Privacy Policy

Effective date: July 1, 2026  ·  Last updated: July 2026

1. Overview

Haven operates a rental listing platform that connects property owners, landlords, agents, and renters across New York, New Jersey, and Connecticut. This Privacy Policy explains what personal information Haven collects when you use the platform, how it is used and stored, who it is shared with, and what rights you have over your data. Please read it alongside Haven's Terms & Policy.

Haven is the data controller for the personal information described in this policy. If you have questions, see Section 11 (Contact) for how to reach us.

2. Data We Collect

Haven collects information in the following categories:

Account registration. When you create an account you provide your first name, last name, email address, account type (agent, owner, or landlord), and a password (stored as a one-way hash — the raw password is never stored). Phone number and agency/company name are optional.

Listing submissions. When you submit a rental listing you provide: property name, neighborhood, rent price, number of bedrooms, availability, a photo URL, a description, amenities, broker fee details, and voucher / PHA acceptance information. This information is published publicly on the platform.

Listing inquiries and messages. When a prospective tenant sends an inquiry through a listing's contact form, Haven stores the sender's name, message text, and any file attachments uploaded (PDFs, Word documents, images, spreadsheets, or plain-text files up to 15 MB each). These messages are visible only to the agent or owner who posted the listing.

Problem reports. If you submit a problem report through the site footer, Haven stores the optional name, optional email address, and problem description you provide.

Search inputs. The neighborhood, bedroom, and price filter fields on the listings page are used to filter results in your browser. These inputs are not sent to or persisted on Haven's servers.

Payment information. Listing fees are processed by Stripe. Haven does not collect or store raw credit card numbers, CVVs, or bank account details. Stripe receives your payment information directly under Stripe's own privacy policy, available at stripe.com/privacy. Haven retains only the Stripe checkout session ID and payment status needed to publish your listing.

Technical and usage data. Haven's server logs may capture your IP address, browser type, and the URLs you request as part of normal web server operation. These logs are used for security monitoring and are not linked to your account profile.

3. Cookies and Tracking

We use an essential cookie to keep you signed in for approximately 30 days. This cookie is required for login. Optional analytics is off by default. Our cookie banner lets you accept or reject analytics, and stores that choice in your browser's local storage. You can change it at any time using “Cookie settings.” Rejecting analytics does not prevent you from using the site.

With your permission, we and our partners may collect data about how you use the site to help us improve its features and your experience. When configured, optional analytics tools load only after you choose “Accept cookies.” Withdrawing permission disables these tools, clears their first-party analytics cookies, and reloads the page to stop the loaded scripts. Withdrawal does not erase data previously collected with your permission.

Font files are loaded from Google Fonts (fonts.googleapis.com). As with any external resource, your browser sends its IP address to Google's servers as part of that request. Google's handling of this data is governed by Google's Privacy Policy.

When enabled on the published site, Replit-hosted analytics measures page views and interactions such as viewing or saving a listing, sending a message, and starting checkout. Haven's custom events include only limited interaction details, such as whether a listing accepts vouchers or a message includes an attachment; they do not include names, email addresses, property addresses, account identifiers, or message contents. These measurements help us understand how the service is used, not target advertising.

4. How Haven Uses Your Information

Haven uses the information described above to:

• Create and authenticate your account (legal basis: performance of a contract).
• Publish rental listings you submit after payment is confirmed (legal basis: performance of a contract).
• Deliver listing inquiries and file attachments to the listing's owner or agent (legal basis: performance of a contract; legitimate interest of the renter seeking housing).
• Respond to problem reports you submit (legal basis: legitimate interest).
• Detect and prevent fraud, abuse, and unauthorized access (legal basis: legitimate interest; legal obligation).
• Maintain platform security and comply with applicable law (legal basis: legal obligation).

Haven does not sell, rent, or trade your personal information to third parties for their own marketing purposes.

5. Storage and Security

Account data and listing information are stored in a managed PostgreSQL database. Passwords are hashed using bcrypt and are never stored in plaintext. File attachments uploaded through listing inquiries are stored on the server and are accessible only to the authenticated agent who owns the listing.

