What we collect
We collect account and contact information, property and tenant records, lease documents, financial transaction data you upload, product activity, support communications, and technical information required to operate and secure the service.
How we use information
- Provide lease extraction, rent, banking, CAM, reporting, and communication workflows.
- Authenticate users, isolate company workspaces, prevent abuse, and maintain audit history.
- Process subscriptions, respond to support requests, and improve product reliability.
AI processing
Documents submitted for AI extraction may be processed by OpenAI to return structured lease terms. Extracted information must be reviewed before becoming an active tenant, charge, fee, or rule. The TenantPoint assistant in chat also uses OpenAI, as described under Chat below.
Chat on our website and in TenantPoint
On our website. Before you send a message in website chat, we ask for your email address and, if you like, your name. We store them with your messages, the page you were on, whether you agreed to one follow-up email, and a one-way hash of your IP address (to limit abuse). Cloudflare Turnstile checks that you are a person, not a bot, before a chat starts. A cookie lets you come back to your conversation; it holds only an identifier we sign, and is not used for tracking. Your browser also remembers when we last asked whether you had questions and whether you hid the chat button. Starting a chat creates a contact record for you, so the TenantPoint team can follow up on your questions.
The TenantPoint assistant. In website chat, the assistant answers first, using our public Help Center and published pricing. OpenAI processes your messages to write its replies; under OpenAI’s API terms, they are not used to train OpenAI’s models. Where the assistant is turned on inside TenantPoint, it can also read the workspace information you can already see (such as your setup progress, properties, tenants, leases, and balances) to answer your question, and screenshots you attach to a question may be sent to OpenAI. It never sees bank login details, connection tokens, or other people’s accounts. You can ask for a person at any time.
Inside TenantPoint. Support conversations, and the screenshots and PDFs you attach, are stored with your account and are visible only to you and the TenantPoint team. When we reply and you are not looking at the chat, we email you the reply.
Emails and retention. We email you our replies and, if you haven’t answered one after a few days, ask once whether it solved things. If you agreed to it in website chat, we send one follow-up email, with a link to stop it. Website chats where you gave an email but never sent a message are deleted after 30 days; other chats are kept as support communications, like your contact record, until you ask us to delete them. Please do not share passwords, bank details, or card numbers in chat; we will never ask for them.
Analytics
We use Google Analytics, with IP addresses anonymized, to understand website traffic and to measure product usage inside the signed-in workspace, such as which setup steps are completed. It does not receive lease, tenant, or financial content. We also use Ahrefs Web Analytics, a cookieless page-view counter that does not collect personal information, on the public website. You can block either with a browser extension or privacy setting without affecting your ability to use the service.
To understand which pages and campaigns bring people to TenantPoint, our website stores the referring source and landing page of your first visit in your browser’s local storage for up to 90 days, and attaches it to a demo or contact request, or an email signup, you choose to submit. It contains no personal information and is never read by third parties. Free tools on the site (calculators, the rent roll generator, the lease date tracker) save your entries only in your own browser’s local storage; nothing you type into them is sent to us.
Email signups and operator notes
When you ask us to email you a template, checklist, or the landlord toolkit, or sign up for our operator notes, we store your email address, the name and company you choose to give, what you asked for, the page you were on, whether you ticked the box to receive operator notes, and the IP address of the request (to stop abuse). We use Resend to send you the email with your links. That request alone does not put you on a mailing list.
We send our monthly operator notes only if you opted in, by ticking that box or using the newsletter signup. Every one includes an unsubscribe link, which works immediately. If you unsubscribe, a later download request will not add you back.
Service providers
Infrastructure may include Vercel (hosting), Supabase (database, authentication, and file storage), OpenAI (lease extraction and the TenantPoint assistant), Cloudflare (Turnstile bot checks for website chat), Stripe (billing and, where enabled, tenant ACH payments), Resend (email), Google Analytics, Telnyx (text messaging, once activated), Sentry (error monitoring, once activated), and Calendly (scheduling walkthroughs: when you book one, Calendly receives your name, email, the answers you give, and the time you pick, and sends the calendar invite and any reminders). Each receives only information needed for its function.
For tenant ACH payments, Stripe collects and processes sensitive payment and bank information through its own controlled payment flow. TenantPoint retains payment amounts, status, relationships to the relevant tenant and workspace, safe Stripe identifiers, and audit events; TenantPoint does not intentionally store raw bank-account credentials, routing numbers, or Stripe onboarding identity documents.
Optional connections you can enable inside the product: Plaid, if you connect a bank account, receives your bank login through its own secure interface and returns account and transaction data to your workspace; TenantPoint never sees your bank credentials and stores the resulting access token encrypted. Intuit QuickBooks Online, if you connect it, receives the invoices, payments, and expenses you choose to push from TenantPoint and returns its own record identifiers; TenantPoint does not read or change records it did not create. You can disconnect either at any time from within the product, which revokes TenantPoint’s access.
Retention and deletion
Information is retained while an account is active, including during a free trial. Authorized owners may request an export or deletion at any time from Settings → Security.
Free trials that end without a paid plan: the workspace becomes read-only and its data is kept for at least 90 days after the trial ends. After that it may be permanently deleted, including the workspace’s properties, tenants, leases, and documents, and the owner’s sign-in unless they also belong to another TenantPoint workspace. Before any such deletion we email the workspace owner 30 days, 7 days, and 1 day ahead with the deletion date, so there is time to choose a plan or request an export.
For every account, paid or trial, and after any deletion, we keep limited information as needed for security, disputes, and legal obligations: for example, a record that a workspace was deleted (its name and the owner’s email address), and our email contact record for you (name, company, email address, and email preferences, so an unsubscribe keeps working). Email us to have a contact record removed.
Contact
Email hello@tenantpoint.co with privacy questions or requests, or use the website contact form. Workspace owners can also request an export or deletion from Settings → Security.