Privacy Policy

Effective April 2026 · Version 2026-04

This Privacy Policy describes how Ocupado collects, uses, and shares information about you when you use our property-management platform.

1. Information we collect

• Account data: name, email, phone, password hash, role (landlord, manager, staff, worker, tenant).
• Business data: company name, tax ID, payout method, and for landlords using Stripe Connect, the information Stripe collects for KYC (stored by Stripe, not by us).
• Property and tenancy data: properties, units, leases, invites, access codes, maintenance requests, messages, community posts.
• Payment data: rent invoices and statuses. Card numbers are handled by Stripe — we never see or store them.
• Usage and device data: IP address, browser/user-agent, login timestamps, audit events.
• Email delivery data: we use Zoho SMTP to send transactional email.
• Smart-lock data: device identifiers and access codes, routed through the Seam API.

2. How we use information

• Operate the service and your account.
• Process payments via Stripe.
• Send transactional emails (receipts, invites, password resets, verifications, notifications).
• Secure the service (rate-limiting, fraud prevention, audit logging).
• Improve and debug the product.

We do not sell your personal information. We do not use your data to train third-party AI models.

3. Sharing

We share data with processors who help run the service: Stripe (payments), Anthropic (Claude, lease analysis — only the lease text you submit), Seam (smart locks), Zoho (email). Each provider acts as a data processor under their own terms.

4. Your choices (GDPR / CCPA)

You have the right to access, correct, export, or delete your personal data. Authenticated users can:

• Download a copy of your data from your profile.
• Request account deletion from your profile.

We will act on these requests within 30 days. Certain records (payment ledger, disputes) may be retained for legal and accounting purposes.

5. Retention

We retain account data for as long as your account is active. After deletion, we keep limited records required by law (typically 7 years for financial records).

6. Security

We use TLS in transit, bcrypt password hashing, environment-isolated secrets, signed Stripe webhooks, and session-based CSRF protection. See our Security page for more.

7. Children

Ocupado is not directed to children under 18 and we do not knowingly collect data from them.

8. Changes

We may update this policy. We will notify users of material changes by email.

9. Contact

Privacy requests: nerd@a84y.com.