Haven applies standard security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) on all responses. Admin authentication endpoints are rate-limited and apply a lock-out policy to reduce brute-force risk. In accordance with the New York SHIELD Act, Haven maintains reasonable administrative, technical, and physical safeguards to protect the private information of New York residents.

No transmission over the internet is 100% secure, and Haven cannot guarantee absolute security. In the event of a data breach affecting New York residents' private information, Haven will notify affected individuals and the New York Attorney General as required by law.

6. Third-Party Services

Haven works with the following third parties who may process personal data:

• Stripe — payment processing for listing fees. Stripe receives payment card details and billing information directly and acts as an independent data controller for that information. See stripe.com/privacy.
• Google — optional OAuth sign-in and font delivery. If you use "Sign in with Google," Google authenticates you and shares your email and account identifier with Haven. Font files are loaded from Google's CDN, which involves transmitting your IP address to Google. See Google's Privacy Policy.
• Apple — optional OAuth sign-in. If you use "Sign in with Apple," Apple authenticates you and shares your email (or a private relay address) and account identifier with Haven. See Apple's Privacy Policy.

Haven does not share your personal data with any other third parties except as required by law or to protect the rights, property, or safety of Haven, its users, or the public.

7. Data Retention and Deletion

Haven retains your account information and listings for as long as your account is active. Listings automatically expire 29 days after they are published. Expired listings are no longer shown publicly but may remain in the database for a limited period for security and legal-compliance purposes.

You may permanently delete your account at any time from your account dashboard. Upon deletion, your personal account record (name, email, password hash, phone, agency) is permanently removed, and your agent name, agency, and phone number are cleared from any listings you posted. Your listings themselves remain on the platform until their normal 29-day expiry but will no longer display your contact details. If you wish to remove your listings entirely before closing your account, delete them individually from your dashboard first. Account deletion cannot be undone, and no refund will be issued for fees paid prior to deletion.

Problem reports are retained for operational and legal compliance purposes and are not automatically deleted on account closure.

Server access logs are retained for a limited period consistent with security monitoring needs and are then deleted.

8. Your Privacy Rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Right of access — request a copy of the personal data Haven holds about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data, subject to legal retention obligations.
• Right to restriction — request that Haven limit how it processes your data.
• Right to data portability — request your data in a structured, machine-readable format so you can transfer it to another service.
• Right to object — object to processing based on legitimate interest.
• Right to lodge a complaint — if you believe Haven has violated applicable privacy law, you have the right to lodge a complaint with a supervisory authority in your jurisdiction (e.g., your country's data protection authority or, for New York residents, the New York Attorney General's office).

To exercise any of these rights, use the Report a problem link in the site footer and describe your request. Haven will respond within 30 days (or within any shorter period required by applicable law).

9. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• The right to know what categories and specific pieces of personal information Haven has collected about you in the past 12 months.
• The right to delete personal information Haven has collected from you, subject to certain exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information. Haven does not sell or share personal information as defined by the CCPA/CPRA.
• The right not to receive discriminatory treatment for exercising your CCPA/CPRA rights.

To submit a CCPA/CPRA request, use the Report a problem link in the site footer. Haven will respond within 45 days.

10. Age Requirement

Haven is intended for users who are 18 years of age or older. Haven does not knowingly collect personal information from anyone under 18. By creating an account or submitting information through the platform, you confirm that you are at least 18 years old. If you believe someone under 18 has provided Haven with personal information, use the Report a problem link in the site footer and the information will be deleted promptly.

11. Changes to This Policy

Haven may update this Privacy Policy from time to time. The effective date at the top of this page reflects the most recent revision. For material changes, Haven will post a notice on the platform. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

12. Contact

For questions, requests, or complaints regarding this Privacy Policy or Haven's data practices, use the Report a problem form in the site footer. Haven will respond within 30 days.

Haven uses AI-assisted tools to help match listings and improve search results. No automated decisions with legal or similarly significant effects are made solely by AI without human review. AI can sometimes make mistakes — please verify important information independently.