Privacy Policy
1. What this policy covers
This policy explains how JustToMakeSure handles personal information when you create or use an account, submit a rental review, optionally upload proof of tenancy, vote, or report a review.
2. Information we collect
- Review submissions: property address, city/postal code/country, private tenant name, public display name, landlord name as shown on the lease, optional lease dates, ratings, review text, optional Instagram contact, and proof of tenancy.
- Published reviews: public display name, property, ratings, review text and limited tenancy information. Private identity and lease proof are not published.
- Reports: the review reported, reason and explanation. Name and email are optional for ordinary reports but required for a formal illegal-content notice where applicable.
- Anonymous voting: a pseudonymous Supabase user identifier/session used to enforce voting rules. No email, name or phone number is requested for voting.
- Technical/security data: hosting and security providers may process IP address, device/browser information and request logs needed to deliver and protect the service.
3. Why we use it
We use data to operate member access, publish and moderate reviews, verify tenancy when optional proof is provided, prevent fraud and automated abuse, operate voting, respond to reports and legal requests, secure the service, and establish or defend legal claims where necessary.
For users in the EEA/UK, the legal basis depends on the activity and may include your request/consent to publish a review, our legitimate interests in verification, fraud prevention, moderation and security, and compliance with legal obligations. You may withdraw publication consent; this does not make prior lawful processing unlawful.
4. Verification is limited
“Tenancy verified” means that we verified evidence that the reviewer rented the property. It does not mean that JustToMakeSure independently proved every factual statement in the review.
5. Retention
| Data | Normal retention |
|---|---|
| Raw tenancy proof and private verification identity | 90 days after publication; 30 days after rejection; maximum 180 days while a submission remains pending. |
| Legal/dispute hold | May temporarily extend the above period where reasonably necessary for a dispute, fraud investigation, legal claim or legal obligation. |
| Published review | While it remains part of the property history, unless removed, withdrawn, or no longer lawfully needed. |
| Review reports | Normally up to 24 months after resolution, longer only where a legal hold is justified. |
| Anonymous voting identifiers | For as long as reasonably needed to enforce voting integrity and the relevant award cycle, then deleted or aggregated where feasible. |
Deletion jobs run automatically for expired raw tenancy proofs and private verification identifiers. Metadata needed to show that verification occurred may be retained without the raw document.
6. Data minimisation
Please upload only the lease page(s) necessary for verification and redact unrelated bank information, signatures, government ID numbers, phone numbers, personal email addresses and other unnecessary information.
7. Service providers
The service currently relies on providers including Supabase (database, private storage and authentication), Cloudflare Turnstile (anti-abuse), GitHub Pages (site hosting), and mapping/geocoding infrastructure such as MapLibre, OpenFreeMap/OpenStreetMap and Photon. These providers may process technical information needed to provide their services. Some processing may occur outside your country; where required, transfers should rely on appropriate legal safeguards.
8. Sale, sharing and advertising
We do not sell personal information. We do not use personal information for cross-context behavioural advertising or targeted advertising. We do not publish raw tenancy documents, private tenant names or landlord contact details.
9. Local storage and cookies
No advertising or behavioural analytics cookies are currently used. Browser storage may hold the Supabase member session, the verified voting session and vote state on that device. A bounded address intent may be held temporarily in session storage to resume onboarding. Passwords and OTP codes are not written to custom application storage. Cloudflare Turnstile and infrastructure providers may use strictly necessary security mechanisms.
10. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, obtain a copy of your data, withdraw consent, or complain to a data protection authority. California and other US state laws may also provide rights to know, correct or delete personal information and to opt out of certain sales/sharing; we currently do not sell or share personal information for targeted advertising.
To exercise a right, contact [email protected]. We may need limited information to verify that the request relates to you.
11. Security
Tenancy proof is stored in private storage. Direct anonymous database access to verification tables is blocked. Access should be limited to people who need it for verification, moderation, security or legal handling.
12. Age
The review-submission service is intended for adults aged 18 or over. We do not knowingly request personal information from children for review submission or voting.
13. Reports and legal requests
Each published review includes a reporting mechanism. Formal illegal-content notices ask for the information needed to identify and assess the specific content. A report does not automatically mean content is unlawful or will be removed.
14. Changes
We may update this policy as the service changes. Material changes will be reflected by an updated date and, where required, additional notice.
Secure review editing
When an author requests an edit, we use the private email address already associated with the submission to send a secure link. The link token and edit session expire after one hour and are not published.
Proposed versions and technical edit history are kept privately for traceability, security, moderation, and dispute handling. Version history is not displayed publicly.
The landlord/owner name may be corrected by the author but remains private and is used only for consistency and verification checks, including checks against any proof of tenancy and automated/API processing. It is never included in the public review.
When proof is replaced or removed, the old proof stops being used for verification. Physical deletion remains governed by the retention periods and any justified dispute/legal hold described in this policy.
Questions and Answers: public and private data
When someone asks a question under a review, their chosen display name, question text, publication time, and any answer from the review author are public. Email addresses, verification codes, authentication identifiers, session tokens, anti-abuse data, and moderation audit data are not displayed publicly.
The questioner’s private email is used to send and verify a 6-digit code for every new question, send an answer notification, support anti-abuse controls, and authorize deletion of that question. Code verification may create a technical authentication record with Supabase Auth, but it does not create a public social profile, public account page, or public identity beyond the display name chosen for the question.
To authorize an answer, we use the existing private email already associated with the review author. It is used to send the verification code and notifications of new questions. After verification, a review-scoped session token may be kept only in browser session storage; the session expires after one hour and cannot be reused for a different review.
Questions and answers are automatically moderated for relevance and safety before publication. Technical moderation decisions and metadata strictly necessary for security, anti-abuse, traceability, and audit may be retained privately for a limited period that is reasonably necessary for those purposes. Longer retention may apply where needed for a legal obligation, report, dispute, or the establishment, exercise, or defence of legal claims.
When the questioner confirms deletion using the original email, the question and its answer disappear together from public display. Public deletion does not require immediate erasure of the minimal private records needed to document the deletion, prevent abuse, handle a report, or comply with legal requirements.
Transactional question-and-answer emails may be delivered through Resend; code verification uses Supabase Auth and anti-abuse protection includes Cloudflare Turnstile. Those providers receive only the information needed for the relevant function.
Member account, unlock status and deletion
The member account uses Supabase Auth as the technical identity. Access to real reviews depends on a server-side membership state; the browser does not decide whether a contribution qualifies. Before unlock, member catalogue APIs do not return exact review locations or review content. The locked map may nevertheless receive server-obfuscated coordinates to indicate the approximate existence of a review: each marker is placed within one kilometre of the real property, without an address, rating, review text, reviewer identity or usable review identifier.
When deleting an account, you may choose to keep published reviews in pseudonymised form or request their removal from catalogue visibility. Information required for a dispute, legal obligation, security control or audit may remain retained under the applicable rules. The deletion request itself may leave a technical audit record needed to reconcile or evidence completion.