Privacy Policy
Last updated: 2026-04-27 (DRAFT)
1. What we collect
To provide the Service, we collect:
- Account information — your email address and authentication credentials (via Clerk);
- Case information — the structured details you provide about your tenancy: state, move-out date, deposit amount, landlord name and mailing address, your forwarding address, what your landlord did or didn't do;
- Uploaded documents — your lease and any photos or correspondence you upload as evidence;
- Payment information — handled and stored by Stripe; we never see or store your card number;
- Usage data — pages visited, actions taken on the dashboard, anonymized via PostHog.
2. How we use it
- To generate, mail, and track the demand letter you've requested;
- To send transactional emails (case status, delivery confirmation, follow-up reminders);
- To provide and improve the Service;
- To respond to your requests for support;
- For aggregate, anonymized analytics (e.g., "what % of California renters get their full deposit back"). We never publish or share data that identifies you.
3. What we don't do
- We don't sell your personal information to anyone, ever.
- We don't use your case information to train AI models without your explicit, separate opt-in consent.
- We don't share your data with third parties for their own marketing.
4. Document retention
Uploaded documents (leases, photos, evidence) are stored for the active life of your case plus 90 days, after which they are deleted unless you have explicitly chosen to retain them in your account. The generated letters and delivery receipts are retained for the longer of: 7 years, or the statute of limitations in your state for security deposit claims.
5. Sharing
We share information only with:
- Lob — to print and mail your certified letter (recipient address, letter content);
- Stripe — for payment processing;
- Clerk — for authentication;
- Anthropic — for parsing your uploaded lease into structured fields. Your documents are not used to train Anthropic models;
- Resend — for transactional email delivery;
- Google Cloud Platform — for application hosting and database storage.
We may also disclose information when required by valid legal process (subpoena, court order).
6. Your rights
Depending on your jurisdiction (CCPA in California, VCDPA in Virginia, CPA in Colorado, GDPR for EU visitors, etc.), you may have the right to:
- Access the personal information we have about you;
- Correct inaccurate information;
- Delete your account and associated data;
- Export your data in a machine-readable format;
- Opt out of certain data processing activities.
Email privacy@securitydepositback.com to exercise any of these rights. We respond within 30 days.
7. Security
We use industry-standard practices: TLS in transit, encryption at rest for sensitive fields, access controls, audit logging. No system is perfectly secure; we will notify affected users of any data breach as required by law.
8. Children
The Service is not directed to children under 18 and we do not knowingly collect data from anyone under 18.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email to active users.
10. Contact
Privacy questions? Email privacy@securitydepositback.com.