Privacy and Consent

Privacy and consent are critical. The platform must separate normal service processing from profiling, score sharing, marketing, and marketplace visibility.

Processing categories

Category	Meaning
Service data processing	Processing required to provide rental management features.
Profiling	Processing used to evaluate behavior, reputation, or risk.
Marketing	Processing used for promotional communication.

Service processing can be necessary for contract management. Profiling and score sharing require explicit opt-in consent.

Consent types

Consent type	Purpose
PROFILING	Allows calculation of behavioral or reputation scores.
SCORE_SHARING	Allows sharing a tenant score with other parties.
MARKETPLACE_VISIBILITY	Allows tenant or property data to appear in marketplace workflows.
MARKETING	Allows marketing communication.

Proposed entity: user_consents

Field	Description
id	Primary identifier.
user_id	User giving consent.
party_id	Business identity affected by consent.
consent_type	Consent category.
status	GRANTED or REVOKED.
granted_at	Grant timestamp.
revoked_at	Revocation timestamp.
source	UI, invitation flow, settings page, or support action.
policy_version	Privacy policy version accepted.

Opt-in and opt-out

• Profiling must be opt-in.
• Score sharing must be opt-in.
• Marketplace visibility must be opt-in.
• Users must be able to revoke consent.
• Revocation must stop future processing for that purpose.

Data minimization

Only process the minimum data required for the declared purpose. For example, marketplace matching does not need to expose raw bank transactions to landlords.

Explainability requirements

For any score or ranking, the platform should explain:

• which data categories were used
• the score version
• the main positive and negative factors
• the confidence level
• how the user can correct wrong data