Her Own Sky LLC (“Her Own Sky,” “Company,” “we,” “us,” or “our”) operates the Covelight mobile applications, website, and related services (collectively, the “Service”).
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use Covelight. It also explains the choices and privacy rights that may be available to you.
This Privacy Policy is a notice of our data practices. Covelight is a property listing and management software platform, not a payment processor, rental agency, or property manager. Certain features, including bank account verification, payment authorizations, tenant-authorized sharing, and payments processed by Stripe, may require separate notices, authorizations, or consents.
Covelight is intended for users in the United States who are at least 18 years old.
1. Information We Collect
1.1 Account and Profile Information
When you create or use a Covelight account, we may collect your name, email address, telephone number, account role, profile information, authentication information, and other information needed to establish and maintain your account.
Your account role may include landlord, tenant, host, guest, property manager, or another role made available through the Service.
Depending on the authentication method used, authentication credentials may be processed by Covelight or an authentication service provider.
1.2 Financial and Payment Information
Covelight provides software that lets property owners and hosts request payments and lets tenants and guests set up and authorize payments. Those payments are processed by Stripe directly into the owner’s or host’s own Stripe account. Covelight does not receive, hold, or transfer rent or booking funds. Covelight also bills property owners for their software subscriptions.
We may collect or process financial information such as limited bank account identifiers (for example, the bank name and last four digits), payment instructions, rent amounts, payment schedules, installment configurations, transaction history and payment status received from Stripe, returned-payment and dispute information, records of which months’ rent was received in full, payment authorization records (see Section 1.11), subscription billing information, and related records.
Bank-account verification is provided by Stripe through Stripe Financial Connections or, where that is unavailable, by micro-deposits. Rent and booking payments are processed by Stripe as direct charges on the property owner’s or host’s own Stripe account. Subscription payments to Covelight are processed by Stripe.
Covelight previously used other providers, including Dwolla for ACH transfers and Plaid for bank linking. These providers are no longer used. Records from them may be retained where reasonably necessary for legal, accounting, dispute, or recordkeeping purposes, as described in Section 9.
Covelight does not receive or store your online banking username or password. When you verify a bank account through Stripe Financial Connections, you authenticate directly with your bank through Stripe.
The specific financial information Covelight receives depends on the service you request, the financial institution involved, and the permissions you authorize.
1.3 Identity Verification Information
Certain payment, banking, fraud-prevention, or regulatory processes may require identity verification.
Depending on the verification method, information may include your legal name, date of birth, address, Social Security number or a portion of it, tax identification information, or government-issued identification.
Some identity information may be collected directly by a payment or identity-verification provider rather than by Covelight. In those situations, Covelight may receive a verification result, account status, or other confirmation rather than the underlying identification document or credential.
For property owners and hosts who receive payments, identity and business verification is performed by Stripe as part of opening a Stripe connected account. Covelight may receive the status of that account, such as whether it is verified or able to accept payments, but not necessarily the underlying documents.
1.4 Property and Tenancy Information
We may collect information relating to rental properties and tenancies, including property addresses, unit information, rent amounts, lease dates, tenancy dates, lease documents, property records, tenancy status, and information concerning the relationship between tenants and housing providers using Covelight.
Information may be provided by landlords, property managers, tenants, or generated through use of the Service.
1.5 Communications
Covelight may allow users to communicate through in-app messaging and related communication features.
We collect and store messages and information you choose to include in those communications as necessary to provide the Service, maintain records, address disputes, enforce our agreements, and protect users and the Service.
Users should avoid including sensitive personal information in messages unless it is reasonably necessary for the communication.
1.6 Maintenance Requests and Uploaded Content
When you submit a maintenance request or other content, we may collect descriptions, photographs, videos, documents, timestamps, and related information.
Photographs, videos, and files created by your device may contain metadata generated by that device, which can sometimes include location, date, device, or other technical information.
Covelight does not require precise GPS location for the ordinary use of the Service. Uploaded files may nevertheless contain location metadata if that information was embedded by your device and has not been removed before or during upload.
1.7 Verified Rent Record
Covelight may allow a tenant to create and share a Verified Rent Record using payment and tenancy information maintained through Covelight.
A Verified Rent Record may include the tenant’s first name and last initial, the city and state associated with a tenancy, monthly rent amount, the period covered by the record, whether the tenancy is current, and monthly payment classifications based on payments made to the landlord using the Service.
