Privacy Policy
Draft — pending attorney review
What we collect
- Account data: name, email address, optional phone number, password (stored only as a memory-hard hash), sign-in timestamps and IP addresses used for security.
- Organization data: properties you add, nicknames, ownership entity names, unit counts, team membership and roles.
- Government records: published agency records matched to your properties, stored with the raw source payload for audit.
- Workflow content: work orders, notes, tasks, materials, uploaded documents, photographs and signatures.
- Operational data: notification delivery status, audit log entries and error diagnostics.
How we use it
To match your properties to agency records, deliver the alerts you configure, operate the workflow features, bill your subscription, and secure and support the service. We do not sell personal data and we do not use your content to train third-party models.
Tenant and occupant information
Agency records and work orders can contain apartment numbers and, where you enter them, occupant names and signatures. Treat this as sensitive. PropNotice never places tenant detail in an SMS message, restricts document access to permitted members, and records every document view and download in an access log.
Sharing
We share data only with the processors needed to run the service: our database and object storage host, the email delivery provider, the optional SMS provider, the payment processor, and — only if enabled by your administrator — the AI provider used to generate summaries. [REVIEW] List each subprocessor by name and location.
Retention, export and deletion
Organization administrators can request a full data export or deletion of organization data from Settings. Deletion requests require administrator confirmation and are subject to legal retention holds; we do not delete data immediately on subscription cancellation. [REVIEW] Specify retention periods and any statutory hold obligations.
Security
Tenant data is isolated at the database level with row-level security, transport is encrypted, secrets are held in the platform secret store, download links are short-lived and signed, and security-sensitive actions are written to an immutable audit log.
Contact
[REVIEW] Add the controller entity, postal address, privacy contact and any DPO details.