Privacy Policy
A-du Privacy Policy
Table of Contents
1. Overview
Effective Date: January 1, 2026
Last Updated: September 24, 2026
A-du, LLC ("A-du," "we," "us," or "our") is committed to protecting your privacy and being transparent about how we collect, use, and share your personal information. This Privacy Policy describes our data practices for the A-du Platform (website, mobile applications, and related services).
Key Points
- • We collect information necessary to operate our technology platform and facilitate connections between Landlords and Tenants
- • We do NOT sell your personal information to third parties
- • California residents have specific privacy rights under CCPA/CPRA
- • We use industry-standard security measures to protect your data
- • You have control over your personal information and can exercise privacy rights
By using the A-du Platform, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, you should not use the A-du Platform.
2. Information We Collect
2.1 Information You Provide Directly
Account Registration Information:
- • Full legal name
- • Email address and phone number
- • Password (encrypted and never stored in plain text)
- • Date of birth
- • Profile photo (optional)
- • Biographical information (optional)
Identity Verification Information:
- • Government-issued ID (driver's license, passport, state ID)
- • Social Security Number or Individual Taxpayer Identification Number (encrypted)
- • Facial recognition data for ID verification (processed by Stripe Identity)
- • Address verification information
Landlord Information:
- • Property addresses and descriptions
- • Property photos and videos
- • Rental pricing and availability
- • House rules and policies
- • Bank account information for payment processing (stored by Stripe)
- • Tax identification (EIN or SSN for 1099 reporting)
Tenant Information:
- • Employment information and income verification
- • Rental history and references
- • Emergency contact information
- • Payment method information (credit/debit card, bank account - stored by Stripe)
Communications and Content:
- • Messages exchanged through the A-du Platform
- • Reviews and ratings you post
- • Customer support inquiries and correspondence
- • Survey responses and feedback
2.2 Information Collected Automatically
Device and Usage Information:
- • IP address and geolocation data
- • Device type, operating system, and browser type
- • Pages visited, features used, and time spent on platform
- • Referring URLs and exit pages
- • Click-stream data and interaction patterns
- • Mobile device identifiers (IDFA, Android Advertising ID)
2.3 Information from Third Parties
Background Check Information:
We obtain background check information from third-party consumer reporting agencies, including:
- • Criminal records (felony and misdemeanor convictions)
- • Sex offender registry status
- • Eviction history
- • Credit reports (with your consent, for Tenants)
- • Watch list screening results
Payment Processing Information:
Stripe, Inc. provides payment processing and collects payment information directly from you. Stripe shares limited information with us including transaction confirmation, payment status, and payout details. We do not directly store your full credit card numbers or bank account numbers.
2.4 Information Collected Through AI Assistants
A-du publishes a Model Context Protocol (MCP) server at a-du.homes/mcp so that AI assistants, such as Claude or ChatGPT, can search rental listings, look up ADU rules and building plan information, and, where you have signed in and approved access, act on your behalf. Anyone may connect an assistant to A-du; most of what it can read is the same public marketplace information available on our website.
What We Record for Each Assistant Request:
- • Which assistant: the client name and version the assistant reports
- • Which capability was used: the tool name, whether it succeeded, any error code, and how long it took
- • Network address: a salted, truncated SHA-256 hash of the address the request came from. We do not store the address itself
- • Your account identifier: only when the request used access you approved. It is absent for public searches, which are not linked to any account
- • Structured filters only: a fixed, predetermined list of values such as a city, price range, bedroom count, jurisdiction, or listing identifier
What We Do Not Record:
We do not record free text sent to or from an assistant. Questions you ask, street addresses you supply, the contents of messages and replies, and the titles and descriptions of listings are all excluded. This is enforced by an allowlist in our software, which records only the specific fields named above and discards everything else, rather than by removing sensitive text afterward.
Approving and Revoking Assistant Access:
An assistant can only act on your behalf, such as requesting a tour or sending an inquiry, after you sign in to A-du and explicitly approve it. Approving an assistant does not give it your password. Actions it takes for you are recorded the same way as actions you take on the website, and appear in your account alongside them.
You can see every assistant you have connected, and revoke any of them at any time, under Connected Agents in your profile settings. Revoking takes effect immediately.
We use these records to operate and secure the service: to enforce rate limits, diagnose errors, detect abuse, and understand which capabilities are used. We do not sell them, and we do not use them to build advertising profiles.
