Legal
Privacy Policy
Student Res Life, Inc. d/b/a Housing.Cloud
Last updated September 20, 2026 · Supersedes the version dated January 23, 2023
Student Res Life, Inc. d/b/a Housing.Cloud (“Housing.Cloud,” “we,” “us,” or “our”) provides this Privacy Policy to our website visitors, business contacts, and institutional customers to explain how we collect, use, disclose, and protect personal information, and to help you understand and exercise your privacy rights.
1. Scope and updates to this Privacy Policy
This Privacy Policy applies to personal information that we process in connection with our websites, our marketing and sales activities, our events, our recruiting, and our other business operations (collectively, the “Services”).
Institutional Customer Data is not governed by this Privacy Policy
This Privacy Policy does not apply to personal information that we process on behalf of our institutional customers through their use of the Housing.Cloud platform (“Customer Data”). Our processing of Customer Data is governed exclusively by our written agreement with the institution and by applicable law. Each institution’s own privacy notice governs its collection and use of Customer Data, and any question or request relating to Customer Data should be directed to the institution.
To the extent Customer Data includes student education records, we process that information solely on behalf of and at the direction of the institution, only for the purposes set out in the institution’s agreement, and consistent with the Family Educational Rights and Privacy Act (“FERPA”) — including as a “school official” with a legitimate educational interest where the institution has so designated us. Institutions retain ownership of their data, and those ownership, access, and export rights are preserved by contract.
Data location
All personal information described in this Privacy Policy is collected, processed, and stored in the United States. Our Services are directed to institutions located in the United States. We do not collect, process, or store personal information in the European Economic Area, the United Kingdom, or China.
Updates
We may revise this Privacy Policy from time to time. If we make material changes, we will update the “Last Updated” date above, post the revised policy on our website, and provide any additional notice required by applicable law. Material changes affecting Customer Data will be handled in accordance with the applicable institutional agreement.
2. Personal information we collect
The categories of personal information we collect depend on how you interact with us and on the requirements of applicable law. We collect information you provide to us, information collected automatically when you use our websites, and a limited amount of information from other business sources, as described below.
2.1 Personal information you provide to us directly
Account creation. Information such as name, email address, username, and job title when you create an account on our website or a demonstration environment.
Purchases and billing. Information and details associated with subscriptions and invoices, including billing contact details. Payments made through our Services are processed by third-party payment processors. We do not directly collect or store payment card numbers, although we may receive limited associated information such as billing details.
Your communications with us. Information such as email address, phone number, or mailing address when you request information about our Services, register for our newsletter, request customer or technical support, or otherwise communicate with us.
Surveys and feedback. Information you provide if you choose to participate in a survey or provide product feedback.
Content you submit. Information contained in support requests, feedback, and comments or messages you send to us or post on our blog or social media pages.
Conferences, trade shows, and events. Information collected from individuals when we attend or host conferences, trade shows, webinars, and other events.
Business development. Information collected from individuals and business sources to assess and pursue potential business opportunities.
Job applications. Information such as your application, CV, cover letter, and any other information you provide when you respond to a job posting.
2.2 Personal information collected automatically
Device and usage information. When you visit our websites we may automatically collect your Internet protocol (IP) address, browser and device type, operating system, device identifiers, referring URLs, pages viewed, links clicked, session duration, and similar usage information, together with approximate location derived from your IP address.
Crash and diagnostic reports. If you submit a crash report, we may collect diagnostic information about your device and the activity that led to the error.
We do not collect precise geolocation. We do not collect GPS-level or device-precise location information, and our applications do not request device location permissions.
Cookies and similar technologies. We use cookies, and a limited set of similar technologies (collectively, “Technologies”), on our websites. Our use of these Technologies falls into three categories only:
Operationally necessary. Technologies required to provide access to our Services, authenticate users, maintain sessions, identify irregular activity, prevent fraud, and support security.
Performance-related. Technologies used to assess the performance, availability, and reliability of our Services, including as part of the analytics practices described below.
Functionality-related. Technologies that support enhanced functionality, such as recognizing you when you sign in and remembering your preferences.
We do not use cookies, pixel tags, web beacons, or similar technologies for advertising purposes. We do not place advertising-network or data-broker technologies on our Services, we do not conduct retargeting or custom-audience advertising, and we do not engage in interest-based, personalized, or cross-context behavioral advertising. We may include a web beacon in our own marketing emails to business contacts to understand whether the message was opened, and you may opt out of those emails at any time as described in Section 6.
