Privacy Policy

Manor Park OS (“MPOS,” “we,” “us,” or “our”) operates the property management platform available at manorparkos.com and its associated applications. This Privacy Policy describes how we collect, use, store, and share information about you when you use our services.

• Provide, operate, and maintain the Manor Park OS platform
• Process rent payments, security deposits, and application fees
• Verify your identity and conduct required screening
• Connect bank accounts for ACH rent payment via Plaid
• Send transactional communications: rent receipts, lease notices, maintenance updates
• Provide customer support and respond to your inquiries
• Detect and prevent fraud, unauthorized access, and abuse
• Comply with legal obligations and enforce our Terms of Service
• Improve our products through anonymized, aggregated analytics

We do not sell your personal information to third parties. We do not use your data for targeted advertising on third-party platforms.

We share information only as described below:

• Landlords and tenants: Profile and application data is shared between parties to a tenancy as necessary to complete that transaction.
• Service providers: We share data with vendors that help us operate the platform — Stripe (payments and identity), Plaid (bank connections), Resend (email), Supabase (database and storage), Vercel (hosting). Each operates under a Data Processing Agreement.
• Legal compliance: We may disclose information when required by law, subpoena, or to protect the rights and safety of our users and the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction.

We retain personal data for as long as your account is active or as needed to provide services. Our policy retains financial and lease records for at least 7 years, with lease records measured from the end of the tenancy, regardless of subscription tier. Longer legal requirements and specific legal holds may apply. Application data for unsuccessful applicants is retained for 2 years. Deletion or anonymization follows a review of applicable retention obligations and privacy rights; reaching a policy date does not itself authorize deletion.

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest (via Supabase), row-level security on all database tables, and strict access controls. Payment card data is processed exclusively by Stripe and never stored on our servers. No security system is impenetrable — if you discover a vulnerability, please report it to privacy@manorparkos.com.

We use essential cookies for session management and authentication. We use analytics cookies (Google Analytics) to understand aggregate platform usage. You may disable non-essential cookies in your browser settings; this will not affect core platform functionality.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the effective date at the top of this page. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

If you opt in, we send transactional text messages — account verification codes, two-factor authentication (2FA) security codes, and account notifications — delivered through our messaging provider, Twilio. You opt in by checking the dedicated SMS-consent box at sign-up or in your account settings; message frequency varies, and message and data rates may apply. Reply STOP to unsubscribe or HELP for help at any time. Full details are in our SMS Terms & Conditions.

Mobile opt-in information and text-messaging consent are never shared, sold, or rented to third parties or affiliates for their marketing or promotional purposes. Phone numbers collected for SMS are used solely to deliver the messages you have consented to, and are shared only with the messaging provider that transmits them on our behalf.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.