Payment classifications are intended to describe Covelight’s records of payments made using the Service only. A record may indicate that a payment was completed as scheduled using the Service, that a returned payment was later completed, or that the full amount was not paid using the Service.
A Verified Rent Record does not represent payments made outside Covelight and is not intended to represent a tenant’s complete rental history.
Covelight may process information relating to the creation and sharing of a Verified Rent Record, including the date a record was created or shared, expiration and revocation information, security or access events, dispute status, and information reasonably necessary to maintain an audit history of the record.
Where recipient information is collected as part of the sharing process, Covelight may retain that information to support security, corrections, disputes, record integrity, and legal or compliance obligations.
Covelight does not include a credit score, tenant score, tenant rating, landlord commentary, criminal-background information, eviction search, or recommendation regarding the tenant’s eligibility for housing in a Verified Rent Record.
The tenant decides whether to create or share a Verified Rent Record. Covelight does not independently send a tenant’s Verified Rent Record to a prospective landlord or other housing provider without the tenant’s direction.
1.8 Information Collected Automatically
When you use the Service, we may automatically collect certain technical information, including device type, operating system, browser type, IP address, mobile network information, device or application identifiers, access times, pages or screens viewed, features used, referring information, application performance information, crash reports, and security logs.
We may infer an approximate geographic area from an IP address for security, fraud prevention, analytics, or Service functionality. We do not require precise device GPS location for ordinary use of Covelight.
1.9 Cookies and Similar Technologies
Our website and applications may use cookies, local storage, software development kits, pixels, application identifiers, or similar technologies for authentication, security, preferences, fraud prevention, Service functionality, performance monitoring, and analytics.
We may use analytics and infrastructure providers to help us understand how the Service performs and how features are used.
Covelight does not use personal information for cross-context behavioral advertising or targeted advertising at launch.
1.10 Information From Other Sources
We may receive information from other Covelight users, financial institutions, payment processors, bank-linking providers, identity-verification providers, fraud-prevention providers, cloud and infrastructure providers, and other service providers.
For example, Stripe may provide bank-verification results (through Stripe Financial Connections or micro-deposits), payment status, returned-payment and dispute information for payments made to a property owner’s or host’s Stripe account, the status of an owner’s or host’s Stripe account, and subscription, billing, or invoice information.
The information we receive depends on the service being performed and the permissions associated with that service.
1.11 Payment Authorization Records
When you authorize a payment or a series of payments using the Service, Covelight records the authorization. The record includes the exact authorization text shown to you, the version of the Terms of Service in effect, the date and time, your IP address, and information about the device and browser or app you used. We use these records to show what you authorized, to provide you with a copy where required, to respond to disputes and returned payments, to prevent fraud, and to meet legal and recordkeeping obligations.
2. How We Use Personal Information
We use personal information to operate, maintain, secure, and improve Covelight.
This includes creating and managing accounts; authenticating users; enabling property owners and hosts to request payments and enabling tenants and guests to set up and authorize payments that Stripe processes directly to the owner’s or host’s account; verifying bank accounts through Stripe; recording payment authorizations; billing owner subscriptions; providing payment histories and month-level summaries; generating tenant-authorized Verified Rent Records; maintaining property, tenancy, and lease records; enabling communications; processing maintenance requests; providing notifications and reminders; responding to customer-support requests; investigating returned or disputed payments; detecting and preventing fraud and unauthorized activity; maintaining security; troubleshooting and improving the Service; complying with legal and regulatory requirements; enforcing our agreements; and establishing, exercising, or defending legal claims.
Communications. We use contact information to send Covelight’s own transactional messages, such as receipts, payment confirmations, booking confirmations, and password resets. Covelight does not communicate with tenants on a landlord’s behalf except to carry out a landlord’s explicit request. For example, when a landlord chooses “Collect rent with Covelight,” we send the tenant an email that requests rent setup. We do not use tenant contact information to send notices, renewal offers, or reminders on a landlord’s behalf without that landlord’s explicit action.
If a payment is delayed because the Service was unavailable, we use payment-status information to notify the landlord and flag the affected month for late-fee review. We do not use it to mark the tenant as late or delinquent.
We may also use information to create aggregated or de-identified information that cannot reasonably be linked to an identifiable individual. We will not attempt to re-identify information that we maintain in a de-identified form except where permitted by law for purposes such as testing whether de-identification methods are effective.