3. How We Use Your Information
We use your personal information for the following purposes:
Platform Operations:
- • Create and manage Member accounts
- • Facilitate connections between Landlords and Tenants
- • Display property listings and enable searches
- • Process booking requests and confirmations
- • Enable messaging between Members
- • Provide customer support
Payment Processing:
- • Process rent payments and Platform Services Fees
- • Remit payments to Landlords
- • Handle refunds and cancellations
- • Detect and prevent payment fraud
- • Generate tax documents (1099-K forms)
Trust and Safety:
- • Verify Member identities
- • Conduct background and credit checks
- • Detect and prevent fraud, abuse, and illegal activity
- • Enforce our Terms of Service and policies
- • Investigate complaints and disputes
- • Comply with legal obligations
Platform Improvement:
- • Analyze platform usage and performance
- • Develop new features and services
- • Personalize user experience
- • Conduct research and analytics
- • Test and optimize platform functionality
Communications:
- • Send transactional notifications (bookings, payments, etc.)
- • Provide platform updates and announcements
- • Respond to inquiries and requests
- • Send marketing communications (with your consent)
- • Request reviews and feedback
Legal Compliance:
- • Comply with applicable laws and regulations
- • Respond to legal requests and court orders
- • Protect our legal rights and interests
- • Prevent illegal activity and enforce agreements
4. How We Share Your Information
We Do NOT Sell Your Personal Information
A-du does not sell your personal information to third parties for monetary consideration. We do not engage in the sale of personal information as defined by the California Consumer Privacy Act (CCPA).
4.1 Sharing with Other Members
To facilitate rental transactions, we share information between Landlords and Tenants:
- • The public sees: Listings with a city, ZIP code and an approximate map area. We do not publish a Listing's street address, precise location or building permit number.
- • Landlords see, before a lease is signed: a Tenant's first name and last initial, verification status, background check summaries (when applicable), and the answers and application details the Tenant provides. The Tenant's full profile (including surname and photo) is shown once a lease is signed.
- • Tenants see: Landlord profile information, property listings, property details and house rules. A Listing's exact address is shared with a Tenant when the Landlord approves the Tenant's request for it, accepts a tour, requests screening, confirms a reservation or sends an invitation, and always before a lease is signed.
- • Both parties see: Messages exchanged, booking details, payment status, and reviews/ratings
Data minimization: We disclose a Landlord's address and a Tenant's full identity only when a step in the rental process needs it. We keep a record of address requests, decisions and disclosures to review them for fair housing compliance and to prevent misuse.
Important: Once Landlords and Tenants form rental agreements, they may exchange additional information directly outside the A-du Platform. We are not responsible for information shared directly between Members outside our platform.
4.2 Service Providers and Business Partners
We share information with third-party service providers who perform services on our behalf:
Payment Processing:
Stripe, Inc. for payment processing, identity verification, and fraud prevention
Background Checks:
Consumer reporting agencies for identity verification, criminal background checks, eviction history, and credit reports
Cloud Infrastructure:
Cloud service providers for data storage and hosting
Communications:
Email and SMS service providers for transactional and marketing communications
Analytics:
Analytics providers to understand platform usage and improve services
All service providers are contractually bound to protect your information and use it only for the purposes we specify.
4.3 Legal and Safety Disclosures
We may disclose your information when required or permitted by law:
- • To comply with legal obligations, court orders, subpoenas, or legal processes
- • To respond to lawful requests from government authorities
- • To protect the rights, property, or safety of A-du, our Members, or the public
- • To detect, prevent, or address fraud, security, or technical issues
- • To enforce our Terms of Service and investigate violations
- • In connection with the investigation of suspected illegal activity
4.4 Business Transfers
If A-du is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the platform of any such change in ownership or control of your personal information.
4.5 Aggregated and De-Identified Information
We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you. For example, we may share statistics about platform usage, rental market trends, or demographic information in aggregate form.
5. California Privacy Rights (CCPA/CPRA)
Your California Privacy Rights
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Right to Know
You have the right to request disclosure of: (1) the categories of personal information we collected about you; (2) the categories of sources from which the information was collected; (3) the business or commercial purpose for collecting the information; (4) the categories of third parties with whom we shared your information; and (5) the specific pieces of personal information we collected about you.
Right to Delete
You have the right to request deletion of your personal information that we collected from you, subject to certain exceptions (e.g., when we need to retain information to complete transactions, comply with legal obligations, or detect security incidents).
Right to Correct
You have the right to request correction of inaccurate personal information we maintain about you.
Right to Opt-Out of Sale/Sharing
A-du does not sell your personal information. We do not share your information for cross-context behavioral advertising. However, if our practices change, we will provide you with the right to opt-out.
Right to Limit the Use and Disclosure of Sensitive Personal Information (Cal. Civ. Code § 1798.121)
Under the California Privacy Rights Act, you have the right to direct A-du, LLC to limit its use and disclosure of the Sensitive Personal Information ("SPI") we collect about you to what is reasonably necessary to perform the services you requested, to prevent fraud, or as otherwise permitted by Cal. Civ. Code § 1798.121.
