Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening
Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Leon Serfaty
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
969d5d4c8a
commit
c9968531e4
@@ -1,17 +1,254 @@
|
||||
export const metadata = { title: "Privacy Policy — Property Management Network" }
|
||||
import { LegalPage, Section, Callout, LegalContact } from "@/components/marketing/legal"
|
||||
import { LEGAL, SUBPROCESSORS } from "@/lib/legal"
|
||||
|
||||
export default function PrivacyPage() {
|
||||
export const metadata = {
|
||||
title: "Privacy Policy",
|
||||
description:
|
||||
"How we collect, use, share, and protect personal data, and the privacy rights available to you under the GDPR and California law.",
|
||||
alternates: { canonical: "/privacy" },
|
||||
}
|
||||
|
||||
export default function Page() {
|
||||
return (
|
||||
<div className="mx-auto max-w-3xl px-6 py-24">
|
||||
<h1 className="text-3xl font-bold text-white mb-8">Privacy Policy</h1>
|
||||
<p className="text-white/50 text-sm leading-relaxed">
|
||||
This Privacy Policy describes how Property Management Network collects, uses, and protects your information.
|
||||
We collect only the data necessary to provide the service (account info, property data you enter,
|
||||
and usage analytics). Your data is stored securely in Supabase with row-level security —
|
||||
no other user can access your records. We do not sell your data to third parties.
|
||||
Files you upload are stored in private buckets and accessible only to you.
|
||||
For questions, contact us at support@propertymanagement.network.
|
||||
</p>
|
||||
</div>
|
||||
<LegalPage
|
||||
title="Privacy Policy"
|
||||
subtitle="This policy explains what personal data we process, why, how we protect it, and the rights you may exercise."
|
||||
>
|
||||
<Section heading="Introduction and scope">
|
||||
<p>
|
||||
<strong>{LEGAL.service}</strong> (the <strong>Service</strong>) is operated by{" "}
|
||||
<strong>{LEGAL.entity}</strong> (<strong>we</strong>, <strong>us</strong>, or{" "}
|
||||
<strong>our</strong>). This Privacy Policy describes how we handle personal data when you
|
||||
(the account holder, referred to as <strong>you</strong> or the{" "}
|
||||
<strong>Customer</strong>—typically a landlord or property manager) use the Service,
|
||||
and how we handle personal data relating to a <strong>Tenant</strong>, meaning an end user
|
||||
whose data the Customer manages within the Service.
|
||||
</p>
|
||||
<p>
|
||||
We act in two distinct roles. We are the <strong>controller</strong> of the account and
|
||||
profile data that relates to your use of the Service. We are a <strong>processor</strong>{" "}
|
||||
of the property, unit, Tenant, lease, and financial records that the Customer enters,
|
||||
because the Customer determines the purposes and means of that processing. Our processing
|
||||
of that data on the Customer’s behalf is governed by our{" "}
|
||||
<a href="/dpa">Data Processing Addendum</a>.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Information we collect">
|
||||
<p>We collect the following categories of information:</p>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Account and profile data</strong>—such as your name, email address,
|
||||
password credentials, organization details, and preferences.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Portfolio data you enter</strong>—property, unit, Tenant, lease, rent,
|
||||
maintenance, and expense records that the Customer creates or uploads to the Service.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Payment metadata</strong>—billing information processed through Stripe.
|
||||
Stripe handles card details directly; we never receive or store full card numbers.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Usage and device or log data</strong>—such as IP address, browser type,
|
||||
device information, pages accessed, and timestamps generated when you use the Service.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Cookies and similar technologies</strong>—as described in our{" "}
|
||||
<a href="/cookie-policy">Cookie Policy</a>.
|
||||
</li>
|
||||
</ul>
|
||||
</Section>
|
||||
|
||||
<Section heading="How we use information">
|
||||
<p>We use personal data to:</p>
|
||||
<ul>
|
||||
<li>Provide, operate, maintain, and improve the Service;</li>
|
||||
<li>Process billing, subscriptions, and payments through Stripe;</li>
|
||||
<li>Protect the Service through security monitoring and fraud prevention;</li>
|
||||
<li>Respond to support requests and communicate with you about your account;</li>
|
||||
<li>
|
||||
Generate optional AI insights when you choose to use AI features (described below); and
|
||||
</li>
|
||||
<li>Comply with legal obligations and enforce our agreements.</li>
|
||||
</ul>
|
||||
</Section>
|
||||
|
||||
<Section heading="Legal bases for processing">
|
||||
<p>
|
||||
Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal
|
||||
bases:
|
||||
</p>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Performance of a contract</strong>—to provide the Service you have signed
|
||||
up for and to administer your account and billing.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Legitimate interests</strong>—to secure, maintain, and improve the Service
|
||||
and to prevent fraud and abuse, provided such interests are not overridden by your
|
||||
rights.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Consent</strong>—where you have given it, for example when you choose to use
|
||||
optional features such as AI insights or optional sign-in providers.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Legal obligation</strong>—to comply with applicable laws, including the
|
||||
retention of certain financial records.
|
||||
</li>
|
||||
</ul>
|
||||
</Section>
|
||||
|
||||
<Section heading="AI processing">
|
||||
<p>
|
||||
When you choose to use AI features, the relevant portfolio data is sent to{" "}
|
||||
<strong>OpenAI</strong> on a per-request basis in order to generate the requested insight.
