Privacy Policy

Tessora (“we,” “us,” or “our”) is a mid-term rental marketplace connecting hosts and renters for stays of 30 days or more. This policy explains what information we collect, how we use it, and your rights regarding that information. We do not sell your personal data.

Information you provide:

• Name, email address, and phone number
• Profile photo
• Property details, including descriptions, photos, amenities, and pricing (hosts)
• Identity verification documents
• Payment information (processed by Stripe; card details are not stored on our servers)
• Lease documents
• Messages sent through the platform
• Reviews and ratings

Information collected automatically:

• IP address, device type, browser, and operating system
• Pages visited, session duration, and referral source
• Search queries performed on the platform

Information from third parties:

• Identity verification results
• Background screening results
• Property management system (PMS) data, when connected by host
• Calendar data from iCal feeds, when connected by host
• Pricing data from PriceLabs, when connected by host

• To operate and improve the marketplace
• To process bookings and payments
• To verify identity and conduct background screening
• To facilitate lease signing
• To send booking confirmations, payment receipts, and platform notifications
• To provide AI-powered listing quality scores and pricing recommendations
• To prevent fraud and maintain platform safety
• To communicate product updates (with opt-out option)
• To generate aggregate analytics and market insights (anonymized)

We will never sell your data to third parties or use it for purposes beyond those listed above without your consent.

We use the following services to operate Tessora:

• Supabase — database and authentication (US-hosted PostgreSQL).
• Stripe — payment processing and host payouts (PCI Level 1 certified).
• Dropbox Sign (HelloSign) — electronic lease signing and document storage.
• Anthropic (Claude) — AI-powered listing analysis and quality scoring. No personal data is sent to this service; only listing descriptions and photos are processed.
• Mapbox — location services and map display.
• Sentry — error monitoring and performance tracking.
• PriceLabs — dynamic pricing recommendations (when connected by host).
• Hostaway, Guesty, OwnerRez, Lodgify — property management system integrations (when connected by host).
• Upstash — rate limiting infrastructure (no personal data stored).
• Resend — transactional emails.
• Vercel — website hosting.
• Google Analytics — aggregate site analytics (IP anonymization enabled).

Each of these services has its own privacy policy. We configure them to minimize data collection where possible.

We do not sell personal data. We share data only in the following circumstances:

• With other users as needed for bookings (hosts see renter name and contact information; renters see host name and property details).
• With payment processors to complete transactions.
• With identity verification and screening providers.
• With third-party integrations you explicitly connect.
• When required by law or to protect safety.
• In aggregate or anonymized form for market insights (no individual identification possible).

• Account data — retained while your account is active, plus 30 days after a deletion request.
• Booking records — retained for 7 years for financial and legal compliance.
• Lease documents — retained for the lease term plus 3 years.
• Messages — retained while both accounts are active.
• Analytics data — retained per each provider's default retention settings.
• Background screening results — retained for 1 year.

You have the right to:

• Access — request a copy of the data we hold about you.
• Deletion — request that we delete your data within 30 days, subject to legal retention requirements.
• Correction — request that we correct inaccurate data.
• Portability — request a data export in a machine-readable format.
• Opt-out — unsubscribe from marketing communications at any time.
• Restrict processing — request limitation of data processing.

To exercise any of these rights, email privacy@tessora.io.

We use essential cookies for authentication and session management. Analytics cookies (Google Analytics) can be disabled in your browser settings. We do not use advertising cookies or sell data to advertisers.

Tessora is not directed to children under 18. As a rental marketplace, the platform requires users to have legal capacity to enter into rental agreements. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

Data is processed in the United States. By using Tessora, you consent to the transfer and processing of your data in the US. We comply with applicable data protection regulations.

Data is encrypted in transit (TLS) and at rest. Payment data is handled exclusively by Stripe, which maintains PCI Level 1 certification. We maintain access controls, monitoring, and conduct regular security reviews to protect your information.

We may update this policy as the platform evolves. We will notify users by email of any material changes. Continued use of the site after changes constitutes acceptance of the updated policy.

Questions about privacy? Email privacy@tessora.io or write to us at Tessora, Austin, TX.