Privacy

Privacy policy

Draft – pending review. This text is not final legal advice and will change after counsel review.

Draft – last updated October 10, 2026.

Property Portal is a maintenance ledger for property managers, residents, and technicians. This page describes what the website, the Android app, and the iOS app collect, who processes it for us, and how long it is kept.

What we collect

• Account details you type: name, email, optional phone, trade, and role. Your password is stored hashed by Convex Auth.
• Company, building, unit, tenancy, invite, and work-order records. That includes request descriptions, status history, comments, and the photos you attach to a job.
• Device records for new-device confirmation: a trusted-device record and a one-time code sent by email. We do not use these for advertising.
• Billing for company plans. Stripe processes payments and sales tax. We store the Stripe customer and subscription IDs and the plan status. Card numbers are not stored by us.
• Diagnostic data, when our monitoring service is turned on for the app: error reports, page and API timing, and console messages. For a sample of web sessions (about 1 in 10) we also record a session replay. Form inputs are masked in replays.

Cookies and browser storage

We use a sign-in cookie set by Convex Auth so you stay signed in. It is kept for up to 30 days. The monitoring service stores a session identifier and a replay identifier in your browser's session storage, which clears when the tab closes. We do not use advertising or cross-site tracking cookies. Stripe may set its own cookies on Stripe-hosted checkout pages.

Service providers

• Convex: our database, file storage for photos, and sign-in.
• Netlify: hosts the website and the web app.
• Resend: sends transactional email, including password resets, new-device codes, new work-order notices, and assignment notices.
• Stripe: company billing, tax, and the payment webhook.
• Our monitoring service: receives the diagnostic data described above, only where it is configured.

We do not sell personal information. We do not send text messages today.

Who can see it

People in your company see the buildings and work they are allowed to see. Residents see their own units and jobs. Photos are kept in Convex file storage. Staff can update resident and worker contact details from the People page.

Export

Staff can export work orders as CSV or PDF. The export includes each job's history.

How long we keep it

• While a company account is active, work orders, comments, photos, and status history are kept with no age limit.
• A work order that someone deletes stays restorable for 30 days, then it is removed.
• If a company plan is canceled, that company's buildings, work orders, and photos are deleted 120 days after cancellation.
• If you delete your account and you are the only owner of a company, that company's data is deleted right away instead of after 120 days. Other accounts are removed from the company.

Your choices

Owners and managers can delete their own account from the Account page. Residents and workers ask their property manager to remove them. You can ask us for a copy of your data or for deletion by writing to [privacy contact email, founders to set].

Security incidents

If we learn that personal information was accessed without authorization, we notify the people affected. Where South Carolina law requires it (S.C. Code § 39-1-90), we also notify the South Carolina Department of Consumer Affairs and the consumer reporting agencies.

Changes

We will post changes on this page and update the date at the top.

Contact

[Controller legal name and contact address, founders to set]