This page is maintained by R2R Company Lets to answer common security and privacy questions about the platform. It describes platform capabilities and our current operating practices — it is not an independent certification.
Accounts are protected by email + password sign-in, with optional Google sign-in. Passwords are hashed by our authentication provider; we never see or store them in plain text.
Admin actions are gated server-side by role checks held in a dedicated roles table — never by client-side flags or local storage.
Subscription tier changes are applied only by authenticated payment webhooks or admin actions; users cannot self-upgrade.
Personal contact details (email, phone, verification numbers) are only visible to the account owner, to admins, and to people you explicitly approve via a contact request or who have paid the contact-reveal fee.
Listing private notes, full addresses, full postcodes, and deal-pack download links are restricted at the database layer to owners, admins, and verified paying users.
Property request notes and reference images are private to the requester.
We collect only what is needed to operate the listing marketplace: account profile, listings you create, favourites, requests you send, and payment metadata returned by the payment provider.
Row-Level Security is enabled on every user-data table. Column-level access controls additionally hide sensitive fields from regular signed-in users.
Listing images are kept in a private bucket and are only readable to the listing owner, to admins, and to viewers of an approved-and-active listing.
Sensitive RPCs are marked SECURITY DEFINER with a fixed search_path and live in a private schema where appropriate; each RPC checks ownership or admin role before returning rows.
Payments, subscriptions and promo codes are processed by Stripe. We do not store card numbers — Stripe holds the payment instruments.
Subscription tier changes are applied only via verified Stripe webhook signatures. Promo-code redemptions are recorded server-side for audit.
Refund and billing questions: email rent2rentsa@hotmail.com.
Verification is optional by default and can be toggled on or off by admins for the whole platform.
You can submit your ID and Property Redress Scheme (PRS) number from your profile. Admins review submissions before any verified badge is displayed; submissions are visible only to you and to admins.
Manage your verification in Your Profile.
Listings from sourcers are automatically removed after 3 months of inactivity. Landlord listings are retained until removed by the landlord.
You can delete your own listings, favourites, contact requests, and reports at any time from your account.
To request full account deletion or export of your personal data, contact us at rent2rentsa@hotmail.com and we will action the request.
The platform runs on managed cloud infrastructure with TLS in transit. The database is backed up by the managed backend provider on the schedule of their plan.
Every listing has a "Report this listing" button. Reports are reviewed by admins and may result in the listing being suspended or removed.
Security concerns or data requests: rent2rentsa@hotmail.com.
For general questions visit our Contact page.
Shared responsibility: R2R Company Lets operates the platform features described above. Users are responsible for keeping their account credentials safe, the accuracy of information they post, and complying with applicable letting and data-protection law in their jurisdiction.