Privacy Policy

1. Information We Collect

Account Information: Name, email address, and password when you create an account.

Traveler Profile Information: Assignment market and dates, housing search preferences (budget, dates, pets, smoking, commute), and profession category you provide.

Landlord and Property Information: Property address, listing details, and the documentation you provide to verify property authority.

Verification Data: Evidence you submit for identity, healthcare-credential, assignment, or property verification is handled in a private review workflow and removed after review is complete. We keep the resulting verification status — not the underlying documents. Background checks are processed by Checkr, a consumer reporting agency; information such as date of birth and Social Security Number is collected by Checkr, not stored by CoStint.

Payment Information: Payments are processed by Stripe. We store payment status and history but never your card or bank numbers.

Usage Data: IP address, browser type, pages visited, and interaction patterns for analytics and security purposes. Our product analytics are cookieless.

2. How We Use Your Information

• To operate the housing marketplace: listings, saved searches, applications, bookings, and messaging
• To verify identity, professional credentials, assignment timing, and property authority
• To process placement fees, rent, and deposit payments
• To send transactional emails (application updates, verification updates, payment receipts)
• To improve the Platform and fix bugs
• To prevent fraud and enforce our Terms of Service

3. Information Sharing

We share your information only in these circumstances:

• With transaction counterparties: Counterparties see privacy-safe profile summaries and verification status only — never license numbers, dates of birth, background-report contents, or uploaded documents. A listing's exact address is shared only after mutual interest; public listing cards show neighborhood and commute context.
• With service providers: Checkr (background checks), primary-source licensing registries such as Nursys and applicable licensing boards (credential review), Stripe (payments), Firebase / Google Cloud (infrastructure), Vercel (hosting and cookieless analytics), Google Maps (location and commute context), Resend and Beehiiv (email).
• Legal requirements: When required by law, subpoena, or legal process

We never sell your personal information to third parties.

4. Background Checks

Background checks run only with your consent at the point they are needed for a transaction — never automatically at signup. Checkr is the consumer reporting agency; required disclosures and authorizations are provided through Checkr. CoStint stores and shares an aggregate status only. Counterparties never see the underlying report or any charge-level detail.

5. Data Security

We implement industry-standard security measures including encryption in transit (TLS), httpOnly session cookies, rate limiting, input validation, and Content Security Policy headers. Verification evidence is restricted to audited reviewer access and removed after adjudication.

6. Data Retention

We retain your account data as long as your account is active. Verification evidence is purged after review; verification status records are retained while your account is active. Background check results are retained for the duration required by applicable law. Transaction records are retained as required for financial and legal compliance.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data — we complete verified deletion requests within 45 days
• Object to processing of your data
• Export your data in a portable format

California residents have additional rights under the CCPA/CPRA. Contact us to exercise any of these rights. You can opt out of product analytics at any time using the Cookie Preferences link in the site footer.

8. Cookies & Analytics

We use a single httpOnly session cookie ("__session") for authentication. Our product analytics are cookieless. We do not use tracking cookies or third-party advertising cookies. A consent notice is shown on first visit, and you can change your analytics choice any time via the Cookie Preferences link in the site footer.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notice. Continued use after changes constitutes acceptance.

10. Contact

Privacy questions or data requests? Contact us at privacy@costint.com.