Christian Rentals
Get started

Privacy policy

Policy version 2026-08-18 · Last updated 25 September 2026

Introduction

This Privacy Policy is provided by Faithful App Ltd, a company incorporated in England and Wales with company number 17247090 and its registered office at 124-128 City Road, London, EC1V 2NX, England(“Faithful App”, “Christian Rentals”, “we”, “our” or “ us”). Faithful App Ltd trades as ‘Christian Rentals’ and operates christianrentals.org, an online marketplace and introductions platform for rooms, flat shares and live-in host arrangements in supported locations (together, the “ Platform”). We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC204101.

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In relation to the Platform, Faithful App is generally the controller for personal data processed to operate and improve the Platform, administer member accounts and profiles, publish and manage room, flat share and live-in host listings in supported locations, ask factual questions about the property and the advertiser’s occupation of it to determine which registration, licensing and declaration requirements to apply before publication in supported locations, facilitate applications, in-app messaging and customer support, process listing fees and optional listing boosts through Stripe, verify identity through Stripe Identity, carry out limited name-match and safety checks, moderate listings and messages, handle reports, keep safety records and moderation logs, and prevent fraud, misuse and unsafe activity. Christian Rentals is introductions-only: we are not a letting agent, property manager, landlord, tenant, payment institution, rent collection service or deposit holder, and we do not handle rent or tenancy deposits. Hosts, advertisers, applicants and other members each act as independent controllers of the personal data they choose to share with each other through the Platform in connection with a listing, application, message or arrangement, and are independently responsible for their own compliance with applicable data protection law in respect of such data. We use third-party service providers to support these activities (including payment processors, cloud hosting, communications, mapping, analytics, identity verification and customer support tools). Where those service providers process personal data on our behalf as processors, they are subject to appropriate contractual or data processing terms where required by applicable data protection law.

What this policy applies to

This privacy policy relates to:

  • your use of the Christian Rentals website at christianrentals.org and any related web features we make available;
  • personal data processed when you create and use a member account, complete a profile, search for, list, apply for or discuss rooms, flat shares or live-in host arrangements in supported locations, use in-app messaging, upload or share listing photos or other content, report content or users, or contact support; and
  • personal data processed in connection with listing fees, optional boosts, identity verification, name-match checks, safety checks and moderation completed through or in connection with the Platform.

The Website may link to other websites owned and operated by third parties. Those other websites may gather information about you in accordance with their own separate privacy policies. For privacy information relating to those other websites, please consult their privacy policies as appropriate. For more information see ‘Who we share your personal data with’ below.

Personal data we collect about you

We may also collect, use and share aggregated and anonymised data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity and cannot reasonably be used to re-identify you. For example, we may aggregate Website usage data to analyse trends and improve the Website and our services. If we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data subject to this Privacy Policy.

We collect and use this personal data for the purposes described in ‘How and why we use your personal data’ below.

Sensitive data

Sensitive personal data (also known as special category data) means information related to personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.

We do not ask for information about your religious beliefs, and none is required to use the Platform. However, Christian Rentals is designed to help users connect in a faith-informed accommodation context, so content you choose to include in a listing, profile or message (for example, churches near a room, or the church you attend) may reveal religious beliefs, which is special category data under UK GDPR. We process that information only to show your content to the users you share it with, and you can edit or delete it at any time. Please do not include unnecessary special category data in listings, messages or reports.

Please do not provide special category data to us via the Platform or in communications unless it is specifically requested or necessary for the relevant purpose. If you voluntarily provide unsolicited special category data, we will use reasonable efforts to delete it where it is not needed. Where retention is necessary (for example, in connection with a report or safety matter), we will process it only to the extent required and in accordance with applicable data protection law, relying on an applicable Article 9(2) condition.

Identity verification. Where Stripe Identity is used, Stripe may process identity documents and biometric or facial matching information for verification purposes. We do not receive or store copies of ID documents. We store only proportionate verification outputs, such as the verification session ID, status, timestamps and pass/fail or verified/not verified result, and any transient name-match output recorded as match/mismatch/unknown. Where biometric data is processed as part of identity verification, we rely on your explicit consent as the lawful basis under Article 9(2)(a) of the UK GDPR. You may withdraw your consent at any time, though this may affect your ability to complete verification. We keep this processing under review because identity verification, faith-related data and safety moderation can be sensitive processing areas that may require additional safeguards and DPIA assessment.

