)
• Bank account information (bank name, account type, branch)
• Plaid Financial Data: If you choose to verify your identity or income through Plaid, we may collect bank account verification, income verification, transaction history, and account balances.
• Credit score (self-reported and verified)

1.3 Guarantor Information (Third-Party Data)

If you provide a guarantor for your rental application, we collect the following information directly from your guarantor:

• All personal identification information listed above (name, email, DOB, SSN, address)
• Relationship to applicant
• Employment and income information
• Banking information
• Credit report from Experian (with guarantor's consent)
• Document uploads (ID, paystubs)

Important: Guarantor information is collected via an invitation link sent to the email address you provide. The guarantor completes a public form accessible via this unique link. Guarantor data is stored in association with your application and may be shared with landlords and property owners.

1.4 Application and Preference Data

• Budget and budget allocation preferences
• Roommate requirements and roommate contact information
• Property preferences (neighborhoods, bedroom/bathroom count, amenities)
• Move-in date and lease term preferences
• Pet information
• Current landlord information and references
• School information and student status (for students)
• Visa and I-20 documentation (for international students)
• Source of referral and how you found LunaHub

1.5 Document Uploads

Depending on your profile type (professional, student, international student), we collect:

• Government-issued ID or passport photos
• Recent paystubs (typically 3 most recent)
• Job offer letters or employment verification
• School acceptance letters
• Student ID cards
• Visa and I-20 documentation

All documents are stored securely in Firebase Cloud Storage with access restricted to authorized personnel, assigned agents, and landlords reviewing your application.

1.6 Payment Information

• Payment method details (processed securely by Stripe, our payment processor)
• First month's rent payments and transaction history
• Billing information

Note: LunaHub does not store your credit card numbers or banking details. All payment processing is handled securely by Stripe, and we only store transaction confirmation details.

1.7 Communication and Interaction Data

• Luna AI Conversations: Your chat messages and conversations with our AI assistant (powered by Google Gemini) are stored to provide personalized recommendations and improve our service.
• Chat Messages: Messages in agent-client chats, roommate group chats, and community discussions are stored and may be reviewed by our support team.
• Community Interactions: Posts, comments, likes, shares, and follows on our social features.
• Email communications sent to and from you
• Notification preferences and push notification device tokens

1.8 Location and Device Data

• Current and previous addresses
• Neighborhood preferences and property locations viewed
• IP address and device information
• Location data collected through Google Maps API when you use address autocomplete features
• Browser type, operating system, and access times

1.9 Behavioral and Analytics Data

• Application status changes and document upload events
• Apartments you save, view, or express interest in
• Search queries and preferences
• User profile activity (followers, posts, engagement metrics)
• Luna AI interaction analytics
• Email engagement (opens, clicks)

2. How We Use Your Information

We use the information we collect to:

• Process and submit rental applications to landlords and property owners
• Verify your identity and creditworthiness through Experian credit checks
• Verify your income and banking information through Plaid
• Process first month's rent payments through Stripe
• Provide personalized apartment recommendations through Luna AI
• Assign you to a real estate agent for personalized assistance
• Facilitate communication between you, agents, roommates, and the community
• Send you application updates, document requests, and showing reminders
• Improve our matching algorithms and AI assistant
• Prevent fraud and ensure platform security
• Comply with legal obligations including fair housing laws
• Provide analytics to property managers about tenant trends (in anonymized or aggregated form)

3. Third-Party Services and Data Sharing

3.1 Third-Party Services We Use

LunaHub integrates with the following third-party services to provide our platform functionality. By using LunaHub, you acknowledge that your information may be transmitted to and processed by these services in accordance with their respective privacy policies:

3.2 Who We Share Your Information With

• Landlords and Property Owners: When you apply for an apartment, we share your complete application (including personal info, documents, credit reports, and guarantor information) with the property owner or landlord.
• Real Estate Agents: Your assigned agent has access to your full profile, application data, documents, and chat history to assist you.
• Property Management Companies: Our management portal allows property managers to view anonymized tenant data for buildings they manage. Property managers can pay to reveal full tenant information for marketing and tenant retention purposes. This constitutes a "sale" of personal information under California law.
• Roommates: Information you share about potential roommates (names and emails) is used to send roommate invitations. Roommates in your group application can see shared apartment preferences.
• Guarantors: Your guarantor receives basic information about your application via email invitation.
• Service Providers: The third-party services listed above.
• Legal Authorities: When required by law, court order, or to protect our rights and safety.
• Business Transfers: In connection with any merger, sale of company assets, or acquisition, your information may be transferred to the successor entity.