The categories of SPI that A-du collects are:
- Social Security number or other government ID (collected only in connection with tenant screening and Stripe identity verification)
- Account log-in in combination with password or security-question answer
- Precise geolocation (only if you enable location on map features)
- Racial or ethnic origin (voluntary fair-housing demographic disclosure only)
- Contents of mail, email, or text messages where A-du is not the intended recipient (in connection with the on-platform messaging feature)
A-du uses SPI only for (i) delivering the specific service you requested (such as tenant screening), (ii) Stripe-required identity verification for payouts, (iii) security and fraud prevention, (iv) compliance with a legal obligation, or (v) non-inferring purposes permitted under § 1798.121(a). A-du does not use SPI to infer characteristics about you and does not sell or share SPI for cross-context behavioral advertising.
You may exercise this right by using the "Limit the Use of My Sensitive Personal Information" link in the A-du site footer, by emailing legal@a-du.homes, or by following the verification steps in § 5.1 below.
Right to Non-Discrimination
You have the right to not receive discriminatory treatment for exercising your CCPA/CPRA privacy rights. We will not deny services, charge different prices, or provide different quality of service because you exercised your privacy rights.
5.1 How to Exercise Your California Privacy Rights
To exercise your California privacy rights, you may submit a request:
- • Email: legal@a-du.homes
- • Phone: (325) 518-8918
- • Online Portal: Available through your account settings
- • Mail: A-du, LLC, Attn: Privacy Rights, [Address], Los Angeles, CA
Verification Process:
To protect your privacy, we will verify your identity before fulfilling your request. We may request additional information such as email verification, account credentials, or government-issued ID. For requests to delete or correct information, we may require higher levels of verification. You may also designate an authorized agent to make requests on your behalf by providing written authorization.
Response Timeline:
We will respond to verified requests within 45 days of receipt. If we need more time (up to 90 days total), we will notify you of the extension and the reason. If we cannot fulfill your request, we will explain why.
5.2 Categories of Personal Information Collected (CCPA)
In the preceding 12 months, we have collected the following categories of personal information:
- • Identifiers: Name, email address, phone number, postal address, IP address, account username
- • Personal Information (Cal. Civ. Code § 1798.80(e)): Name, address, SSN/ITIN, bank account number, credit/debit card number
- • Protected Classification Characteristics: Age, date of birth, sex/gender (voluntarily provided)
- • Commercial Information: Rental history, transaction history, Platform Services Fees paid
- • Biometric Information: Facial recognition data for ID verification
- • Internet/Network Activity: Browsing history, search history, interaction with platform
- • Geolocation Data: Physical location derived from IP address or device
- • Professional/Employment Information: Current employer, job title, income
- • Education Information: School attended (if voluntarily provided)
- • Inferences: Profile reflecting preferences, characteristics, behavior, attitudes
5.3 California "Shine the Light" Law
California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. A-du does not share personal information with third parties for their direct marketing purposes.
6. Data Security
We implement reasonable and appropriate security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction.
Security Measures Include:
- • Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
- • Access Controls: Role-based access with least-privilege principles
- • Authentication: Secure password requirements and optional two-factor authentication
- • Secure Infrastructure: Industry-standard cloud security practices
- • Regular Security Audits: Periodic vulnerability assessments and penetration testing
- • Employee Training: Security awareness and data protection training for all staff
- • Incident Response: Procedures for detecting, responding to, and reporting security incidents
- • Third-Party Security: Vendor security assessments and contractual safeguards
Important: No Security is 100% Guaranteed
While we implement strong security measures, no internet transmission or electronic storage is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and should notify us immediately if you suspect unauthorized access to your account.
6.1 Data Breach Notification Procedure
A-du, LLC notifies affected individuals and regulators of data security incidents in accordance with California Civil Code § 1798.82 and § 1798.29, the HIPAA Breach Notification Rule (where applicable), the FTC Health Breach Notification Rule (where applicable), and any other federal or state breach-notification law that applies to the data category involved.
A. When notification is triggered.
A-du will notify you if there has been a breach of the security of a system we maintain that reasonably resulted in, or is reasonably believed to have resulted in, the unauthorized acquisition of your unencrypted personal information (as defined by § 1798.82(h)), or of encrypted personal information together with the key necessary to decrypt it. Examples include unauthorized acquisition of Social Security numbers, driver's-license numbers, financial account numbers, usernames paired with passwords, health or medical information, biometric data, or genetic data.
