Privacy Policy

1. Our role

For information our customers put into EPMS about their owners, guests, tenants, vendors and staff, the property management company decides what is collected and why, and EPMS processes it on their behalf as a service provider. If you are an owner or guest, your property management company is responsible for that information; please contact them first with requests about it. We will help them respond.

For information about our customers' own accounts (the people who sign in to EPMS to work), and for information we collect to run and secure the service, EPMS is responsible.

2. Information we collect

We do not share information collected for marketing or promotional use.

• Account information: name, email address, phone number, role and sign-in details (passwords are stored only as secure one-way hashes; two-step login keys are encrypted).
• Business records our customers enter: units, owners, guests, tenants, vendors, reservations, rates, documents, communications, accounting and trust accounting records.
• Bank information, only if a customer connects a bank account through Plaid: account names, the last digits of account numbers, and transactions. See section 4.
• Payment information: card and bank payments are entered directly with the customer's payment processor (for example Stripe). EPMS does not store full card numbers.
• Technical information: sign-in history (date, time, IP address), security logs, and the browser and device used. EPMS uses only the cookies needed to keep you signed in and to remember settings; we do not use advertising or tracking cookies.

3. How we use information

We use information only to:

• provide, maintain and improve EPMS and give support;
• process reservations, payments, owner statements, trust accounting and communications as our customers direct;
• secure the service: verify sign-ins, prevent fraud and abuse, and investigate security incidents;
• send service messages (for example password resets, security alerts and notices about changes to this policy);
• meet legal obligations.

4. Bank connections through Plaid

If you choose Connect a bank, EPMS uses Plaid Inc. ("Plaid") to connect to your bank. You sign in to your bank in Plaid's secure window; EPMS never sees or stores your bank password. You choose which accounts to share.

EPMS receives account names, the last digits of account numbers, and transactions for the accounts you choose, and uses them only to provide the bank feed, reconciliation and accounting features you asked for. We do not sell this data, use it for advertising, or share it except with the service providers in section 5. Plaid's handling of your data is described in the Plaid End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy).

You can disconnect a bank at any time on the Bank Feed page; EPMS then revokes its access through Plaid and deletes the connection credentials. Transactions already brought in become part of your accounting records and are kept with them (section 7).

5. How we share information

We do not sell personal information, and we do not share it for advertising. We share it only:

• with service providers that help us run EPMS, under contracts requiring them to protect it: Cloudflare (hosting, databases, storage, security), Resend (email), Twilio (text messages, if used), Plaid (bank connections, if used), and Anthropic (AI drafting features, only for text submitted to them);
• with services our customers choose to connect, such as their payment processor or booking channels, as they direct;
• when required by law or to protect the rights, safety and security of our customers, users or EPMS;
• with a successor if EPMS is involved in a merger or sale, subject to this policy.

6. How we protect information

EPMS keeps a written information security program. Information is encrypted in transit and at rest; bank and payment credentials are additionally encrypted; each customer has its own separate system; administrators use two-step login; access is limited by role and reviewed; sign-ins are protected against repeated guessing; and every system is backed up nightly and monitored. No system is perfectly secure, but we work to protect your information and will notify affected customers of a security incident as required by law and our contracts.

7. How long we keep information

We keep customer records for as long as the customer uses EPMS, and as required by law (trust accounting and financial records are typically kept for seven years under Colorado real estate and tax rules). When a customer leaves, they may export their data for 60 days, after which it is deleted from the live service; backup copies are deleted on their normal schedule. Bank connection credentials are deleted when a bank is disconnected. Security and sign-in logs are kept for up to 12 months.

8. Your rights and choices

Depending on where you live (including under the Colorado Privacy Act and the California Consumer Privacy Act), you may have the right to know what personal information we hold about you, to correct it, to delete it, to receive a copy, and to opt out of its sale or targeted advertising (EPMS does neither). To make a request, email [email protected]. We will acknowledge it within 10 business days and respond within 45 days. If your information is held in EPMS by a property management company, we may refer your request to them. We will not discriminate against you for exercising your rights.

9. Children

EPMS is a business service and is not directed to children under 16. We do not knowingly collect their personal information as users.

10. Changes to this policy

If we make a material change, we will show the new policy in EPMS and ask users to accept it before continuing, and update the effective date above.

11. Contact us

Escalated Property Management Systems Inc., Colorado. Privacy questions and requests: [email protected].