3. Tenant-Controlled Sharing
Covelight is designed to give tenants control over certain disclosures of their information.
A tenant may choose to share information through features such as Verified Rent Record. Sharing through these features occurs at the tenant’s direction.
A housing provider cannot independently retrieve a tenant’s Verified Rent Record through Covelight without the sharing process authorized by the tenant.
Sharing links may use security controls such as expiration periods, access codes, revocation, access-attempt limits, or other safeguards.
Tenants may be able to review information before or while it is being shared and may dispute information they believe is inaccurate.
Covelight may maintain records of sharing and access events as reasonably necessary to support security, dispute resolution, corrections, compliance, and protection of users.
4. How We Disclose Personal Information
4.1 Payment and Financial Service Providers
We disclose information to Stripe, financial institutions, and related payment or financial-service partners when reasonably necessary for bank-account verification, identity verification of property owners and hosts, processing payments to an owner’s or host’s Stripe account, subscription billing, fraud prevention, and related services. When you pay a landlord or host, Stripe processes your payment details on that landlord’s or host’s Stripe account.
These providers process information under their own agreements, privacy policies, and legal obligations in addition to their contractual obligations to Covelight.
4.2 Between Covelight Users
We disclose information between users when necessary to provide the Service or at the direction of a user.
For example, a landlord or property manager may see information reasonably necessary to manage a tenancy, including tenant identity and contact information, rent obligations, whether required rent has been received, and maintenance requests relating to the property.
Landlords do not receive a tenant’s bank login credentials or bank-account information through Covelight.
A tenant’s payment schedule is private to that tenant. Covelight reports rent to landlords by month, never by installment. For each month, a landlord sees whether rent was paid in full and on time, or not. Landlords do not see through Covelight whether a tenant divides rent into installments, how many payments the tenant made, or the amount or date of any individual payment, unless the tenant expressly authorizes it. Covelight enforces this on its own servers.
Because the landlord is the merchant for rent payments, Stripe may make certain payment information available to the landlord under the landlord’s own agreement with Stripe.
4.3 Verified Rent Record Recipients
When a tenant chooses to share a Verified Rent Record, we disclose the information contained in that record to the recipient or individuals who access the tenant-authorized sharing link.
The record reflects payments made to the landlord using the Service and does not represent payments made outside Covelight.
Covelight does not provide a tenant score, ranking, recommendation, or housing-eligibility determination as part of the Verified Rent Record.
4.4 Service Providers
We disclose information to vendors and service providers that assist us with functions such as cloud infrastructure, data storage, security, authentication, analytics, customer support, communications, file processing, fraud prevention, and software operations.
We require service providers to handle personal information in accordance with applicable contractual and legal requirements and only for authorized purposes.
4.5 Legal, Safety, and Compliance Purposes
We may disclose information when we reasonably believe disclosure is necessary to comply with applicable law, regulation, subpoena, court order, legal process, governmental request, or other legal obligation.
We may also disclose information when reasonably necessary to detect or prevent fraud, protect the rights or safety of users or others, investigate misuse of the Service, enforce our agreements, or establish, exercise, or defend legal claims.
4.6 Business Transactions
If Her Own Sky LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.
4.7 At Your Direction or With Your Authorization
We may disclose information to another person or entity when you direct us to do so, authorize the disclosure, or use a Service feature whose purpose is to transmit information to a recipient you select.
5. Sale and Advertising
Covelight does not sell personal information.
At launch, Covelight does not share personal information for cross-context behavioral advertising and does not process personal information for targeted advertising.
If these practices change in the future, we will update this Privacy Policy and provide any notices and choices required by applicable law before using personal information for those purposes.
Disclosing information to service providers that process information on Covelight’s behalf is not intended to constitute a sale of personal information.
6. Financial Account Access and Payment Authorizations
Linking a financial account, accessing financial-account information, or initiating an electronic payment may require separate authorization.
Where required, Covelight or Stripe will present additional disclosures or consent requests relating to the specific activity. Bank accounts are verified through Stripe Financial Connections or micro-deposits. ACH Direct Debit authorizations are presented on a page hosted by Stripe and name the property owner or host, not Covelight, as the payee.
A Privacy Policy is not intended to replace any separate authorization that may be legally or contractually required for financial-data access, ACH origination, payment initiation, or another regulated activity.