|
||||
That data is <strong>not used to train models</strong>. AI features are optional: if you do
|
||||
not use them, no portfolio data is transmitted to OpenAI. See our{" "}
|
||||
<a href="/subprocessors">sub-processors</a> page for further detail.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="How we share information">
|
||||
<p>We share personal data only in the limited circumstances described below.</p>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Service providers and sub-processors</strong>—we engage trusted vendors to
|
||||
host, operate, and support the Service. Our current sub-processors include{" "}
|
||||
{SUBPROCESSORS.map((sp, i) => (
|
||||
<span key={sp.name}>
|
||||
<strong>{sp.name}</strong>
|
||||
{i < SUBPROCESSORS.length - 1 ? ", " : ""}
|
||||
</span>
|
||||
))}
|
||||
. The full, current list is maintained on our{" "}
|
||||
<a href="/subprocessors">sub-processors</a> page.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Legal and safety</strong>—where required to comply with law, respond to
|
||||
lawful requests, or protect the rights, property, or safety of any person.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Business transfers</strong>—in connection with a merger, acquisition,
|
||||
financing, or sale of assets, subject to this policy.
|
||||
</li>
|
||||
</ul>
|
||||
<p>
|
||||
We do <strong>not</strong> sell or rent personal data.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="International data transfers">
|
||||
<p>
|
||||
Personal data may be processed in countries other than the one in which it was collected,
|
||||
including the United States. Where we transfer personal data across borders, we rely on
|
||||
appropriate safeguards such as the <strong>Standard Contractual Clauses</strong> approved by
|
||||
the European Commission, together with supplementary measures where required.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Data retention">
|
||||
<p>
|
||||
We retain personal data for as long as your account remains active. Following account
|
||||
deletion, we delete or anonymize personal data within{" "}
|
||||
<strong>{LEGAL.dataDeletionDays} days</strong>, except where a longer retention period is
|
||||
required by law or for legitimate business purposes such as the retention of financial and
|
||||
tax records.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Security">
|
||||
<p>
|
||||
We protect personal data using encryption in transit and at rest, and we enforce access
|
||||
isolation at the <strong>application layer</strong>: every request is authenticated and
|
||||
scoped to the relevant account, so that one account cannot access another account’s
|
||||
records. Uploaded files are stored privately and served only through authenticated,
|
||||
per-account access. We also employ authentication controls and automated bot protection on
|
||||
our sign-in forms. No method of transmission or storage is <strong>100% secure</strong>, and
|
||||
we cannot guarantee absolute security.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Your privacy rights">
|
||||
<p>
|
||||
Depending on where you live, you may have the following rights in relation to your personal
|
||||
data.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Rights under the GDPR.</strong> If you are in the European Economic Area or the
|
||||
United Kingdom, you may request:
|
||||
</p>
|
||||
<ul>
|
||||
<li>Access to your personal data;</li>
|
||||
<li>Rectification of inaccurate or incomplete data;</li>
|
||||
<li>Erasure of your data;</li>
|
||||
<li>Restriction of processing;</li>
|
||||
<li>Portability of the data you have provided;</li>
|
||||
<li>To object to certain processing;</li>
|
||||
<li>To withdraw consent where processing is based on consent; and</li>
|
||||
<li>To lodge a complaint with a supervisory authority.</li>
|
||||
</ul>
|
||||
<p>
|
||||
<strong>Rights under California law (CCPA and CPRA).</strong> If you are a California
|
||||
resident, you may request to know, delete, and correct the personal information we hold
|
||||
about you, and to opt out of any sale or sharing of personal information. We do{" "}
|
||||
<strong>not</strong> sell or share personal information for cross-context behavioral
|
||||
advertising.
|
||||
</p>
|
||||
<p>
|
||||
To exercise any of these rights, contact us at{" "}
|
||||
<a href={`mailto:${LEGAL.privacyEmail}`}>{LEGAL.privacyEmail}</a>. We will respond within
|
||||
the timeframe required by applicable law and may need to verify your identity before acting
|
||||
on your request. For further detail on data rights, see our{" "}
|
||||
<a href="/gdpr">GDPR and Data Rights</a> page.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Notice to Tenants">
|
||||
<p>
|
||||
If you are a <strong>Tenant</strong>, your landlord or property manager (the{" "}
|
||||
<strong>Customer</strong>) is the <strong>controller</strong> of the data held about you
|
||||
within the Service, and we act as a <strong>processor</strong> on their behalf. Please
|
||||
direct requests to access, correct, or delete your data to the Customer who manages your
|
||||
tenancy. We will assist that Customer in responding, as set out in our{" "}
|
||||
<a href="/dpa">Data Processing Addendum</a>.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Children">
|
||||
<p>
|
||||
The Service is not directed to children, and we do not knowingly collect personal data from
|
||||
children. If you believe a child has provided us with personal data, please contact us so
|
||||
that we can delete it.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section heading="Changes to this policy">
|
||||
<p>
|
||||
We may update this Privacy Policy from time to time. When we make material changes, we will
|
||||
update the date shown above and, where appropriate, provide additional notice. Your
|
||||
continued use of the Service after an update constitutes acceptance of the revised policy.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Callout>
|
||||
This Privacy Policy should be read together with our <a href="/terms">Terms of Service</a>,{" "}
|
||||
<a href="/cookie-policy">Cookie Policy</a>, and{" "}
|
||||
<a href="/dpa">Data Processing Addendum</a>.
|
||||
</Callout>
|
||||
|
||||
<LegalContact email={LEGAL.privacyEmail}>
|
||||
{
|
||||
"If you have questions about this policy or wish to exercise your privacy rights, contact us at "
|
||||
}
|
||||
</LegalContact>
|
||||
<Section heading="Data protection contact">
|
||||
<p>
|
||||
For data-protection matters specifically, you may also contact our data protection team at{" "}
|
||||
<a href={`mailto:${LEGAL.dpoEmail}`}>{LEGAL.dpoEmail}</a>.
|
||||
</p>
|
||||
</Section>
|
||||
</LegalPage>
|
||||
)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user