B. Timing.
A-du will notify affected individuals "in the most expedient time possible and without unreasonable delay" consistent with the needs of law enforcement, the scope of the breach, and any measures necessary to restore reasonable integrity to the data system. Where the incident affects the personal information of more than 500 California residents, A-du will also submit the sample notification to the California Attorney General at oag.ca.gov/privacy/databreach/report. Where the incident falls under federal breach laws (e.g., HIPAA or the FTC Health Breach Notification Rule), A-du will meet the applicable federal notification deadlines.
C. Method of notification.
Notices will be delivered by (i) email to the address on file, or (ii) conspicuous posting on the A-du Platform combined with notification to major statewide media where email is not feasible or as required by § 1798.82(j). Substitute notice will be used only where permitted by statute.
D. Contents of the notice.
Each breach notification will include, at a minimum: (1) the name and contact information of A-du, LLC; (2) a list of the types of personal information that were or are reasonably believed to have been subject to the breach; (3) if known, the date, estimated date, or date range of the breach; (4) whether the notification was delayed as a result of a law enforcement investigation; (5) a general description of the incident; (6) the toll-free telephone numbers and addresses of the major credit reporting agencies; and (7) any other content required by § 1798.82(d).
E. Internal escalation and remediation.
Upon discovery or reasonable suspicion of a breach, A-du will (i) initiate internal incident-response procedures, (ii) engage forensic resources as appropriate, (iii) determine the scope of affected data and individuals, (iv) preserve evidence, (v) identify and close the vulnerability, (vi) evaluate additional regulatory obligations (HIPAA, GLBA, FTC Health Breach Notification Rule, SEC disclosure obligations, or other sector-specific rules), and (vii) provide a post-incident summary to affected individuals describing the corrective measures taken. Members may report suspected security incidents to legal@a-du.homes.
7. Data Retention
We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.
Retention Periods:
- • Active Accounts: Information retained for duration of account activity
- • Closed Accounts: Most information deleted within 90 days of account closure, except as required for legal compliance
- • Transaction Records: Retained for 7 years for tax and accounting purposes
- • Communications: Messages retained for 3 years after rental completion
- • Identity Verification: Verification records retained for 5 years for compliance
- • Background Checks: Retained for 7 years per FCRA requirements
- • AI Assistant Call Records: Technical records described in Section 2.4, retained for operational and security monitoring. These contain no free text. Where a request used access you approved, the record includes your account identifier
- • Legal/Compliance: Information retained as required by law or to defend legal claims
When we no longer need your information, we securely delete or anonymize it. Anonymized or aggregated data may be retained indefinitely for analytics and research purposes.
9. Third-Party Services and Links
The A-du Platform may contain links to third-party websites, services, or integrations (such as Stripe, Google Maps, social media platforms). This Privacy Policy does not apply to third-party services.
We Are Not Responsible for Third-Party Privacy Practices
Third-party services have their own privacy policies and terms of service. We encourage you to review the privacy policies of any third-party services you access through or in connection with the A-du Platform. We are not responsible for the privacy practices or content of third parties.
Key Third-Party Services:
- • Stripe: Payment processing and identity verification - Stripe Privacy Policy
- • Google Maps: Property location display - Google Privacy Policy
- • Background Check Providers: Identity and background verification services
- • Rental Listing Partners: If A-du syndicates a Listing to a rental listing partner (for example Zillow), the partner receives the Listing's details, including its address for mapping, and A-du instructs the partner not to display the street address
- • Email/SMS Providers: Transactional and marketing communications
10. Children's Privacy
The A-du Platform is NOT intended for children under 18 years of age.
We do not knowingly collect personal information from individuals under 18. You must be at least 18 years old to create an account and use the A-du Platform. If we discover that we have collected information from someone under 18, we will promptly delete that information. If you believe we have collected information from a minor, please contact us immediately at legal@a-du.homes.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:
- • Posting the updated Privacy Policy on the A-du Platform with a new "Last Updated" date
- • Sending an email notification to your registered email address
- • Displaying a prominent notice on the platform
Your continued use of the A-du Platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated Privacy Policy, you should stop using the platform and may close your account.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
A-du Privacy Contact Information
Email: legal@a-du.homes
Mail:
A-du, LLC
Attn: Privacy Officer
453 S Spring St. Ste. 400 #100
Los Angeles, CA 90013
For California Privacy Rights Requests: Please use the contact methods listed in Section 5.1 above. Include "California Privacy Rights Request" in the subject line and provide sufficient information for us to verify your identity.
Last Updated: September 24, 2026
This Privacy Policy is effective as of the date listed above and applies to all information collected by A-du, LLC through the A-du Platform.