How your personal data is collected

We use different methods to collect data from and about you including through:

  • Your interaction with us. We collect personal data from you directly when you create an account, complete your profile, browse, search for, list or apply for rooms, flat shares or live-in host arrangements in supported locations, contact us, use in-app messaging, upload listing photos or other content, start an identity verification process, pay a listing fee or optional boost through Stripe, submit a report, exercise your data protection rights, subscribe to communications, or otherwise correspond with us (including by email or via social media).
  • Automated technologies or interactions. As you interact with the Website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

How and why we use your personal data

Under data protection law, personal data may only be processed where there is a lawful basis. Faithful App acts as a controller for processing necessary to operate the Platform (including account administration, profiles, listings in supported locations, applications, in-app messaging, payments for listing fees and boosts, identity verification, reports, moderation, trust and safety, Online Safety Act-related safety measures and platform security). Where we act as a controller, we rely on one or more of the following lawful bases:

  • where you have given consent;
  • to comply with our legal and regulatory obligations;
  • for the performance of a contract with you or to take steps at your request before entering into a contract; or
  • for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. Our principal legitimate interests include operating and improving the Platform, preventing fraud and misuse, ensuring user safety, and communicating with members about Platform activity. You can obtain further details of these assessments by contacting us (see ‘How to contact us’ below).

Marketing

We may send you communications about the Platform, account updates, listing activity, applications, in-app messages, saved-search alerts, service announcements and insights, and (where permitted) promotional offers. You can choose which activity emails you receive (messages, applications, listing alerts and reminders) at any time from your account settings or from the link at the bottom of any such email; emails about your own account, such as a suspension or a listing we have removed, are sent regardless because they are the record of what happened. While you have a live listing, emails telling you about a new message or application about it are also always sent, because they are part of the service you asked for when you listed and someone is waiting for your reply. You can choose to receive them as they happen or as one daily summary, and pausing or removing the listing stops them.

Where required by law (including under PECR), we will obtain your consent before sending you direct marketing by email, SMS, push notification or similar electronic means. Where consent is not required, we may send marketing on the basis of our legitimate interests, subject to applicable law and your right to opt out at any time. We will also seek consent where required for non-essential cookies or similar technologies used on the Platform, and we maintain records of your marketing and consent preferences. For further information on the cookies and similar technologies we use and how you can control them, please see our Cookie Policy.

You will have the right to opt out of receiving marketing communications at any time by:

  • contacting us at hello@christianrentals.org; or
  • using the ‘unsubscribe’ link included in all marketing emails you may receive from us.

We will not sell your personal data to third parties for their own direct marketing purposes.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

Who we share your personal data with

We share personal data only where necessary for the purposes set out in this Privacy Policy. As controller for Platform operations, we may share personal data with:

  • other users (for example, where a host, advertiser or applicant shares listing details, approximate location, photos, application details, messages or contact information with another member through the Platform, including any registration or licence number the advertiser chooses or is required to display as the advertiser’s own statement in a supported location);
  • our service providers who help us operate the Platform, including Supabase for database and file storage, Vercel for hosting, Resend for transactional email, Mapbox for maps/geocoding and location searches, Google Workspace/Gmail for support, reports, DSARs and internal business communications, and analytics, security and storage providers;
  • Stripe to process listing fees, optional boosts, payments, fraud prevention and Stripe Identity verification; we do not store or process your full card details or copies of ID documents ourselves; and
  • professional advisers, regulators, law enforcement and other third parties where required or permitted by law.

We do not verify registration or licence numbers against the Scottish Landlord Register, Rent Smart Wales or any other supported-location register, but may share information with regulators or other third parties where required or permitted by law. Where our service providers process personal data on our behalf as processors, they do so under appropriate contractual or data processing terms where required by applicable data protection law and must only process personal data in accordance with our instructions.

We only allow service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. Where a service provider processes personal data on our behalf as a processor, we put in place a written data processing agreement (a “Data Processing Agreement”) that meets the requirements of Article 28 of the UK GDPR. Under that Data Processing Agreement we impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you, act only on our documented instructions, keep the data secure and confidential, and assist us in meeting our obligations under applicable data protection law.

We or the third parties mentioned above may occasionally also need to share your personal data with:

  • external auditors, e.g. in relation to the audit of our accounts and our company — the recipient of the information will be bound by confidentiality obligations;
  • professional advisors (such as lawyers and other advisors) — the recipient of the information will be bound by confidentiality obligations;
  • law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations; and
  • other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency — usually, information will be anonymised, but this may not always be possible, however the recipient of the information will be bound by confidentiality obligations.

