This Privacy Policy describes how Novikov Studio LLC(“Company,” “we,” or “us”) collects, uses, shares, and protects personal information in connection with the website at https://rentacnyc.comand the related rental, sale, and installation services (collectively, the “Services”).

1. Scope

This Policy applies to information processed by the Company in connection with the Services. It does not apply to third-party websites or services that are linked from our website. Capitalized terms not defined here have the meanings given in our Terms of Service.

2. Information We Collect

2.1 Information you provide to us

• Contact and identifying information — name, email address, mobile phone number, residential or building address, apartment number, and floor.
• Installation details — window type, presence of a child age 10 or younger, walk-up/elevator status, building name, and notes you provide to the installer.
• Building information — when applicable, the name and email of your building management for the purposes of Certificate of Insurance issuance.
• Payment information — payment-card data is collected directly by our payment processor (presently planned to be Stripe, Inc.) and is not stored on our servers; we receive a payment-method token, billing zip code, and the last four digits of the card.
• Account and waitlist data — your email if you sign up for our waitlist or, when accounts launch, your account credentials and preferences.
• Voluntary communications — content of emails, text messages, and other correspondence you send to us.

2.2 Information collected automatically

• Device and connection data — IP address, browser type and version, device type, operating system, screen size, language, and timezone.
• Usage data — pages viewed, links clicked, time on page, referring URL, and aggregated booking-funnel events.
• Cookies and similar technologies — strictly necessary cookies for session continuity and security; analytics cookies only if you opt in (see Section 7).

2.3 Information from third parties

• Payment processor — transaction status, fraud-risk signals.
• Address validation — standardized form of the address you submit.
• Public records and building partners — when a partner building shares its Certificate of Insurance template or tenant list with us at your request or theirs.

3. How We Use Information

We use personal information to:

• Provide, schedule, and complete bookings and installations;
• Issue Certificates of Insurance to building management when requested;
• Process payments and manage subscriptions;
• Send transactional communications about your order (confirmation, ETA, removal);
• Provide customer support;
• Comply with legal obligations, including New York City building safety law;
• Detect, prevent, and address fraud, security, and technical issues;
• Improve and develop the Services in aggregated, de-identified form;
• With your consent, send marketing emails or SMS, which you may opt out of at any time.

4. Legal Bases (where applicable)

For users in jurisdictions that require it, our legal bases for processing are the performance of a contract with you (booking and fulfillment), our legitimate interests (operations, fraud prevention, service improvement), your consent (marketing communications, optional analytics), and compliance with legal obligations.

5. How We Share Information

We do not sell personal information for monetary consideration. We share information only as described below:

• Service providers (processors). Companies we use to deliver the Services, including: Cloudflare, Inc. (hosting, DNS, CDN, D1 database, edge assets); Stripe, Inc. (payments, subscriptions, tax calculation, when enabled); Twilio, Inc. (SMS, when enabled); Resend, Inc. (transactional email, when enabled); and similar reputable vendors bound by confidentiality and data-protection commitments.
• Building management. When you authorize us to issue a Certificate of Insurance, we share the COI with the building management you identify.
• Legal compliance. When required by law, subpoena, court order, or governmental request, or to enforce our Terms.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or substantially all of our assets, subject to standard confidentiality protections.
• Aggregated or de-identified data. Information that cannot reasonably be used to identify you, for any business purpose.

6. Where Your Information Is Stored

The Services are hosted on Cloudflare’s infrastructure, with the primary D1 database located in the U.S. East-North-America region. Vendors may process data in the United States or other jurisdictions consistent with their published terms.

7. Cookies and Analytics

We use a small number of strictly necessary cookies for session continuity and security. Where we use analytics or product-improvement cookies, they are loaded only after you opt in through our cookie banner. You may withdraw consent at any time through your browser settings or by clearing cookies for https://rentacnyc.com.

8. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Booking records and tax-relevant invoices are typically retained for a minimum of seven years to satisfy New York and federal recordkeeping requirements. You may request deletion of information that is not subject to a legal retention requirement.

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include TLS 1.3 in transit, encryption at rest in our hosting provider’s managed database, principle-of-least-privilege access controls, audit logging of administrative actions, and a dedicated address for vulnerability reports at security@rentacnyc.com. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

10. Your Rights

10.1 All users

• Access and correction. You may request a copy of the personal information we hold about you and ask us to correct inaccuracies.
• Deletion. You may request deletion of your information, subject to retention obligations described in Section 8.
• Marketing opt-out. Every marketing email contains an unsubscribe link, as required by the CAN-SPAM Act. To stop SMS, reply STOP to any message, per the TCPA and standard carrier conventions.

10.2 New York residents

We process personal information of New York residents in accordance with the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act, which requires reasonable safeguards and breach notification. Where a breach affecting your data occurs, we will notify you and the New York Attorney General as required by law.

10.3 California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”), gives you the right to know what categories of personal information we collect; the categories of sources, third-party recipients, and purposes; the right to request deletion or correction of your information; the right to opt out of any sale or sharing (we do not sell or share for cross-context behavioral advertising); the right to limit the use of sensitive personal information; and the right to non-discrimination for exercising any of the foregoing. To submit a request, email privacy@rentacnyc.com with “CCPA Request” in the subject line. We will verify your identity using information already on file (e.g., email + booking reference).

11. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us at privacy@rentacnyc.com and we will promptly delete it. The Services do collect information about whether a child age 10 or younger resides in the premises being serviced; that information is collected from the booking adult, used solely to comply with New York City Local Law 57 (window safety), and is not used for marketing or sold.

12. Third-Party Links

The website may contain links to third-party sites we do not control. We are not responsible for the privacy practices of those sites.

13. Changes to This Policy

We may update this Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated by email to active customers where reasonably possible.

14. Contact Us

To exercise any of the rights described above, ask a question about this Policy, or submit a complaint, contact us at:

Novikov Studio LLC d/b/a RentACNYC
Attn: Privacy
New York
New York, NY USA
privacy@rentacnyc.com