Analytics. We use a limited number of third-party tools to understand how our websites and platform perform:
Google Analytics — used on our public marketing website to understand aggregate website usage. We have configured Google Analytics so that data collected is not used for advertising personalization, audience building, or Google signals. For more information, see Google’s privacy policy for its partners, and Google’s Analytics opt-out browser add-on.
Datadog — a cloud monitoring service used for application performance monitoring, security monitoring, and error diagnosis. For more information, see the Datadog Privacy Center.
Social media features. Our websites may contain links or buttons to our social media pages. These features may collect your IP address and the page you are visiting and may set a cookie to enable the feature to function. Your interactions with those platforms are governed by the privacy policy of the platform provider.
2.3 Personal information collected from other sources
We may obtain limited business contact information about individuals at current and prospective institutional customers from third-party business information services, publicly available sources, and conference or event organizers, in order to conduct our sales and marketing activities.
Important limitation. We do not combine Customer Data or institutional data — including de-identified, anonymized, or otherwise masked institutional data — with personal information obtained from any other source.
3. How we use personal information
3.1 To provide our Services
Managing your information and accounts;
Providing access to areas, functionality, and features of our Services;
Answering requests for customer or technical support;
Communicating with you about your account, service activity, and policy changes;
Processing subscription payments and billing information;
Processing applications if you apply for a job we post; and
Allowing you to register for our events.
3.2 For administrative purposes
Pursuing our legitimate interests, including direct marketing to business contacts, product research and development, and network and information security;
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and pursuing those responsible;
Measuring interest and engagement in our Services;
Improving, upgrading, and enhancing our Services, and developing new products and features;
Ensuring internal quality control and safety;
Authenticating and verifying individual identities, including requests to exercise rights under this Privacy Policy;
Debugging to identify and repair errors in our Services;
Auditing relating to interactions, transactions, and other compliance activities;
Disclosing personal information to service providers as needed to provide the Services;
Enforcing our agreements and policies; and
Carrying out activities required to comply with our legal obligations.
3.3 To market our products and services
We use business contact information to market our products and services to current and prospective institutional customers. Our marketing consists of email campaigns, newsletters, event and webinar invitations, direct outreach from our sales team, and content published on our own website and social media channels.
We do not conduct interest-based, personalized, or cross-context behavioral advertising. We do not build advertising audiences or custom-audience lists, we do not create advertising profiles about individuals, and we do not disclose personal information to advertising networks, ad exchanges, or data brokers. If you have questions about our marketing practices, or wish to opt out of marketing communications, you may contact us as set out in Section 14.
3.4 With your consent
We may use personal information for other purposes that are clearly disclosed to you at the time you provide the information, or with your consent.
3.5 De-identified and aggregated information
We may create de-identified, anonymized, or aggregated information and use it for testing, internal analytics, and service improvement.
We do not sell, share, or otherwise disclose de-identified, anonymized, or aggregated data — including any such data derived from institutional data — to advertising networks, data brokers, or any other third party, and we do not use it for marketing to individuals, for the creation of profiles, or for analytics unrelated to the services we provide to the institution. We do not attempt to re-identify de-identified data.
4. How we disclose personal information
We disclose personal information only as described in this section. We do not disclose personal information to advertising networks, ad exchanges, data brokers, or any third party for advertising or for that party’s own marketing purposes.
4.1 Service providers and subprocessors
We disclose personal information to third-party service providers and subprocessors that support the delivery of our Services, including providers of cloud hosting and infrastructure, payment processing, email and messaging delivery, application and security monitoring, and customer support tooling. All of our subprocessors are located in the United States.
Each service provider is bound by a written agreement containing confidentiality, security, and privacy obligations; is reviewed for security and privacy before onboarding; is subject to ongoing monitoring, including review of audit reports and certifications; and is prohibited from using personal information for its own purposes.
4.2 Business partners
We may disclose personal information to business partners in order to provide a product or service you have requested, or where we jointly offer a product or service with that partner.
4.3 Affiliates
We may disclose personal information to our corporate affiliates for administrative purposes, IT management, or to support and supplement the Services we provide.
4.4 Application programming interfaces and software development kits
We may use third-party application programming interfaces (“APIs”) and software development kits (“SDKs”) as part of the functionality of our Services. For more information about our use of APIs and SDKs, please contact us as set out in Section 14.
4.5 Disclosures to protect us or others, and legal process
We may access, preserve, and disclose information we hold if we in good faith believe doing so is required or appropriate to comply with legal process; to protect your, our, or others’ rights, property, or safety; to enforce our policies or contracts; to collect amounts owed to us; or to assist in an investigation of suspected or actual illegal activity.
We do not disclose institutional data to law enforcement without a valid warrant, subpoena, court order, or other legally binding process. Where we receive a request for institutional data, we notify the institution unless we are legally prohibited from doing so.
