Effective Date: June 26, 2026

DoorVault ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share information when you use our property management tracking platform at doorvault.app ("Service").

1. Information We Collect

Account Information

When you create an account, we collect your username, email address, display name, and password (stored as a secure hash). We do not store passwords in plain text.

Property and Financial Data

You may enter property details, transaction records, mortgage information, lease terms, occupant details, management company details, documents, and other financial data. This information is provided voluntarily and is essential to delivering the Service.

Usage Data

We collect basic usage information such as login timestamps, pages visited, feature usage, device and browser details, referrer URLs, and approximate location derived from IP address. We use this information to secure the Service, understand product usage, and improve DoorVault. Optional analytics on the app and marketing site may be processed by Google Analytics, and some marketing pages may use Meta Pixel for campaign measurement.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Generate financial reports, tax summaries, and portfolio analytics
• Power the AI assistant feature using your portfolio data as context
• Send account-related notifications (renewal reminders, security alerts)
• Send transactional and service emails, including verification, password, security, billing, portfolio, Knox, document, and product-critical notices
• Send product emails or newsletter emails when you create an account, submit a lead form, request a demo, request a download, run the public deal analyzer, or otherwise opt in; you can unsubscribe from marketing emails at any time
• Respond to support requests
• Detect and prevent fraud or unauthorized access

3. Data Storage and Security

Your data is stored in encrypted databases. We use industry-standard security practices including HTTPS encryption in transit, hashed passwords, and access controls. While we take reasonable measures to protect your data, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

4. Third-Party Services

We use the following third-party services:

• Anthropic (Claude AI): Powers the AI assistant feature. When you use the AI chat, relevant portfolio context is sent to Anthropic's API to generate responses. Anthropic does not use this data for training. See Anthropic's Privacy Policy.
• Google (OAuth, Drive, and Analytics): If you sign in with Google, we receive your email address and profile name from Google. If you connect Google Drive for cloud storage sync, DoorVault accesses files within the folder you select to analyze property documents. We only read file names, metadata, and contents of files in your designated sync folder. We create subfolders to organize documents by property and may upload files back to your Drive. We do not access files outside your selected folder, and we do not modify or delete your existing files. Google Analytics may process page views, device details, referrers, and usage events when analytics is enabled. Your Google Drive data is used solely to provide the DoorVault service and is not sold or shared for advertising purposes. DoorVault's use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Meta (Pixel): Some marketing pages may use Meta Pixel to measure advertising performance after analytics consent. We do not send portfolio data, financial records, documents, or account passwords to Meta.
• Dropbox: If you connect Dropbox for cloud storage sync, DoorVault accesses files within the folder you select, following the same principles as described for Google Drive above.
• Microsoft OneDrive: If you connect OneDrive for cloud storage sync, DoorVault accesses files within the folder you select, following the same principles as described for Google Drive above.
• Apple (Sign-In): If you sign in with Apple, we receive your email address (or Apple relay address) and display name. We do not receive other Apple account data.
• Payment Processor (Stripe): If you subscribe to a paid plan, payment is handled by Stripe. We do not store credit card numbers or banking details on our servers. See Stripe's Privacy Policy.
• Cloudflare (R2 Storage & CDN): Documents you upload are stored securely in Cloudflare R2 object storage. Cloudflare also provides DNS and CDN services for the application.
• Resend (Email): Transactional and marketing emails are sent through Resend. We share only the necessary recipient email address and message content.

4a. Google API Services Disclosure

DoorVault's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: (a) DoorVault only uses Google user data to provide and improve the cloud storage sync feature you explicitly enable; (b) DoorVault does not use Google user data for serving advertisements; (c) DoorVault does not allow humans to read your Google Drive data unless you provide affirmative consent, it is necessary for security purposes, or it is required by law; (d) DoorVault does not transfer Google user data to third parties except as necessary to provide the service (e.g., sending document content to Anthropic's AI for analysis, which you initiate by enabling cloud sync).

5. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data and property records within 30 days. Certain data may be retained longer if required by law or for legitimate business purposes such as fraud prevention. Anonymized, aggregated data that cannot identify you may be retained indefinitely for analytics purposes.

6. Your Rights

You have the right to:

• Access -- Request a copy of the personal data we hold about you
• Export -- Download your property and financial data in standard formats (CSV)
• Correct -- Update or correct inaccurate information in your account
• Delete -- Request deletion of your account and associated data
• Restrict -- Request that we limit how we process your data

To exercise any of these rights, contact us at [email protected].

7. Cookies

DoorVault uses essential cookies required for authentication, security, session management, preferences, and fraud prevention. Essential cookies are necessary for the Service to function and cannot be disabled through our banner. We also offer optional analytics cookies and similar technologies, including Google Analytics and Meta Pixel on marketing pages, to measure usage and campaign performance. Analytics is not required to use DoorVault, and you can choose "Essential only" in the cookie banner. For more detail, see the Cookie Notice.

8. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share data only when required by law, to protect our rights, to prevent fraud, or with service providers who assist in operating the Service (subject to confidentiality obligations). If you use household sharing, data is shared with members of your household as configured by you.

9. Children's Privacy

DoorVault is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice within the Service at least 14 days before the changes take effect. The "Effective Date" at the top of this page indicates when the policy was last revised.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at [email protected].

---