Privacy Policy

1. Introduction

Welcome to PurelyPayments ("Company," "we," "us," or "our"). We provide a mobile application and web-based platform that enables property managers and landlords to collect rent payments from tenants, manage properties, and handle related documentation.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use the PurelyPayments mobile application ("App") and our related websites and services (collectively, the "Services"). This policy applies to all users of our Services, including property managers, landlords, and tenants.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Information We Collect

We collect various types of information depending on how you interact with our Services and whether you are a property manager/landlord or a tenant.

2.1 Account and Identity Information

• Registration Information: Email address, password (stored in hashed/encrypted form), and full name
• Profile Information: Account preferences and settings
• Authentication Data: Information used to verify your identity when you sign in, including through Google or Apple single sign-on if you choose to use these options

2.2 Financial and Payment Information

• Payment Provider Identifiers: Stripe account, customer, checkout session, payment intent, invoice, and subscription identifiers
• Bank Account Information: Bank account name, bank institution name, and last four digits of account numbers. Full account numbers are transmitted directly through Stripe and are not stored on our servers
• Transaction Records: Payment amounts, fees, status, payment provider, and transaction identifiers from Stripe

2.3 Identity Verification Information (KYC)

For landlords and property managers who connect payout accounts through Stripe, Stripe may collect identity and business verification information as part of Stripe Connect onboarding.

2.4 Property and Unit Information

• Property Details: Property name, full address (street, city, state, ZIP code), and year built
• Unit Information: Unit name/number, payment amount, payment frequency, and tenant assignment

2.5 Tenant Information

• Contact Information: Tenant name, phone number, and email address (provided by landlords when creating units)
• Self-Submitted Information: Additional information tenants provide through tenant information request forms
• Tenant Payment Sources: Stripe customer and payment method identifiers for linked payment methods

2.6 Document and Signature Information

• Documents: Lease agreements and other PDF documents uploaded to or generated through our Services
• Electronic Signatures: Signer's name, typed signature, and timestamp
• Signature Audit Information: IP address and user agent (browser/device information) at the time of signing, collected for legal verification purposes

2.7 Device and Technical Information

• Device Identifiers: App-generated device IDs used for security and multi-factor authentication
• Device Information: Device model name (used for trusted device management in MFA)
• Log Data: Information automatically collected when you access our Services, including access times and pages viewed

2.8 Communications Information

• SMS Logs: Phone numbers that receive SMS messages, message types, and Twilio message identifiers
• Email Communications: Records of emails sent through our Services

2.9 Maintenance Request Information

• Tenant contact information
• Description of maintenance issues
• Photographs of maintenance issues

3. How We Collect Information

3.1 Information You Provide Directly

We collect information that you voluntarily provide when you:

• Create an account and register for our Services
• Complete your landlord/property manager profile
• Add properties and units to your account
• Set up payment processing with Stripe and link payout accounts through Stripe-hosted onboarding
• Submit identity verification information for ACH payment setup
• Upload or sign lease documents
• Submit maintenance requests
• Contact us with questions or support requests

3.2 Information Collected Automatically

When you use our Services, we automatically collect certain technical information:

• Device identifiers generated by our App for security purposes
• Device model information for trusted device management
• IP address and user agent when you sign documents electronically
• Usage data and interaction information within the App

3.3 Information from Third Parties

We receive information from third-party service providers:

• Stripe: payment status, payment confirmation, connected account status, and hosted checkout activity
• Google/Apple: Basic profile information if you choose to sign in using these services

3.4 Information from Other Users

Landlords and property managers may provide information about their tenants, including names, phone numbers, and email addresses, when setting up units within our Services.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Providing and Operating Our Services

• Create and manage your account
• Process rent payments and other financial transactions
• Facilitate bank account linking and verification
• Enable property and unit management
• Generate and store lease documents
• Process electronic signatures with legal audit trails
• Send payment requests, reminders, and confirmations via SMS and email
• Process and track maintenance requests

4.2 Security and Fraud Prevention

• Verify user identity and prevent unauthorized access
• Manage trusted devices for multi-factor authentication
• Detect and prevent fraudulent transactions
• Maintain audit trails for electronic signatures
• Protect against security threats and unauthorized activities

4.3 Communication

• Send transactional messages about your account and payments
• Notify tenants of payment requests
• Provide customer support
• Send important updates about our Services

4.4 Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and prevent harm
• Maintain records for tax and regulatory compliance
• Enforce our terms of service

4.5 Service Improvement

• Analyze usage patterns to improve our Services
• Troubleshoot technical issues
• Develop new features and functionality

5. Third-Party Service Providers

We work with trusted third-party service providers to operate our Services. Below is information about our key partners and how your data is shared with them.

6. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

6.1 With Service Providers

We share information with the third-party service providers described in Section 5 to operate our Services, process payments, and communicate with users.

