Privacy Policy

Last Updated: May 21, 2026

1. Introduction

Welcome to RTOAsk ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our rent-to-own customer verification platform.

1.5 FCRA Compliance

RTOAsk is a consumer reporting agency ("CRA") as defined under the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq. We assemble, evaluate, and furnish consumer reports (limited to rent-to-own shed default/payment history) to verified business members for the permissible purpose of evaluating eligibility for rent-to-own agreements.

All collection, use, disclosure, and handling of consumer information complies with FCRA requirements, including accuracy procedures, permissible purpose certifications from users, consumer rights to access and dispute information, and other obligations. For a full summary of your rights under the FCRA, visit https://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.pdf or www.consumerfinance.gov/learnmore.

2. Information We Collect

2.1 Business Member Information

When you register as a business member, we collect:

• Business name and type.
• Contact person's name and role.
• Business address, city, state, and ZIP code.
• Email address and phone number (for account authentication, two-factor authentication, and member support communications)
• Account password (encrypted and securely stored).
• States where you operate.

2.2 Customer Information

Business members that submit customer information for verification purposes, shall include:

• Customer full name, address, email, phone number and last 4 of SSN.
• Customer RTO contract or late payment.
• Payment history and account status.
• Notes, photos and comments regarding customer interactions.

Customer information is collected only when submitted by verified business members who certify a permissible purpose under FCRA and represent that they have obtained appropriate consumer consent or authorization where required.

2.3 Automatically Collected Information

We automatically collect certain information when you access our platform:

• IP address and device information.
• Browser type and version.
• Login timestamps and activity logs.
• Search queries and database usage patterns.

3. How We Use Your Information

We use the collected information for the following purposes:

• Account Management: To create and manage your business account, authenticate users, and provide customer support.
• Service Delivery: To provide access to our customer verification database and enable cross-business customer lookups.
• Security: To implement two-factor authentication, prevent fraud, and protect against unauthorized access.
• Communication: To send account notifications, service updates, SMS verification codes, and respond to member inquiries via email or phone.
• Improvement: To analyze usage patterns and improve our platform's functionality and user experience.
• Compliance: To comply with legal obligations and enforce our Terms of Use.
• FCRA-Required Functions: To maintain accurate records, facilitate consumer disputes and file disclosures, investigate inaccuracies, and comply with FCRA obligations (e.g., providing consumers access to their file upon request and responding to disputes).

4. Information Sharing and Disclosure

4.1 Member-to-Member Sharing

Customer information submitted by one business member may be viewable by other verified business members within their approved states for the permissible purpose of customer verification and risk assessment in rent-to-own shed transactions, as certified by those members under FCRA.

• FCRA Users: We share information only with users who have certified in writing that they have a permissible purpose under FCRA § 604 and will comply with all applicable FCRA rules (including adverse action notices if denying based on our data).

4.2 We Do Not Sell Your Information

We do not sell, rent, or trade your personal information or customer data to third parties for marketing purposes.

4.3 Service Providers

We may share information with trusted service providers who assist us in operating our platform, such as:

• Cloud hosting providers.
• Email delivery services.
• SMS services for two-factor authentication.
• Payment processors (if applicable).

4.4 Legal Requirements

We may disclose your information if required by law, court order, or governmental request, or to protect our rights, property, or safety.

5. Data Security

We implement industry-standard security measures to protect your information:

• SSL/TLS encryption for data transmission.
• Encrypted password storage using bcrypt hashing.
• Two-factor authentication (2FA) for account access.
• Regular security audits and updates.
• Restricted access controls based on user roles and approved states.
• Secure database infrastructure with regular backups.

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. SMS & Phone Communications

RTOAsk uses your phone number exclusively for account security and member support purposes. We do not use phone numbers for marketing or promotional communications of any kind.

6.1 SMS Two-Factor Authentication

By registering a phone number with your RTOAsk account, you consent to receive SMS text messages containing one-time passcodes (OTPs) from RTOAsk for the sole purpose of verifying your identity during login. SMS verification messages are sent only when a login attempt is initiated by you or when account security activity requires verification.

• SMS verification codes are for your use only. Do not share your verification code with anyone, including RTOAsk staff.
• Message frequency varies based on your login activity.
• Standard message and data rates may apply based on your mobile carrier plan.
• RTOAsk is not responsible for delays in SMS delivery caused by your mobile carrier.

6.2 Voice Calls

RTOAsk may contact you by phone when necessary for account-related support, security concerns, or matters directly related to your membership. Calls are made only during reasonable hours in accordance with applicable regulations.