4. Automated Decision-Making and AI

LunaHub uses automated processes and artificial intelligence in the following ways:

• Luna AI Assistant (Google Gemini): Our AI chatbot analyzes your preferences, saved apartments, and profile to provide personalized apartment recommendations. Luna AI has access to your personal information to provide contextual assistance.
• Agent Assignment: An algorithm automatically assigns you to a real estate agent based on availability and specialization.
• Credit Checks: Credit checks through Experian are triggered automatically upon application submission (with your consent).
• Application Status Updates: Your application status is automatically updated when all required documents and information are submitted.
• Matching Algorithms: We use algorithms to match you with apartments based on your budget, preferences, and profile.

Your Rights: You have the right to understand how automated decisions are made and to request human review of any automated decision that significantly affects you. Contact us at [email protected] to request human review.

5. Data Security

We implement comprehensive security measures to protect your personal information:

• Encryption: Social Security Numbers are encrypted using industry-standard AES-256 encryption. Credit reports are stored with signed URLs that expire after a limited time.
• Access Controls: Access to your data is restricted to authorized personnel, your assigned agent, and relevant landlords only.
• Secure Storage: All data is stored on Google Firebase's secure infrastructure with encryption at rest and in transit.
• Audit Logging: All credit checks and sensitive data access is logged in audit trails.
• Authentication: User accounts are protected by Firebase Authentication with secure password requirements.

However, no internet transmission or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5.1 Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users via email within 72 hours of discovering the breach (as required by GDPR)
• Notify relevant authorities as required by applicable state and federal laws
• Provide information about what data was compromised and steps you can take to protect yourself
• Take immediate action to secure our systems and prevent future breaches

To report a security concern, contact: [email protected]

6. Data Retention and Deletion

6.1 How Long We Keep Your Data

• Active Applications: Application data is retained while your application is active and for 2 years after completion or withdrawal.
• Credit Reports: Stored for 7 years to comply with Fair Credit Reporting Act (FCRA) requirements.
• Financial Records: Payment records retained for 7 years for tax and accounting purposes.
• Chat Messages: Agent and roommate chat messages retained for 3 years. Community posts retained indefinitely unless deleted.
• Documents: Uploaded documents (IDs, paystubs, etc.) retained for 3 years after application completion.
• Audit Logs: Security and compliance logs retained for 7 years.
• Inactive Accounts: Accounts with no activity for 5 years may be automatically deleted after email notification.

6.2 How to Delete Your Account

You have the right to request deletion of your account and personal information. To delete your account:

1. Send an email to [email protected] with subject line "Account Deletion Request"
2. Include your full name and email address associated with your account
3. We will verify your identity and process your request within 30 days

Note: Some data may be retained for legal compliance purposes (e.g., financial records, audit logs) even after account deletion. We will clearly communicate what data must be retained and for how long.

We are working on a self-service account deletion feature in your user dashboard. Until then, please use the email process above.

7. Your Rights and Choices

7.1 General Rights

You have the right to:

• Access: Request a copy of all personal information we have about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your information (subject to legal retention requirements)
• Portability: Request a machine-readable copy of your data to transfer to another service
• Object: Object to processing of your data for certain purposes
• Opt-Out: Opt-out of marketing emails (click unsubscribe in any marketing email)
• Withdraw Consent: Withdraw consent for data processing where consent was the legal basis

To exercise these rights, contact: [email protected]

We are developing a self-service Privacy Center in your dashboard where you can export your data, manage privacy settings, and submit data requests. Until then, please contact us via email.

