Privacy policy

Last updated 6 August 2026

Christian Rentalshelps Christians find flatshares and rooms. We collect only what we need to run the service, and we're specific about it below. This policy explains what we collect, why, our lawful bases, how long we keep it, who we share it with, and your rights.

The data controller is Faithful App Ltd (company no. 17247090), registered office 124-128 City Road, London, EC1V 2NX, England. We are registered with the UK Information Commissioner's Office (ICO registration no. [to be added]). For any data or privacy question, or to exercise your rights, contact us at hello@christianrentals.org.

1. What we collect

Account details — name, email, and optional profile information (photo, bio, gender, date of birth for our 18+ check).
Church — entirely optional and special-category data under UK GDPR (Article 9). We process it only with your explicit consent, captured at sign-up, and use it solely to power faith-based matching. You can withdraw consent and remove it at any time in Settings, with no effect on the rest of your account.
Listings — the content you post about a room or property. Full postcodes and street addresses are never shown publicly; only the outcode (e.g. SW4) appears on a listing.
Messages — the content of messages you exchange with other members through our in-app messaging. See section 3.
Church references — if you request a reference, we collect the name and email of the church leader you nominate and their answers, used only to show whether you are church-referenced. We email the referee to collect it.
Identity verification — carried out by Stripe Identity. We never see or store your documents; we record only the pass/fail result and the verification session id. To help prevent someone verifying on another person's behalf, at the moment of verification we also compare the name on your document against your profile name — the comparison happens transiently and we keep only the match result, never the name, date of birth, or any other document detail.
Payments — processed by Stripe. We never see or store your card details; we keep a record of the order and its status.
Reports & safety records — if you report a user, listing or message, we store the report, the content reported, and the action we took.
Location searches — when you search or save a search, the place or postcode you enter is sent to our geocoding provider (see section 6) to turn it into a map location.
Technical & usage data — essential cookies to keep you signed in, and, only with your consent, privacy-friendly analytics. See our Cookie Policy.

2. How we use your data

To create and run your account and the marketplace (listings, applications, messaging); to verify identity and take payment; to send you transactional emails about your activity (applications, messages, references, saved-search alerts); to keep the platform safe and prevent fraud; and to comply with our legal obligations.

3. Messages, moderation & keeping you safe

Messages between members are stored so that both parties have a record and so we can act if something goes wrong. We are an introductions platform — we are not a party to your conversations or any arrangement you reach.

Automated safety checks. We use automated pattern detection to flag attempts to move contact or payment off-platform, which is how most scams happen, and to show you a safety warning. This is not used to make any decision with legal effect about you.
Access by our team. Messages are private to you and the other party. Our small team may access specific messages only where necessary to investigate a report, a safety or fraud concern, or a legal request — not to browse.
Reporting & removal. You can report a user, listing or message. We may remove content and suspend or remove accounts that break our Terms or the law.
Lawful disclosure. Where we are legally required, or where it is necessary to prevent or detect crime or protect someone, we may preserve and disclose messages and account data to the police or other authorities.

These measures also support our duties as a user-to-user service under the Online Safety Act 2023.

4. Our lawful bases (UK GDPR)

Contract — to provide the account and marketplace you sign up for (listings, applications, messaging, payments).
Explicit consent — for your church (special-category data) and for optional analytics cookies. You can withdraw consent at any time.
Legitimate interests — keeping the platform safe, preventing and detecting fraud and abuse, moderating content, and sending transactional emails about your activity. We have balanced these against your rights.
Legal obligation — where we must retain or disclose records to comply with the law.

5. How long we keep your data

Account, listings, applications and messages — for as long as your account is open. If you delete your account we remove your profile, listings, applications, messages and references, except where we must keep limited records (see below).
Safety, fraud and moderation records — retained for up to 24 months after the event so we can detect repeat abuse and respond to disputes and legal requests.
Payment and order records — retained for up to 7 years to meet accounting and tax obligations. If you delete your account these records stay, but we detach them from you: they keep the amount, date and Stripe reference, and no longer name anyone.
Identity verification result — the session id, the pass/fail result and any name-match result only, retained while your account is open and for up to 24 months after you close it, then deleted. We never store copies of ID documents.

6. Who we share data with

We use a small number of trusted processors:

Stripe — payments and identity verification.
Supabase — our database and file storage (UK/EU region).
Vercel — hosting.
Resend — transactional email.
Mapbox — turning a place or postcode you search into a map location, and showing the map. It receives your search text and IP address.

We never sell your data, and we do not use it for third-party advertising.

7. International transfers

Some of our processors (such as Stripe, Resend and Mapbox) are based in, or transfer data to, the United States or other countries outside the UK. Where they do, the transfer is protected by an appropriate safeguard — UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement / Standard Contractual Clauses — so your data receives an equivalent level of protection.

8. Security

Access to your data is controlled at the database level so that members can only see their own information and the content shared with them. Data is encrypted in transit and at rest, and access by our team is limited to what is necessary. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Your rights

Under UK GDPR you have the right to access, correct, export, delete, restrict or object to our processing of your data, and to withdraw consent at any time. From Settings → Your data & account you can download a copy of your data and permanently delete your account. You can also email hello@christianrentals.orgfor any data request. We respond within one month. You have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Age

Christian Rentals is only for people aged 18 or over. We ask you to confirm this at sign-up and do not knowingly collect data from anyone under 18.

11. Cookies

We use essential cookies to keep you signed in, and — only with your consent — privacy-friendly analytics to improve the site. Full detail, and how to change your choice, is in our Cookie Policy.

12. Changes to this policy

We may update this policy. When we make material changes we will update the “last updated” date above and, where appropriate, tell you directly.