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

We do not share your personal data with third parties except as described in this Privacy Policy or where required or permitted by law.

How long your personal data will be kept

We will keep personal data for as long as necessary for the purposes set out in this Privacy Policy. As controller for Platform operations, we generally retain account, profile, listing, application, in-app messaging, uploaded content and support data for as long as you have an account. If you delete your account, we remove or anonymise your profile, listings, applications and messages, except where we must keep limited records for legal, safety, fraud, moderation, dispute or accounting reasons.

  • Safety, fraud, report and moderation records are generally retained for up to 24 months after the relevant event so we can detect repeat abuse and respond to disputes and legal requests.
  • Messages you have sent remain visible to the member you sent them to after you delete your account, with your name and profile removed, so that they keep a record of the conversation. The conversation is deleted once both members have closed their accounts.
  • Payment and order records are retained for up to 7 years to meet accounting and tax obligations and, where practicable after account deletion, will be retained in de-identified form rather than as active account data.
  • Identity verification outputs — the session ID, status and pass/fail or verified/not verified result, and any name-match result of match/mismatch/unknown — are retained while your account is open and for up to 24 months after account closure for fraud prevention, trust and safety, compliance or legal claims purposes, after which they will be deleted or anonymised unless a longer period is required by law or an active legal claim. We do not store copies of ID documents.

Following the end of the applicable retention period, we will delete or anonymise personal data in accordance with applicable data protection requirements, unless we are required to retain it (for example, due to legal obligations or a legal hold).

Transferring your personal data out of the UK

We may transfer your personal data outside the UK (for example, where our service providers or their support teams process data in other countries). Some of our service providers, including Stripe, Resend, Mapbox, Google Workspace/Gmail, hosting, communications, analytics and verification providers, may operate globally and may process personal data outside the UK. Where we transfer personal data outside the UK, we will ensure appropriate safeguards are in place to protect your personal data, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, and, where required, a transfer risk assessment (TRA), or another lawful transfer mechanism under UK data protection law.

Furthermore, under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR; there are appropriate safeguards in place (such as the IDTA and, where relevant, the UK Addendum to the EU Standard Contractual Clauses), together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law.

  • The EEA: we may rely on the UK adequacy regulations in respect of EEA countries (where applicable).
  • Other countries: we will put in place appropriate safeguards (such as the IDTA and, where required, a TRA) and other measures required by UK data protection law.

In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.

Your rights

You generally have the following rights, which you can usually exercise free of charge. For most Platform processing, Faithful App is the controller and you can direct requests to us. For more information regarding these rights, please visit the ICO website.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

If you would like to exercise any of those rights, please email or write to us — see ‘How to contact us’ below. We may need to verify your identity before responding. When contacting us please:

  • provide enough information to identify yourself (e.g. your full name and username) and any additional identity information we may reasonably request from you; and
  • let us know which right(s) you want to exercise and the information to which your request relates.

You can also download or export a copy of your data, and request deletion of your account and associated active account data, directly from your account Settings. Account deletion is subject to the retention periods and exceptions described in ‘How long your personal data will be kept’, including retention of de-identified payment and order records where required for accounting and tax obligations. Where you contact us by email to exercise your data protection rights, we will respond within one month of receiving your request (this period may be extended by up to a further two months where the request is complex or we receive a number of requests, and we will let you know within one month if that is the case and explain the reason for the extension).

Keeping your personal data secure

We have implemented appropriate technical and organisational security measures to protect your personal data. Access to personal data is restricted to authorised personnel and service providers on a need-to-know basis. Access to data is controlled at database and application level so members can only see their own information and content shared with them. Data is protected in transit and at rest where appropriate, and we maintain policies and controls designed to protect against unauthorised access, alteration, disclosure or loss of personal data.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

How to complain

Please contact us if you have any queries or concerns about our use of your information (see ‘How to contact us’ below). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner.

The Information Commissioner can be contacted at ico.org.uk/make-a-complaint or telephone: 0303 123 1113.

Changes to this privacy policy

We may change this privacy policy from time to time to reflect updates in our services, our processing activities, or regulatory requirements. We will notify you of any material changes before they take effect, for example by posting an updated version on the Website and/or emailing you, and we will obtain fresh consent where required by applicable data protection law. The updated policy will indicate the date it takes effect.

How to contact us

You can contact us by post or email if you have any questions about this privacy policy, the information we hold about you, to exercise your rights under data protection law, or to make a complaint.

Our contact details are shown below:

124-128 City Road, London, EC1V 2NX, England
hello@christianrentals.org