6.3 How We Protect Your Phone Number

Your phone number is:

• Used exclusively for authentication and member support purposes as described in this section.
• Never sold, shared, or distributed to third parties for marketing purposes.
• Stored securely on AWS-protected infrastructure with restricted access controls, consistent with the security measures described in Section 5 of this Privacy Policy.
• Transmitted only through vetted SMS service providers as noted in Section 4.3.

6.4 Opting Out & Updating Your Phone Number

To remove or update the phone number associated with your account, or to opt out of SMS authentication, please contact us at admin@rtoask.com. Note that disabling SMS two-factor authentication may affect your ability to securely access your RTOAsk account.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide our services. Customer records may be retained for:

• Active accounts: As long as necessary to provide services or comply with FCRA requirements, or until requested for deletion by the submitting member.
• Inactive accounts: Up to 7 years for legal and business purposes, consistent with FCRA guidelines for retaining consumer report information (e.g., derogatory information can be reported for up to 7 years).
• Deleted accounts: Backup copies may persist for up to 90 days.

8. Your Rights and Choices

You have the right to:

• Access: Request a copy of the information we have about you.
• Correction: Update or correct inaccurate information.
• Deletion: Request deletion of customer records you submitted (subject to legal retention requirements).
• Account Closure: Close your business account at any time.
• Opt-Out: Unsubscribe from non-essential communications.

To exercise these rights, contact us at admin@rtoask.com.

8.1 Rights for Individuals (Consumers Whose Data May Be in Our Database)

If you are an individual whose rent-to-own shed payment/default information has been submitted to RTOAsk:

• You have the right to request a free file disclosure of all information we maintain about you (at least annually).
• If a business denies your rent-to-own application based on our data, you have the right to an adverse action notice explaining why and providing our contact info.
• You may dispute the accuracy or completeness of any information; we will investigate within 30 days (or as required by FCRA) and correct/delete if warranted.
• Requests: Email admin@rtoask.com with your full name, current address, DOB, last 4 of SSN and any proof documents you may have. We will respond promptly.
• For more on your FCRA rights, refer to the "Summary of Your Rights Under the Fair Credit Reporting Act" linked/provided on our site.

8.2 Dispute Process

To dispute information in our database: Contact us at admin@rtoask.com. Provide details of the inaccuracy. We will reinvestigate (including contacting the furnisher) within 30 days and notify you of the results. If corrected, we update the record and notify relevant parties if required. We may delete or block unverifiable information even if the furnisher does not respond, as required by FCRA.

9. Customer Data Submitted by Members

If you are a customer whose information has been submitted to RTOAsk by a business member:

• Your information is used solely for business verification and risk assessment purposes.
• You may contact us to request information about what data we have about you.
• We do not independently verify submitted data initially but rely on members' certifications of accuracy. We also conduct periodic audits to ensure data reliability. If you dispute information, we will forward your dispute to the submitting member for verification, independently reinvestigate as needed, and update our records accordingly per FCRA requirements. For additional rights regarding your data, see section 7.1 above.

10. Children's Privacy

RTOAsk is designed for business use only. We do not knowingly collect information from individuals under 18 years of age. If we become aware that we have collected information from a minor, we will take steps to delete it. If incidental information about minors is submitted as part of customer data (e.g., family addresses), we will handle it in accordance with applicable laws, including COPPA if applicable, and delete if not necessary for the permissible purpose.

11. State-Specific Privacy Rights

Depending on your state of residence, you may have additional rights regarding your personal information under applicable state consumer privacy laws. These rights may include (but are not limited to) the right to know what personal information we collect and how it is used/ disclosed, the right to access, correct, or delete your information, the right to opt out of certain uses (such as targeted advertising or sales of personal information, where applicable), and protection against discrimination for exercising these rights.

Examples include rights under the California Consumer Privacy Act (CCPA/CPRA) for California residents, as well as similar laws in states such as Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and others (including new laws effective in 2026 in Indiana, Kentucky, Rhode Island, and beyond).

We do not sell personal information as defined under these laws, and we comply with all applicable state requirements. If you are a resident of a state with comprehensive privacy rights and wish to exercise any such rights or need more details about how they apply to you, please contact us at admin@rtoask.com with your state of residence. We will respond in accordance with applicable law (typically within 30–45 days, depending on the state).

For more information on state privacy laws, you can visit resources like the International Association of Privacy Professionals (IAPP) state privacy tracker or your state attorney general's website.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on our platform.
• Updating the "Last Updated" date.
• Sending email notifications for material changes.

Your continued use of RTOAsk after changes are posted constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

RTOAsk
Email: admin@rtoask.com

By using RTOAsk, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.