7.2 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You can request details about what personal information we've collected about you in the past 12 months, including:
  • Categories and specific pieces of personal information collected
  • Categories of sources from which we collected information
  • Business purposes for collecting information
  • Categories of third parties with whom we share information
• Right to Delete: Request deletion of your personal information (subject to legal exceptions)
• Right to Opt-Out of Sale: We sell certain personal information to property management companies through our management portal. Specifically, property managers can pay to access full tenant profiles and application data. You have the right to opt-out of this sale.

  Do Not Sell My Personal Information

  To opt-out of the sale of your information to property managers, email us at: [email protected] with subject line "Do Not Sell My Information - California Resident"

  Note: Opting out will not affect your ability to find apartments through LunaHub, but property managers will not be able to access your detailed information for marketing purposes.

• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights (no denial of service, different prices, or different quality of service)
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Information: You can request that we limit use of your sensitive information (SSN, financial data) to only what is necessary to provide our services. Note: This may prevent us from processing rental applications.

Categories of Personal Information We Collect (CCPA):

• Identifiers (name, email, phone, SSN, address)
• Financial information (credit reports, income, bank accounts, payment info)
• Protected classifications (race, national origin - for fair housing compliance only)
• Commercial information (rental preferences, application history)
• Internet activity (browsing history, search queries, app interactions)
• Geolocation data (addresses, neighborhoods, property locations)
• Professional information (employment, income)
• Education information (school, student status)
• Inferences (preferences, characteristics, behavior)

How to Submit a California Privacy Request:

1. Email: [email protected]
2. Subject line: "California Privacy Request - [Type: Know/Delete/Opt-Out/Correct]"
3. Include: Full name, email address, phone number for verification
4. We will respond within 45 days (may extend to 90 days if complex)
5. We may request additional information to verify your identity

You may designate an authorized agent to submit requests on your behalf. The agent must provide written proof of authorization.

7.3 Notification Preferences

You can manage notification preferences in your account settings or by:

• Clicking "unsubscribe" in marketing emails
• Disabling push notifications in your device settings
• Contacting us to opt-out of specific notification types

Note: You cannot opt-out of transactional emails (application updates, document requests, showing confirmations) as these are essential to providing our service.

8. Cookies and Tracking Technologies

LunaHub uses cookies and similar technologies to provide and improve our services:

8.1 Types of Cookies We Use

• Essential Cookies: Required for basic functionality (user authentication, session management). These cannot be disabled.
• Firebase Authentication Cookies: Maintain your logged-in session securely.
• Google Maps Cookies: Enable address autocomplete and map features.
• Functional Cookies: Remember your preferences (saved searches, notification settings).
• Analytics Cookies: Help us understand how users interact with our platform to improve user experience.

8.2 How to Manage Cookies

You can control cookies through:

• Your browser settings (most browsers allow you to refuse cookies or delete existing cookies)
• Google Analytics Opt-out: https://tools.google.com/dlpage/gaoptout

Note: Disabling essential cookies may prevent you from using certain features of LunaHub.

8.3 Do Not Track

Our platform does not currently respond to Do Not Track (DNT) browser signals. We will update this policy if we implement DNT support in the future.

9. Children's Privacy

LunaHub is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 13 years of age.

Age Requirement: You must be at least 18 years old to use LunaHub and create an account. By using our platform, you represent that you are 18 years or older.

If we discover that we have inadvertently collected information from a child under 13, we will delete that information immediately. If you believe we have collected information from a child under 13, please contact us at [email protected].

10. International Data Transfers

LunaHub operates in the United States, and your data is stored on servers located in the United States (Google Firebase us-central1 region).

If you are accessing LunaHub from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using our services, you consent to this transfer.

For European Union Residents: Google Firebase complies with the EU-US Data Privacy Framework and uses Standard Contractual Clauses (SCCs) for international data transfers. Data transferred to the United States is protected under these mechanisms.

GDPR Rights: If you are an EU resident, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, data portability, and object to processing. Contact us to exercise these rights.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email if the changes significantly affect your rights or how we use your data
• Request your consent if required by law

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Us

For privacy-related questions, to exercise your privacy rights, or to submit a data request, contact us at: