Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide when using our Service, including:

• Account Information: Name, email address, password, and other registration details
• Profile Information: First name, last name, and contact preferences
• Payment Information: Billing address and payment method details (processed securely through our payment processor, Stripe)
• Communication Data: Information provided when you contact us for support or feedback

1.2 Documents and User Content

To provide our lease analysis service, we collect and process:

• Lease Documents: Residential lease agreements and related documents you upload for analysis
• Property Information: Property addresses and related details extracted from or associated with your leases
• Photographs: Move-in and move-out inspection photos you upload
• Generated Documents: Letters, checklists, and other documents created through our Service

1.3 Automatically Collected Information

When you access or use our Service, we automatically collect certain information, including:

• Device Information: Device type, operating system, browser type, and unique device identifiers
• Usage Data: Pages viewed, features used, actions taken, and time spent on the Service
• Log Data: IP address, access times, referring URLs, and error logs
• Location Information: General geographic location based on IP address

1.4 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to collect information and improve our Service. These technologies help us:

• Remember your preferences and settings
• Authenticate users and prevent fraud
• Analyze usage patterns and improve the Service
• Deliver relevant content and advertisements

You can control cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of our Service.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Improving the Service

• Analyze your lease documents and provide reports
• Generate letters, checklists, and other documents
• Store and organize your documents and photos
• Process payments and manage subscriptions
• Respond to your inquiries and provide customer support
• Improve and optimize our Service and user experience
• Develop new features, tools, and services based on aggregated user data

2.2 Communications

• Send transactional emails (account confirmations, receipts, etc.)
• Provide important notices about your account or the Service
• Send marketing communications (with your consent, where required)

2.3 Safety and Security

• Detect, prevent, and respond to fraud and security threats
• Enforce our Terms of Service and other policies
• Comply with legal obligations

2.4 Analytics, Research, and Aggregate Insights

• Analyze usage patterns to improve our Service
• Conduct research and development for new features and tools
• Generate aggregated, de-identified statistics about Service usage
• Create market insights such as rental price trends, common lease terms, and frequently flagged clauses by geographic area
• Build data-driven features and tools that help tenants make informed decisions (e.g., rent comparisons, area-specific lease insights)

When we use your data for analytics and aggregate insights, we de-identify and aggregate the information so that it cannot reasonably be used to identify you or any specific property. We may use and share these aggregate, de-identified insights as part of our Service or for business purposes. Your individual documents and personal details are never shared in identifiable form.

3. How We Share Your Information

We do not sell your personal information to third parties. We may use aggregated, de-identified data derived from your use of the Service to build features, generate market insights, and improve our products. We may share your information in the following circumstances:

3.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud Infrastructure: Supabase, Vercel, and Amazon Web Services for hosting and data storage
• Payment Processing: Stripe for secure payment processing
• AI Services: Anthropic and OpenAI for document analysis (documents are processed in accordance with their enterprise privacy policies and are not used by these providers to train their models)
• Product Analytics: PostHog (PostHog, Inc.) for product analytics and session replay — loaded only after you click Accept on the cookie banner
• Marketing Analytics: Google Analytics (Google LLC) and Meta Pixel (Meta Platforms, Inc.) for advertising measurement — loaded only after you click Accept on the cookie banner
• Session Replay & UX Research: Contentsquare (formerly Hotjar) for session replay, heatmaps, and UX research — loaded only after you click Accept on the cookie banner
• Error Monitoring: Sentry for application error tracking and diagnostics
• Email Delivery: Resend for transactional and marketing email
• Address Lookup: Google Places API for property address autocomplete
• Anti-Abuse: hCaptcha for bot and spam protection on signup, newsletter, and other public forms

These service providers are contractually obligated to use your information only for the purposes of providing services to us and to maintain appropriate security measures.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests, including:

• Court orders, subpoenas, or other legal processes
• Requests from law enforcement or government agencies
• To protect our rights, privacy, safety, or property
• To investigate potential violations of our Terms of Service

3.3 Business Transfers

If Honestkey™ is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

3.4 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

4. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption: All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption
• Access Controls: Every table enforces row-level security tied to your signed-in account, so a request that reached the wrong record is refused by the database itself. Administrative access to production is limited to the people who need it and protected by multi-factor authentication
• Secure Infrastructure: Our hosting, database and payment providers each hold their own SOC 2 attestations. Honestkey™ does not hold one of its own — see our security overview for what we do and do not have
• Breach Notification: If a security incident affected your data we would tell you directly and promptly, with what we know, what we did, and what it means for you

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our Service. We may also retain and use your information as necessary to:

• Comply with legal obligations
• Resolve disputes
• Enforce our agreements
• Maintain security and prevent fraud

When you delete your account, we will delete or anonymize your personal information within thirty (30) days, except where retention is required by law or for legitimate business purposes. Aggregated, de-identified data that has already been derived from your information may be retained indefinitely, as it can no longer be linked back to you.

5.1 Document Retention

Uploaded lease documents and associated analysis results are retained while your account is active. You may delete individual documents at any time through your account settings. Upon account deletion, all documents and personally identifiable information will be permanently deleted within thirty (30) days. Aggregated, de-identified insights derived from your data prior to deletion (such as anonymized rent data points or clause frequency statistics) may be retained.

6. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

6.1 Access and Portability

You can access and download your personal information and documents through your account settings or by contacting us.

6.2 Correction

You can update or correct your account information at any time through your account settings.

6.3 Deletion

You can delete your account and associated data through your account settings or by contacting us. Note that we may retain certain information as required by law or for legitimate business purposes.

6.4 Marketing Communications

You can opt out of marketing communications by clicking the “unsubscribe” link in our emails or updating your communication preferences in your account settings. You will continue to receive transactional communications.

6.5 Do Not Track

Our Service does not currently respond to “Do Not Track” browser signals. However, you can control tracking through your browser settings and cookie preferences.

7. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected, the sources of collection, our business purposes, and categories of third parties with whom we share information.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information to third parties. We may use de-identified, aggregated data for analytics, product features, and business purposes (as described in Section 2.4), which does not constitute a “sale” under the CCPA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please contact us using the information provided below. We may need to verify your identity before processing your request.

7A. EU/EEA and UK Privacy Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent UK law give you additional rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — ask us to delete your personal data, subject to legal-retention exceptions.
• Right to restrict processing — ask us to pause processing while a dispute is resolved.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interests, including for direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. For analytics and advertising cookies, withdraw consent by clearing the honestkey-cookie-consent key from your browser's local storage and clicking Decline when the banner reappears.
• Right to lodge a complaint — file a complaint with your local data-protection authority.

Lawful bases. We process your personal data on the bases of (a) contract — to provide the Service you signed up for; (b) consent — for non-essential cookies, marketing emails, and optional features; (c) legitimate interests — for security, fraud prevention, and product improvement, balanced against your rights; and (d) legal obligation — to comply with tax, accounting, and law-enforcement requirements.

To exercise any of these rights, contact us through our support page. We will respond within 30 days. We may need to verify your identity before processing your request.

8. International Data Transfers

Honestkey™ is based in the United States. If you access our Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

By using our Service, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules. We take appropriate measures to ensure your information is protected in accordance with this Privacy Policy.

9. Children's Privacy

Our Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

10. Third-Party Links and Services

Our Service may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our Service.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our Service before the changes become effective. Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

For questions specifically about your account or documents, please contact our support team at our support chat.