Biometric Data Retention & Destruction Policy

Threshold Technology LLC d/b/a RentEngine · Effective 29 August 2026 · Version 1.0 · Last reviewed 29 August 2026

1. Purpose and Scope

This policy governs how RentEngine collects, stores, uses, and permanently destroys biometric identifiers and biometric information (together, “biometric data”). It is published to satisfy Section 15(a) of the Illinois Biometric Information Privacy Act (740 ILCS 14) and to reflect our practices under comparable state laws, including the Texas Capture or Use of Biometric Identifier Act and the Washington biometric privacy statute.

This policy applies to biometric data that RentEngine collects or possesses in connection with its prescreening, identity-verification, and rental-application services, whether the individual is a prospective renter, applicant, or other user of the platform.

2. What Biometric Data We Collect

RentEngine collects biometric data only where necessary to verify an individual’s identity and detect fraud. Depending on the service and the verification method in use, this may include:

  • A scan of facial geometry derived from a self-captured image compared against a government-issued identification document; and/or
  • A voiceprint, where identity verification occurs through a voice-based interaction.

    • RentEngine does not collect biometric data for any purpose other than those stated in this policy. Biometric data is not used in any tenant-screening decision, credit evaluation, or background-check scoring.

    3. Notice and Consent

    RentEngine does not collect, capture, or otherwise obtain biometric data unless it first (a) provides written notice that biometric data is being collected and stored, the specific purpose for collection, and the length of term for which it will be retained; and (b) obtains the individual’s written consent, which may be provided by electronic signature.

    4. Retention Schedule

    RentEngine retains biometric data only for as long as reasonably necessary to fulfill the purpose for which it was collected. Biometric data is permanently destroyed on the earliest of the following:

  • When the initial purpose for collecting the biometric data — identity verification and fraud detection — has been satisfied;
  • Within three (3) years of the individual’s last interaction with RentEngine; or
  • Upon a valid request requiring destruction, where applicable law so requires.

    • 5. Destruction Guidelines

    When biometric data reaches the end of its retention period, RentEngine permanently and irreversibly destroys it so that it cannot be recovered or reconstructed. Destruction includes deletion of the biometric data from production systems and, subject to technical feasibility, from backups in the ordinary course of backup rotation. RentEngine requires its third-party service providers to permanently destroy biometric data on the same schedule and to confirm destruction upon request.

    6. Disclosure to Third Parties

    RentEngine does not sell, lease, trade, or otherwise profit from biometric data. RentEngine discloses biometric data only to its identity-verification service provider(s), which process the data solely on RentEngine’s behalf and under written contract that prohibits any further disclosure, sale, or use of the data beyond providing the verification service. RentEngine does not otherwise disclose, redisclose, or disseminate biometric data except: with the individual’s consent; to complete a transaction requested or authorized by the individual; or as required by state or federal law or valid legal process.

    7. Data Security

    RentEngine stores, transmits, and protects biometric data using a reasonable standard of care within its industry, and in a manner at least as protective as that used to safeguard other confidential and sensitive information it maintains, such as Social Security numbers and financial account information.

    8. Governance and Review

    RentEngine reviews this policy at least annually and updates it as needed to reflect changes in law, technology, or business practices. Prior versions are retained for recordkeeping. Questions about this policy may be directed to ops@rentengine.io.