Privacy Policy

This Privacy Policy explains how Portier369 ("Portier369," "we," "us") collects, uses, discloses, and safeguards information when you use our property management platform and related websites and services (collectively, the "Services"). By using the Services, you agree to the practices described here.

Who we are and our role

Portier369 provides software to community association and property management companies ("Customers"). For most information processed in the platform — owner records, payments, communications, and association data — the Customer is the data controller and Portier369 acts as a data processor on the Customer's behalf, under our agreement with them. For our own account, billing, marketing, and website information, Portier369 acts as a controller. If you are a homeowner, board member, tenant, or vendor, please also review your management company's own privacy notice, as they determine how your association data is used.

Information we collect

Account information: name, email address, phone number, role, and login credentials.
Association and property data: units, ownership and occupancy records, tenant and emergency- contact details, ledgers, assessments, violations, work orders, meeting and architectural records, and documents entered or uploaded by Customers (including lease and insurance documents stored in private, access-controlled storage).
Financial and banking data: double-entry accounting records, and — where a Customer connects a bank account — bank-account and transaction information obtained through our banking-data provider (Plaid). See "Payments and financial data" below.
Payment information: where an association enables online assessment payments, Stripe processes payment credentials through that association's own connected Stripe account. We receive transaction and payout identifiers, status, payment-method type, and limited details such as the last four digits; we do not store full card or bank-account numbers on our own servers. Management-company subscription billing may also be processed by a third-party billing provider.
Communications: emails, SMS, and notices sent through the platform, and support correspondence.
Usage and device data: log data, IP address, browser type, and activity within the Services, used to operate, secure, and improve the platform.

How we use information

We use information to provide and maintain the Services; authenticate users and enforce role-based access; process billing and send transactional communications; provide support; detect and prevent fraud and abuse; comply with legal obligations; and improve and develop new features. We do not sell or share personal information for cross-context behavioral advertising.

Payments and financial data

A Customer may enable online assessment payments for an association by connecting that association's own Standard Stripe account. The association, not Portier369, is the payment recipient for direct charges on that account, and Stripe settles funds to the association's designated bank account. Portier369 provides the software workflow and accounting records but does not receive or hold association assessment funds. Stripe collects and tokenizes payment credentials; Portier369 stores only the limited identifiers and payment details needed to operate AutoPay, post the association ledger, and reconcile payouts.

Where a Customer chooses to connect a bank account, we use Plaid to link the account and retrieve transaction information for reconciliation. Plaid holds the banking credentials; Portier369 receives account and transaction data, not login credentials. Plaid's handling of end-user information is described in the Plaid End User Privacy Policy. Stripe's handling of payment information is described in the Stripe Privacy Policy. Subscription billing of management companies is handled by our billing provider subject to its own terms.

Artificial-intelligence features

Some optional features use artificial-intelligence ("AI") services on a bring-your-own-key basis. When a Customer enables these features, it configures its own AI provider (for example, OpenAI, Anthropic, DeepSeek, or a compatible provider) using the Customer's own account and credentials. Content submitted to those features — which may include uploaded documents, images (such as insurance certificates), or association records — is transmitted to the provider the Customer selected, solely to generate the requested output. The Customer selects the provider and is responsible for that provider's terms, including any data-use or model-training terms. AI output may be inaccurate and should not be relied upon as legal, accounting, tax, or compliance advice.

How we share information

We share information with the Customer organization you belong to; with the sub-processors described below, who process data on our behalf under contractual confidentiality and security obligations; when required by law or legal process or to protect rights, property, and safety; and in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Text messages (SMS)

Management companies use Portier369 to send text messages to owners, tenants, and vendors who have agreed to receive them, such as maintenance and work order updates, payment reminders, meeting notices, and community notices. We use your mobile number and consent record only to deliver these messages and to honor opt-out requests. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Reply STOP to any message to stop receiving texts, or HELP for help.

Sub-processors

We engage the following categories of sub-processors to provide the Services:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and content delivery.
• Resend — transactional and bulk email delivery.
• Plaid — bank-account connectivity and transaction data (where enabled by a Customer).
• Stripe — association-owned connected accounts, assessment-payment processing, tokenized payment methods, and payouts (where enabled).
• Our subscription-billing provider — billing of management-company subscriptions.
• Customer-selected AI provider — only where a Customer enables AI features and provides its own credentials (see "Artificial-intelligence features").
• SMS provider — text-message delivery, where SMS features are used.

A current list of sub-processors is available on request at hello@portier369.com.

Data security

We use technical and organizational measures to protect information, including row-level security enforced at the database layer, encryption in transit and at rest, role-based access controls, audit logging, and signed, time-limited URLs for stored documents. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. See our Security page for more.

Security incident notification

We maintain an incident-response process. In the event of a personal-data breach affecting Customer data, we will notify the affected Customer without undue delay after becoming aware, consistent with the Data Processing Addendum and applicable law, and will cooperate with the Customer's own notification obligations.

Data retention and deletion

We retain information for as long as needed to provide the Services and as required by applicable law and our agreements with Customers. Customers control the retention of their association data. Following termination of a Customer agreement, association data is deleted or returned within sixty (60) days, subject to legal retention requirements and routine backup cycles; residual copies in backups are deleted on our regular backup rotation.

Data Processing Addendum

Where Portier369 processes personal data on a Customer's behalf, our Data Processing Addendum ("DPA") governs that processing and is incorporated into the Customer agreement. The DPA addresses processing instructions, confidentiality, sub-processor flow-down, security, breach notification, and deletion or return of data. Customers may request the DPA at the contact address below.

International data transfers

The Services are intended for Customers and associations located in the United States, and information is processed in the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those of your location.

Your privacy rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. Because we often act as a processor, please direct requests concerning association data to your management company; we will assist them as required. For information we hold as a controller, contact us at the address below. We will not discriminate against you for exercising these rights.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the purposes for collection, and the categories of recipients; to request correction or deletion; and to limit the use of sensitive personal information. We do not sell personal information and do not share it for cross-context behavioral advertising. You may exercise these rights, or use an authorized agent to do so, by contacting us at the address below; where we act as a processor, we will route your request to the relevant Customer (the business) and assist them.

Other U.S. state privacy rights

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others) may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to appeal a declined request. Because Portier369 typically processes association data on behalf of a Customer who is the controller, please direct such requests to your management company; we will support them in responding.

Cookies and analytics

We use strictly necessary cookies for authentication and security, and we may use privacy-conscious, aggregated usage analytics provided by our hosting platform to operate and improve the Services. We do not use third-party advertising cookies.

Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect their personal information.

Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, additional notice.

Contact us

Questions about this Policy, or requests to exercise your rights, can be sent to hello@portier369.com.