Privacy Policy

Subscapes, Inc. ("Subscapes," "we," "us," or "our") operates a social subletting platform that connects people looking to sublet their home with people seeking short-to-medium term housing. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our website, mobile application, and related services (collectively, the "Platform").

By creating an account or using the Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Platform.

We collect information you provide directly, information generated through your use of the Platform, and information from third parties.

Information you provide

• Account registration details: name, email address, phone number, username, and password.
• Profile information: date of birth, gender, employer, work title, school or major, and profile photo.
• Listing content: photos, descriptions, pricing, availability, and address of properties you list.
• Identity verification documents: government-issued ID submitted for verification (processed by a certified third-party; we do not store raw document images).
• Connected social accounts: if you link Instagram, Facebook, LinkedIn, or TikTok, we receive your public profile handle and connection data.
• Communications: messages sent through the Platform between hosts and renters.
• Payment information: if you purchase a Boost or verification service, payment is processed by a PCI-compliant third-party provider. We store only a tokenized reference — never your full card number.
• Renter preferences: preferred neighborhoods, budget, move-in timeline, and situation description.

Information generated automatically

• Device and browser information: IP address, browser type, operating system, and device identifiers.
• Usage data: pages viewed, search queries, listings clicked, time spent, and navigation paths.
• Location data: approximate city-level location inferred from IP address. We do not collect precise GPS location unless you explicitly grant permission.
• Log data: server logs, error reports, and performance data.
• Cookies and similar technologies: described further in the Cookies section below.

Information from third parties

• Social platforms (Instagram, Facebook, LinkedIn, TikTok) when you choose to connect them — limited to public profile data and mutual connection graphs.
• Identity verification providers: confirmation of whether your document matched your profile (no raw document data).

We use the information we collect to operate, improve, and protect the Platform and its community.

• Provide and personalize the Platform: show you relevant listings, match renters with hosts, surface mutual connections, and power neighborhood demand maps.
• Account management: create and maintain your account, authenticate you, and process profile updates.
• Trust and safety: verify identities, surface mutual connections, detect fraud, investigate reports, and take enforcement action when necessary.
• Communications: send you messages, notifications, weekly reactivation reminders, and product updates. You can opt out of non-essential emails at any time.
• Payments: process purchases for ID verification through our third-party payment processor.
• Analytics and product improvement: understand how users interact with the Platform so we can fix bugs and build better features.
• Legal compliance: fulfill our obligations under applicable law, respond to legal process, and enforce our Terms of Service.

We do not sell your personal data. We share information only in the limited circumstances described below.

With other users

Your public profile — including your display name, profile photo, neighborhood, bio, verified status, and renter preferences — is visible to other logged-in users. Your full name, email, phone number, and date of birth are never shown publicly. Your messages are visible only to you and the recipient.

With service providers

We share data with vetted vendors who help us operate the Platform: cloud hosting providers, payment processors, identity verification services, analytics platforms, and customer support tools. These vendors are contractually prohibited from using your data for any purpose other than providing services to us.

For legal reasons

We may disclose information if we believe in good faith that doing so is necessary to comply with a legal obligation, protect the rights or safety of Subscapes or its users, prevent fraud, or respond to a government request.

Business transfers

If Subscapes is acquired, merges with another company, or undergoes a similar corporate transaction, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.

Subscapes places a high priority on keeping its community safe. Here is how we handle sensitive verification data specifically.

Government ID verification

Your ID document is scanned and processed entirely by our third-party verification provider using encrypted channels. Subscapes receives only a pass/fail result and, if verified, the document type used. We never receive, store, or view images of your government-issued ID.

We use cookies and similar technologies to operate the Platform, remember your preferences, and understand how the Platform is used.

Types of cookies we use

• Essential cookies: required for the Platform to function (authentication, session management). Cannot be disabled.
• Preference cookies: remember your settings, such as your tab selection or grid layout preference.
• Analytics cookies: help us understand usage patterns so we can improve the Platform. We use privacy-preserving analytics tools and do not build advertising profiles.
• Third-party cookies: our payment processor and social login providers may set their own cookies. Refer to their privacy policies for details.

You can control non-essential cookies through your browser settings or via our cookie banner. Note that disabling cookies may affect some Platform features.

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Active account data is retained indefinitely while your account exists.
• Messages are retained for 2 years from the date sent, then automatically deleted.
• Deactivated listings are retained for 6 months, then permanently deleted.
• After you delete your account, most personal data is deleted within 30 days. Some data may be retained for up to 7 years where required by law (e.g., payment records).
• Aggregated, anonymized analytics data may be retained indefinitely — it cannot be linked back to you.

Depending on where you live, you may have certain rights regarding your personal data. We honor these rights for all users regardless of location.

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data. You can also delete your account directly from Account → Settings → Danger Zone.
• Portability: request your data in a structured, machine-readable format.
• Opt-out of marketing: unsubscribe from non-essential emails at any time via the unsubscribe link or from Account → Settings → Notifications.
• Withdraw consent: where processing is based on your consent (e.g., connecting a social account), you can withdraw it at any time.

To exercise any of these rights, email us at privacy@subscapes.co. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

We take reasonable technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption in transit (TLS) for all data sent between your device and our servers.
• Encryption at rest for sensitive fields including passwords (hashed with bcrypt) and payment tokens.
• Role-based access controls so only authorized team members can access user data, and only for legitimate purposes.
• Regular security audits and penetration testing.
• Incident response procedures with user notification in the event of a data breach affecting your data.

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at security@subscapes.co.

The Platform is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@subscapes.co and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by displaying a prominent notice on the Platform at least 14 days before the change takes effect. The 'Last updated' date at the top of this page reflects the most recent revision.

Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please reach out:

• General privacy inquiries: privacy@subscapes.co
• Data deletion requests: privacy@subscapes.co
• Security vulnerabilities: security@subscapes.co
• Safety concerns: safety@subscapes.co
• Mailing address: Subscapes, Inc., 228 Park Ave S, New York, NY 10003