Privacy Policy

Information we collect

We collect information directly from you, from third parties you authorize (such as Google when you sign in with OAuth), and automatically as you use the service:

• Account details — full name, email address, telephone number, password (stored as a bcrypt hash), and optional profile image.
• Identity verification — one-time codes sent during email confirmation and password reset.
• Organization and property records — organizations you own or belong to, properties, property units, vacancy status, property groups and features.
• Tenant and tenancy data — tenant records, tenancy agreements, contract templates, generated and uploaded contract PDFs.
• Operational records — maintenance issues you report or approve, announcements you publish, payments you record or confirm, and payment method details.
• Communications — chat messages exchanged with other members of organizations you belong to, and invitations you send or receive.
• Authentication data — session records, signed session cookies, OAuth provider identifiers (such as your Google account ID and email) when you sign in with a third-party provider.
• Technical data — IP address, browser type, device information, and basic request logs needed to operate the service securely.

How we use information

We use the information above only for purposes that are necessary to run the service or that you would reasonably expect:

• Authenticate you, keep your session active, and recover access to your account.
• Provide the core functionality — managing properties, units, tenants, tenancy agreements, payments, issues, announcements, and chats.
• Send transactional emails such as account confirmations, password resets, invitations, and notifications.
• Generate documents on your behalf, such as tenancy agreements produced from contract templates.
• Detect and prevent abuse, fraud, and unauthorized access; investigate incidents.
• Respond to your support requests and improve the product.

We do not sell your personal information, and we do not use it for advertising.

Cookies and similar technologies

We use a small number of strictly necessary cookies. We do not use cookies for advertising or third-party tracking.

• A signed, HTTP-only session cookie that keeps you logged in.
• Short-lived cookies used during sign-in, OAuth callbacks, and CSRF protection.

How we share information

We share information only with the third parties that help us operate the platform, and only to the extent they need to perform their function on our behalf:

• Cloud hosting and database providers that store the data backing your account.
• Transactional email delivery providers used to send confirmations, password resets, invitations, and notifications.
• File storage providers used to host uploaded contract PDFs, profile images, and other attachments.
• Identity providers (such as Google) when you choose to sign in with OAuth — we receive your name, email, and the provider's unique account ID.

We may also disclose information when required by law, to protect the rights and safety of users, or in connection with a corporate transaction such as a merger or acquisition.

How we protect information

We use industry-standard safeguards to protect your data, including TLS in transit, bcrypt password hashing, signed cookies, scoped data access by organization, and access controls based on roles within each organization. No system is perfectly secure, so please choose a strong password, keep your credentials private, and tell us right away if you suspect unauthorized access.

Data retention

We keep your account information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account at any time from your account settings or by contacting us.

Your rights and choices

You have meaningful control over your data within the platform:

• Access and update most of your information from your account and organization settings.
• Export or download contract PDFs and other documents you uploaded.
• Remove members from organizations you own, or leave organizations you belong to.
• Request deletion of your account; depending on your jurisdiction, you may also have rights to access, correct, restrict, or object to certain processing.

Contact us using the details below to exercise any right we cannot fulfill directly through the application.

Children's privacy

The service is intended for use by adults managing rental properties. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, contact us so we can delete it.

International data transfers

Your information may be processed in countries other than the one where you live, in line with our hosting and service provider arrangements. Where required, we use appropriate safeguards to protect personal information transferred internationally.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the application or by email. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at privacy@leaseytenant.com.