Smartrent

SmartRent Security & Data Privacy Overview

> Scope note: This document primarily describes SmartRent’s security practices and the categories of information it collects. It is not a complete privacy policy or terms-of-service agreement. Several important topics—such as formal privacy rights, AI training, dispute procedures, and policy changes—are not addressed.

1. Data Collection & Usage

Information collected

SmartRent says it collects three broad categories:

• User-provided information: Email address, mobile number, and similar registration details.
• Home information: Address and information about the home, including room names assigned in the app.
• Device and app activity: Interactions with connected devices and use of the app, including:
• Changing thermostat settings
• Locking or unlocking doors
• Granting visitor or service-provider access
• Other connected-device interactions

How information is used

The stated purposes are to:

• Register and authenticate users
• Send registration links and access codes
• Operate and support SmartRent devices and services
• Provide the user experience and manage app functionality

Retention

SmartRent states that device-activity data is encrypted and deleted after 30 days, with a full deletion when a resident moves out.

However, the document does not specify:

• How long account, contact, address, or home information is retained
• Whether data may be retained for legal, fraud-prevention, backup, or billing purposes
• How “move out” is determined or how quickly deletion occurs

2. User Rights

The document does not identify formal rights to:

• Access or receive a copy of personal data
• Correct inaccurate data
• Delete account or personal information
• Restrict or object to processing
• Port data to another provider
• Withdraw consent
• Appeal a privacy decision
• File a complaint with a regulator

It does state that device-activity data is deleted after 30 days and fully deleted upon move-out. This is a specific retention commitment, but it is not the same as a comprehensive data-rights process. Users would need to consult SmartRent’s broader privacy policy or contact SmartRent to determine whether additional rights apply under laws such as state privacy laws or the GDPR.

3. Third-Party Sharing

SmartRent says it does not sell personal information and does not sell it to third-party affiliates.

Nevertheless, information is processed by third parties involved in providing the service, including:

• Amazon Web Services (AWS), which hosts the platform and data
• Cloud, security, infrastructure, and other service providers
• Potentially SmartRent personnel and authorized contractors who require access

The document does not provide a full list of vendors, explain whether data is transferred internationally, or describe disclosures required by law. It also does not clearly explain what information property managers or landlords can access beyond stating that device-activity data is not visible to them in the platform.

4. AI/ML Training

The document is silent on artificial intelligence and machine-learning training. It does not say whether personal information, device data, or de-identified information is used to train SmartRent or third-party AI models. Users should not assume that the absence of a statement means data is excluded from AI training.

5. Key User Obligations

Users are instructed to:

• Protect their phones with a passcode or biometric security
• Secure the SmartRent mobile app
• Never share phones or personal access codes
• Reset door codes if they may be compromised

Users may also be subject to permissions and identity-verification requirements established by local property or community administrators. A practical risk is that anyone with access to the user’s phone, app credentials, or door code may potentially access the home or connected devices.

6. Liability & Disputes

The document describes safeguards, including encryption, firewalls, access controls, vulnerability scanning, penetration testing, MFA, and incident-response procedures. It also references ISO 27001 certification and SOC 2 Type II audits.

However, it contains no express provisions addressing:

• Liability for security incidents or unauthorized access
• Service interruptions or device failures
• Indemnification
• Arbitration or court jurisdiction
• Class-action waivers
• Notice requirements for claims
• Available remedies or damages caps

Security certifications and encryption reduce risk but do not guarantee that breaches or operational failures cannot occur.

7. Changes

The document does not explain:

• How SmartRent will notify users of updates
• Whether notice will be sent by email, app notification, or website posting
• When changes become effective
• Whether continued use constitutes acceptance

Users should look for a separate privacy policy or terms of service containing these provisions.