6.2 Between Landlords and Tenants

Our Services facilitate communication and transactions between landlords and tenants. Information necessary for these relationships (such as contact information, payment details, and lease documents) is shared between parties as needed to provide our Services.

6.3 For Legal Reasons

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency). We may also disclose information when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing
• Protect the personal safety of users or the public
• Protect against legal liability

6.4 Business Transfers

If PurelyPayments is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

6.5 With Your Consent

We may share your information in other circumstances with your explicit consent.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). This section describes your rights and how to exercise them.

7.1 Your Rights

As a California resident, you have the right to:

• Right to Know: Request information about the categories and specific pieces of personal information we have collected, the categories of sources from which it was collected, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Access: Request a copy of the personal information we have collected about you.
• Right to Delete: Request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information or share it for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: Where applicable, you can limit our use of sensitive personal information to only what is necessary to provide our Services.
• Right to Non-Discrimination: You will not be discriminated against for exercising any of your privacy rights.

7.2 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

7.3 How to Exercise Your Rights

To exercise your California privacy rights, you may:

• Email us at privacy@purelypayments.com
• Submit a request through the App settings

We will verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf by providing written authorization.

7.4 Response Timing

We will respond to verifiable consumer requests within 45 days. If we need additional time (up to 45 additional days), we will notify you of the reason and extension period in writing.

7.5 Do Not Track Signals

Our Services do not currently respond to "Do Not Track" signals as there is no common industry standard for handling such signals.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

8.1 Retention Periods

8.2 Account Deletion

When you request deletion of your account:

• Your personal information will be anonymized rather than completely deleted to maintain financial record integrity
• Active payment relationships and associated records will be retained for legal and tax compliance purposes
• Property and unit data associated with your account will be archived
• Information shared with Stripe is subject to their retention policies

9. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

9.1 Security Measures

• Encryption: All data in transit is encrypted using TLS/SSL. Sensitive data at rest is encrypted.
• Password Security: Passwords are hashed using industry-standard algorithms and are never stored in plain text.
• Access Controls: Access to personal information is limited to employees and contractors who need it to perform their job functions.
• Multi-Factor Authentication: We offer MFA with trusted device management to protect your account.
• Infrastructure Security: We use Supabase's secure cloud infrastructure with enterprise-grade security controls.
• Payment Security: Financial information is processed through secure, compliant payment processors (Stripe).

9.2 Data Breach Response

In the event of a data breach that affects your personal information, we will notify you in accordance with applicable laws and regulations. This notification will include information about the breach, the types of information affected, and steps you can take to protect yourself.

10. Your Choices and Rights

You have several choices regarding your personal information:

10.1 Account Information

You can access and update your account information at any time through the App settings. This includes:

• Your name and email address
• Password and security settings
• Notification preferences
• Linked bank accounts

10.2 Communication Preferences

You can manage your communication preferences:

• Transactional Messages: These are necessary for our Services (payment confirmations, receipts) and cannot be opted out of while using our Services.
• SMS Notifications: Contact us to update your SMS preferences.

10.3 Bank Account Linking

You can unlink bank accounts at any time through the App. Note that this may affect your ability to send or receive payments.

10.4 Account Deletion

You can request deletion of your account by contacting us at privacy@purelypayments.com. As described in Section 8, some information may be retained or anonymized for legal compliance purposes.

10.5 Data Portability

You can request a copy of your personal information in a commonly used, machine-readable format. Contact us to make this request.

11. Children's Privacy

PurelyPayments is a rent payment and property management application designed for use by adults. Our Services are not intended for individuals under the age of 18.

If we learn that we have collected personal information from a person under 18, we will take steps to delete that information as quickly as possible. If you believe that we might have any information from or about a person under 18, please contact us immediately at privacy@purelypayments.com.

12. Mobile Application Disclosures

This section provides additional information about our mobile application.

12.1 App Permissions

Our mobile application may request the following permissions:

• Camera: To take photos for maintenance requests
• Photo Library: To select existing photos for maintenance requests
• Notifications: To send you payment alerts and important updates

12.2 Device Identifiers

Our App generates device identifiers for security purposes, including:

• Managing trusted devices for multi-factor authentication
• Detecting and preventing fraudulent access
• Maintaining session security

These identifiers are generated by our App and are not tied to hardware identifiers or advertising identifiers.

12.3 Data Collection on Mobile

The data we collect through the mobile App is the same as described in Section 2 of this Privacy Policy. We do not collect location data beyond property addresses you provide.

12.4 App Store Privacy

For information about data collection by the Apple App Store or Google Play Store, please refer to their respective privacy policies.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

13.1 Notification of Changes

When we make material changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this page
• Post the updated Privacy Policy on our website and in the App
• For significant changes, send you a notification via email or through the App

13.2 Review of Changes

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our Services after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Complaints

If you are not satisfied with our response to your privacy concerns, you may have the right to lodge a complaint with your local data protection authority.