You may be able to revoke certain financial-data permissions or disconnect a financial account through Covelight, Stripe, or your financial institution, subject to transactions already authorized or legal retention requirements.
7. Credit Reporting
Covelight does not furnish rent-payment information to consumer reporting agencies. Credit reporting is not offered, and Covelight is not accepting enrollments.
If Covelight introduces this feature, participation will be optional. Before furnishing information, Covelight will provide applicable disclosures, obtain required authorization or consent, and explain what information may be reported.
Covelight intends any optional rent-reporting program to report qualifying positive payment history rather than late or missed rent payments, subject to the rules and capabilities of the reporting program and applicable law.
If credit reporting becomes available, this Privacy Policy may be updated to identify additional data practices, service providers, dispute procedures, and consumer rights associated with that feature.
8. Accuracy, Corrections, and Payment Record Disputes
You may contact Covelight if you believe personal information or payment information associated with your account is inaccurate.
Verified Rent Record users may be provided with a way to dispute information associated with the record. While a dispute is being reviewed, Covelight may identify the applicable information as disputed or under review.
If Covelight determines that information in its records is inaccurate, we may correct the underlying information and update information generated from that record as appropriate.
Certain legal rights relating to correction, access, deletion, or disputes may apply depending on your jurisdiction and the type of information involved.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining transaction records, resolving disputes, preventing fraud, satisfying contractual requirements, complying with applicable law, and establishing or defending legal claims.
Account information is generally maintained while an account remains active. Following an account-deletion request, certain account information may remain available for a limited recovery or administrative period, generally up to 30 days, before deletion from active systems where deletion is appropriate.
Payment, transaction, payout, accounting, fraud-prevention, and related financial records may be retained for longer periods, including periods of up to seven years where reasonably necessary for accounting, tax, compliance, dispute, security, contractual, or legal purposes.
Payment authorization records (see Section 1.11) are retained for as long as the authorization is in effect and afterward for the period reasonably necessary to resolve disputes and returned payments and to meet legal and recordkeeping obligations, and in any case for at least two years after the last related payment, consistent with Nacha record-retention rules. Records from payment and bank-linking providers that Covelight no longer uses may be retained where reasonably necessary for legal, accounting, dispute, or recordkeeping purposes, and are deleted when no longer needed.
In-app communications are generally retained for the duration of the applicable tenancy and for approximately 12 months afterward, unless a longer period is reasonably necessary.
Maintenance records are generally retained for the duration of the applicable tenancy and for approximately 24 months afterward, unless a longer period is reasonably necessary.
Lease documents and related tenancy records are generally retained during the lease or tenancy and for approximately 36 months afterward, subject to account settings, legal requirements, disputes, or legitimate business needs.
Verified Rent Record sharing, access, dispute, and audit information may be retained for the period reasonably necessary to support record integrity, corrections, disputes, security, compliance, and legal claims.
Information may be retained longer when necessary to comply with law, respond to a legal hold, investigate fraud or abuse, resolve a dispute, collect or defend a claim, or enforce an agreement.
Information stored in backups may remain for a limited period after deletion from active systems and will be removed in accordance with our normal backup-retention processes.
We may retain aggregated or de-identified information that does not reasonably identify you.
10. Data Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, destruction, or misuse.
Our safeguards may include encryption in transit and at rest where appropriate, access controls, secure authentication, monitoring, logging, rate limiting, credential protection, infrastructure security controls, and procedures for responding to suspected security incidents.
Financial account login credentials used to authenticate directly with your bank through a supported financial-data provider are not stored by Covelight.
No system can guarantee absolute security. You are responsible for protecting your account credentials and for notifying us if you believe your account or information has been compromised.
11. Your Privacy Rights and Choices
Depending on where you live and whether a particular privacy law applies to Her Own Sky LLC or to the information involved, you may have rights concerning your personal information.
These rights may include the right to confirm whether we process information about you; access information or categories of information we maintain; request correction of inaccurate information; request deletion; receive certain information in a portable format; obtain information concerning categories of information disclosed to third parties; withdraw consent where processing is based on consent; opt out of certain forms of sale, sharing, targeted advertising, or profiling where applicable; and appeal a decision we make concerning a privacy-rights request.
Covelight will not discriminate against you for exercising a privacy right provided by applicable law.
