Privacy

This page describes what Rental Hunter stores, why it stores it, how long it keeps it and how you remove it. It is written from what the software actually does, not from a template. It is not legal advice.

Who runs Rental Hunter, and how to reach us

Rental Hunter is an independent tool, built and run by its founder, Riccardo. It is not affiliated with, endorsed by, or partnered with Daft.ie.

Write to info@rentalhunter.ie to ask for a copy of what is held about you, to have something corrected, to have your data deleted, or to ask anything at all about how your data is handled. That address reaches the person who runs the service, and it is the right place to start for any of it.

Most of it you can also do yourself, immediately, from the dashboard. Where that is the case it is noted below.

What is stored

Your account

Your name, your email address and a hashed form of your password. The password itself is never stored. Sessions are held in a signed token in your browser rather than in a server-side session table.

Your search configuration

Everything you enter when setting up and editing your search: the area or map pin and radius, price range, bedroom and bathroom bounds, property types, furnishing preference, lease length, availability window, keywords to match, keywords and agency licence numbers to exclude, and the timezone your search runs in.

The details used in your applications

Your full name, phone number, number of adults, whether you have pets and any description of them, your intended moving date and the message template you wrote. These are what gets sent when an application is submitted, so they are stored exactly as you entered them.

The credentials you supply

Your Daft.ie email address, and your Telegram bot token and chat identifier. Rental Hunter needs these because it acts on your behalf: the enquiry is sent from your own Daft.ie account, and the notification is sent through your own Telegram bot. Rental Hunter never asks for or stores your Daft.ie password. You sign in to Daft.ie yourself, through a streamed view of the browser your bot uses, and Rental Hunter keeps only the signed-in profile of that browser. Your Telegram bot token is encrypted before it is stored, using AES-256-GCM with a key held in the server environment.

Your application history

For every application attempt: the listing identifier and link, the address, the monthly price, the outcome status, the reason where an attempt was skipped or failed, the agency or seller type, the timestamp, the message that was sent and the applicant details used. Alongside it, a snapshot of the listing as it stood at the moment of applying: its description, bedrooms, bathrooms, property type, availability, facilities, BER rating, seller licence number, coordinates and the listing photos.

Why it is stored

Every field above exists because the product needs it to work. The search configuration decides what qualifies as a match, the applicant details and message are the content of the application itself, the credentials are what allows the application to be sent as you and the notification to reach you, and the history is the record you asked the product to keep so you can see what it has done on your behalf.

Rental Hunter does not sell your data, does not share it with advertisers, and does not use it to build a profile of you. The only third parties it transmits anything to are the ones you deliberately connected: Daft.ie, when it submits an application under your account, and Telegram, when it notifies you through your own bot, and, in Extension mode, the browser's push service, which carries a content-free wake-up message (see Extension mode below).

How long it is kept

• Your account and search configuration are kept for as long as your account exists.
• Application history is kept for a retention period configured on your account, which defaults to 365 days.
• You can auto-archive older applications out of your main view at any time. Archiving hides them from your default list, it does not delete them.

Deleting your data

You can delete your account yourself from the dashboard. Deletion first marks the account as deleted and ends your access. After a grace period of 30 days, a scheduled job irreversibly anonymises the account: the email address is replaced with a placeholder, the personal details are cleared, and the search configuration, including your Daft.ie and Telegram credentials, is removed. The account's Extension connection records are deleted at the same time, as described below.

Applications previously recorded are detached from the account rather than removed, so no personal identifier remains attached to them.

Access and correction

Everything Rental Hunter holds about you is visible and editable from the dashboard: the search configuration and applicant details in your settings, and the full application history, including the message sent and the listing snapshot, on the applications pages.

If you would rather not do it yourself, or you want a copy of it in one piece, write to info@rentalhunter.ie and ask.

Extension mode

In Extension mode, a browser extension applies to your matches from your own browser, with the Daft.ie account you are signed in to there. Before you can connect it, the extension shows what it does and sends and asks for your agreement; you give it in the extension, before connecting. The sections above still apply. This section adds what is particular to the extension.

What the extension keeps in your browser

The connection token that identifies your account to Rental Hunter, its settings and state, and the application it is working on. It reads Daft.ie pages only to apply. The listing description and seller licence number it reads there are checked against your exclusions in the browser and are never sent to Rental Hunter.

What the extension sends to Rental Hunter

• When you connect: the browser name and operating system, the extension and Chromium version, and the version of the disclosure you accepted.
• Check-ins, on every change of state and hourly: the extension and Chromium version, its state (running, paused, signed out of Daft.ie, waiting for a Daft.ie check, or missing profile details), whether automatic sending is on, and whether push is working.
• Attempt reports, one for each try at a match: the match, the permission (grant) id, the outcome (sent, skipped, failed or a test run), a reason code, the step that failed, when the form opened and when Send was confirmed, and the extension version.
• Error reports, when something breaks: a reason code, the failing step, the extension version, the Daft.ie listing identifier and the lines of the extension's own code involved. They never include page content, HTML or listing descriptions.
• Its push subscription, so that Rental Hunter can wake it when matches are waiting.

The extension never sends your cookies, session tokens or passwords. Check-ins and error reports are required to run the service: there is no setting to turn them off. Disconnecting the extension stops them.

Push

Rental Hunter wakes the extension with a content-free Web Push message. It travels through the browser vendor's push service, which for Chrome is Google's push service, so that service sees that a message was sent to your browser. The message carries no data about you or your matches.

How long the extension's data is kept

• The connection record (browser, versions, state and the disclosure version you accepted) is kept while your account exists, and also after you disconnect, with no time limit today. Only the latest check-in of each connection is kept.
• The push subscription is dropped when a connection ends: when you disconnect, when a newer connection replaces it, when an administrator ends it or removes your Extension access, when your account is deleted, rejected or deactivated, or when it expires after 30 days without contact.
• State changes and error reports are kept for 30 days. A recorded Daft.ie ban report is kept without a time limit while your account exists.
• Attempt reports belonging to an application follow the retention of the application they belong to (365 days by default, as above). Attempt reports without an application, for example test runs, attempts that will be retried, and skipped or failed attempts reported without a valid permission or for a match that was no longer waiting, are kept for 30 days.
• Within about 31 days after you delete your account (a daily job runs after a 30-day grace period), its connection records are deleted, with their check-ins, state changes, error reports, attempt reports and any recorded ban report.

Changes to this page

If what the software stores changes, this page is updated with it. The date at the top is the date of the most recent revision.