4.6 Merger, sale, or other asset transfer
If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, personal information may be transferred as part of that transaction, as permitted by law and by contract. Any successor or acquirer will be bound by commitments no less protective than those set out in this Privacy Policy.
Customer Data remains subject to the institution’s agreement in any such transaction, and the institution’s ownership, access, export, and deletion rights survive a change of control.
5. We do not sell or share personal information
We do not sell personal information, for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (“CCPA”) and comparable United States state privacy laws. We also do not “sell” covered information as that term is defined in Nevada Revised Statutes Chapter 603A. We have not sold or shared personal information in the preceding twelve months.
This commitment applies equally to de-identified, anonymized, and aggregated data, and it applies to us and to our subprocessors. Neither we nor our subprocessors use or disclose institutional data — or any de-identified or masked derivative of it — for advertising, for marketing to individuals, for the creation of profiles, or for analytics unrelated to the services we provide to the institution.
6. Your privacy choices and rights
6.1 Your choices
Email communications. You can use the unsubscribe link at the bottom of our marketing emails to opt out of future marketing emails. You will continue to receive transaction-related and service-related messages, such as notices about your account or updates to our terms or this Privacy Policy.
Text messages. If you receive an unwanted text message from us, you may opt out by following the instructions in the message or by contacting us as set out in Section 14.
Phone calls. If you receive an unwanted call from us, you may opt out of future calls by following any instructions given on the call or by contacting us as set out in Section 14.
Mobile push notifications. You may opt out of push notifications by changing the settings on your mobile device.
Cookies. You may stop or restrict the placement of Technologies on your device, or remove them, by adjusting your browser or device settings. If you disable operationally necessary Technologies, parts of our Services may not function properly.
6.2 Do Not Track and Global Privacy Control
Some browsers transmit “Do Not Track” (“DNT”) or Global Privacy Control (“GPC”) signals. Because we do not sell or share personal information and do not engage in targeted or cross-context behavioral advertising, there is no such activity for these signals to opt out of, and we do not use browser signals to enable any advertising activity.
6.3 Your rights
Subject to applicable law, and depending on your state of residence, you may have the right to:
Know and access the personal information we have collected about you, including the categories of information, the sources, the purposes for collection, and the categories of third parties to whom we disclose it;
Obtain a portable copy of the personal information you have provided to us, in a structured, commonly used, machine-readable format;
Request correction of personal information that is inaccurate or incomplete;
Request deletion of your personal information;
Opt out of the sale or sharing of personal information, of targeted advertising, and of profiling in furtherance of decisions producing legal or similarly significant effects. As described in Section 5, we do not engage in any of these activities;
Limit our use of sensitive personal information, where applicable; and
Appeal a decision we make regarding a rights request, and not be discriminated against for exercising your rights.
6.4 How to exercise your rights
To exercise any of these rights, contact us at privacy@housing.cloud. We will acknowledge and respond to your request within the period required by applicable law — generally within forty-five (45) days, which may be extended by an additional forty-five (45) days where reasonably necessary, with notice to you.
We will take reasonable steps to verify your identity before acting on a request, and we may decline a request where we are unable to verify it. An authorized agent may submit a request on your behalf with proof of authorization. Requests relating to Customer Data must be directed to the institution, which controls that information; if you send us such a request, we will refer you to the institution or forward the request to it.
7. Security of your information
We maintain a documented information security program with administrative, technical, and physical safeguards designed to protect personal information. These include encryption of data in transit using TLS 1.2 or higher and encryption of data at rest; role-based access controls applied on a least-privilege basis; multi-factor authentication for administrative access; centralized audit logging and continuous security monitoring; annual third-party penetration testing; and secure media handling and disposal procedures.
Our controls are independently assessed under a SOC 2 Type II examination covering the Security, Availability, Processing Integrity, Confidentiality, and Privacy Trust Services Criteria, and we undergo that examination annually.
No system of security is impenetrable, and we cannot guarantee absolute security. Liability for security incidents involving Customer Data is governed by our agreement with the applicable institution.
Incident notification. We will notify affected individuals and institutions of a security incident as required by applicable breach notification laws. For institutional customers, we provide notice without unreasonable delay and, typically, within seventy-two (72) hours of confirming an incident affecting that institution’s data. By using our Services, you agree that we may communicate with you electronically about security, privacy, and administrative matters relating to your use of the Services.
8. Retention of personal information
We retain the personal information described in this Privacy Policy for as long as necessary to fulfill the purposes for which it was collected, to provide our Services, to resolve disputes, to establish legal defenses, to conduct audits, to enforce our agreements, and to comply with applicable law.