To submit a privacy request, contact privacy@herownsky.com. Please describe the right you wish to exercise and provide enough information for us to identify your account or request.
We may take reasonable steps to verify your identity before completing a request. We will not require information beyond what is reasonably necessary to authenticate or process the request.
You may use an authorized agent to submit certain requests where applicable law permits it. We may request evidence that the agent is authorized to act for you.
Some requests may be limited or denied where an exception applies, including where information must be retained to complete a transaction, provide a requested service, prevent fraud, maintain security, comply with law, preserve evidence, or establish or defend legal claims.
If we deny a request and applicable law provides a right to appeal, you may appeal by emailing privacy@herownsky.com with the subject line “Privacy Appeal.” We will review the appeal and respond within the period required by applicable law. Where required, our response will also explain how you may submit a complaint to the appropriate state regulator or attorney general.
12. Minnesota Privacy Rights
Minnesota residents may have additional rights under the Minnesota Consumer Data Privacy Act and other applicable Minnesota laws when those laws apply.
Those rights may include access, correction, deletion, data portability, information concerning processing activities, the ability to opt out of certain processing, and the right to appeal a denial of a qualifying privacy request.
Minnesota residents may exercise applicable rights through the process described in Section 11.
If we deny an appeal governed by Minnesota law, we will provide the explanation and information concerning the Minnesota Attorney General required by applicable law.
Nothing in this section limits rights that may apply under other Minnesota laws governing rental housing, tenant records, financial information, or consumer information.
13. California Privacy Rights
California residents may have rights under the California Consumer Privacy Act, as amended, when that law applies to Her Own Sky LLC or to the information involved.
Applicable rights may include the right to know or access personal information, request deletion, request correction, opt out of the sale or sharing of personal information, limit certain uses or disclosures of sensitive personal information, and receive equal treatment when exercising privacy rights.
Covelight does not sell personal information. At launch, Covelight does not share personal information for cross-context behavioral advertising.
California residents may submit applicable requests using the process described in Section 11.
If our data practices change in a way that creates additional California notice or opt-out requirements, we will update our disclosures and provide any required privacy controls.
14. Other U.S. State Privacy Rights
Residents of other U.S. states may have additional rights under applicable state privacy laws.
Where such laws apply, Covelight will provide and honor the rights required by those laws, which may include rights to access, correct, delete, obtain, or port personal information and to opt out of certain processing activities.
You may submit a request using privacy@herownsky.com regardless of the state in which you live.
15. Children's Privacy
Covelight is not intended for individuals under 18 years of age.
We do not knowingly create accounts for or intentionally collect personal information from individuals under 18 through the ordinary operation of the Service.
If we learn that personal information was collected from an individual under 18 in circumstances where it should not have been collected, we will take reasonable steps to delete or otherwise appropriately address that information.
16. Third-Party Services
Covelight integrates with or relies on third-party services, including payment processors, financial-data providers, cloud infrastructure providers, authentication services, and other technology providers.
Third parties may collect or process information under their own privacy policies and legal obligations.
This Privacy Policy governs Her Own Sky LLC’s processing of personal information and does not replace the privacy notices or agreements of independent third parties.
We encourage you to review the privacy policies and terms presented by Stripe (including for Stripe Financial Connections), your financial institution, and other services you choose to use.
Tenant screening referrals. Where Covelight refers a housing provider to a third-party tenant-screening service, such as a background-check or credit-check provider, any engagement with that service is between the housing provider and that third party. Covelight does not receive, store, or otherwise process the resulting report or any information contained in it, and does not know whether the housing provider requested or obtained one. No screening information reaches Covelight, so none of it forms part of a Verified Rent Record or of any other information Covelight holds about a renter.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in Covelight, our technology, our data practices, our service providers, or applicable law.
When we update the Policy, we will revise the “Last Updated” date.
If we make a material change, we will provide additional notice where appropriate, such as an in-app notice, website notice, or email.
If applicable law requires affirmative consent for a new use of personal information, we will obtain that consent rather than relying solely on publication of an updated Privacy Policy.
18. Contact Us
If you have questions about this Privacy Policy, our privacy practices, or a privacy-rights request, contact:
Her Own Sky LLC
Covelight Privacy
2688 Rice St, Unit #2108
Little Canada, MN 55113
privacy@herownsky.com
Privacy-rights requests and appeals may also be submitted to privacy@herownsky.com.