Customer Data is retained for the period set out in the applicable institutional agreement. At the conclusion of that agreement, we provide the institution with an export of its data and then delete it from active systems and from backups in accordance with our documented retention schedule, using sanitization methods aligned with NIST Special Publication 800-88. Application and security logs are retained for thirty (30) days.
9. Automated processing and artificial intelligence
The Housing.Cloud platform includes automated and AI-assisted features, such as roommate matching suggestions, task prioritization, suggested drafted responses, review of staff–student communications for issues warranting administrative attention, and automated checks for incomplete applications. The following safeguards apply:
Tenant scoping. AI processing is scoped to the individual institution’s environment. Institutional data is not retained in shared training sets and is not used to train models outside that institution’s environment.
Licensed enterprise services only. We use only licensed, contractually governed enterprise AI services. Institutional data is never processed by consumer-grade or shared AI services.
Human oversight. Automated outputs support, rather than replace, administrator decisions. Administrators can review, modify, override, or reject suggestions before action is taken.
Logging. AI feature usage is logged, including user, date and time, and action taken, and is available for audit and incident response.
Institutional control. Institutions may disable AI-assisted features through configuration.
Governance. AI features are subject to our privacy review, change management, and risk assessment processes before release, and to ongoing monitoring afterward.
10. State-specific privacy notices
10.1 Notice for California residents
In the preceding twelve months, we have collected the following categories of personal information, as defined by the CCPA: identifiers (such as name, email address, postal address, phone number, and IP address); commercial information (such as subscription and billing records); internet or other electronic network activity information (such as website usage); geolocation data (approximate location derived from IP address only); professional or employment-related information (such as job title and employer); and, where you apply for a role with us, the contents of your application.
We collect this information from you directly, automatically through our websites, and from the limited business sources described in Section 2.3. We use it for the purposes described in Section 3, and we disclose it only to the categories of recipients described in Section 4. We do not sell or share personal information, and we do not use or disclose sensitive personal information for the purpose of inferring characteristics about an individual. We retain personal information as described in Section 8.
Shine the Light. California’s “Shine the Light” law permits California residents to request, once per year and free of charge, a list of the third parties to whom we disclosed their personal information for those third parties’ direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for their own direct marketing purposes.
Removal of content posted by minors. Where required by law, California residents under the age of 18 may request removal of content or information they posted to a publicly viewable portion of our Services by contacting us as set out in Section 14.
10.2 Notice for Nevada residents
Nevada Revised Statutes Chapter 603A gives Nevada consumers the right to direct an operator of an internet website or online service not to make any sale of certain covered information. We do not sell covered information as that term is defined in Chapter 603A, and we do not sell personal information under any other state privacy law. If you would nonetheless like to submit a request, email us at privacy@housing.cloud with the subject line “Nevada Do Not Sell Request” and include your name and the email address associated with your account.
10.3 Notice for residents of other states
Residents of other states with comprehensive consumer privacy laws have the rights described in Section 6.3, including the right to appeal a decision on a rights request. To exercise any right, or to submit an appeal, contact us at privacy@housing.cloud.
11. Children’s information
Our websites are not directed to children under 13 (or such other age as required by local law), and we do not knowingly collect personal information from children through our websites. If we become aware that a child has provided us with personal information in violation of applicable law, we will delete it unless we have a legal obligation to retain it.
Where an institution’s users include individuals under the age of 18, information about those individuals is Customer Data and is governed by the institutional agreement and by FERPA, not by this Privacy Policy. A parent or guardian who wishes to review, correct, or delete information held about a student should contact the institution.
12. Third-party websites and applications
Our Services may contain links to other websites or applications, and other websites or applications may link to our Services. Those third-party services are not controlled by us. We do not endorse, screen, or approve, and we are not responsible for, the privacy practices or content of other websites or applications. We encourage you to read the privacy policy of each website and application with which you interact.
13. Complaints
If you believe we have processed personal information in a manner inconsistent with this Privacy Policy or with applicable law, contact us at privacy@housing.cloud. Complaints are logged, investigated, and resolved by our Privacy Officer under our documented privacy management process. You also retain the right to contact your state attorney general or other applicable regulator.
14. Contact us
Student Res Life, Inc. is the data controller responsible for the personal information described in this policy. If you have questions, requests, or complaints about privacy, please contact us.
Privacy Officer — Sasha Bratyshkin, Chief Technology Officer
Email: privacy@housing.cloud
Mail: Student Res Life, Inc., 161 Water Street, Suite 2214, New York, NY 10038
Phone: (908) 795-8308
We aim to respond to all privacy requests within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.