Privacy Policy

1. Who this policy covers

This policy applies to three groups of people:

• Visitors who browse the Site, request a demo, or contact us.
• Customers and their staff who hold an account on the Service.
• Residents, applicants, owners, and vendors whose information a customer enters into the Service. For that information the customer (your property manager, landlord, or association) decides what is collected and why, and we process it on their behalf. See Section 6.

If you download the DoorForm software and self-host it, this policy does not apply to that installation. The operator of a self-hosted instance is responsible for its own privacy practices, and we do not receive data from it unless the operator connects it to a service we run.

2. Information we collect

Information you give us.

• Contact and demo requests: your name, email address, phone number, company, the number of units you manage, and anything you write in the message field.
• Account information: name, email, phone, job title, organization, and login credentials when a customer sets up accounts on the Service.
• Billing information: billing contact, address, and payment details for the managed Service. Card and bank details are collected and stored by our payment processor, not by us.
• Support and correspondence: the contents of emails, support tickets, and other messages you send us.

Information collected automatically.

• Server logs: the Site and Service are delivered through Cloudflare, which records IP address, browser type, requested pages, referring URL, and timestamps for security and performance purposes.
• Service usage and audit logs: within the Service we record actions such as logins, record changes, and payments, along with the user and time, so that customers have an audit trail and we can investigate problems.
• Device and browser preferences: for example, the light or dark theme you choose on the Site. See Section 5.

The Site itself does not use advertising trackers or third-party analytics scripts.

3. How we use information

We use the information described above to:

• respond to your demo request, question, or support ticket;
• provide, operate, secure, back up, and support the Service;
• set up and bill accounts, and send invoices and account notices;
• tell you about DoorForm features, updates, and offerings that we think will interest you (you can opt out at any time);
• monitor for fraud, abuse, and security incidents, and enforce our Terms of Service;
• understand how the Site and Service are used so that we can improve them; and
• comply with legal obligations and resolve disputes.

Where data-protection law requires a legal basis, we rely on performance of a contract (providing the Service you or your organization requested), our legitimate interests (running and securing our business, responding to inquiries), your consent (marketing where consent is required), and compliance with law.

4. How we share information

We do not sell personal information and we do not share it with third parties for their own marketing. We share information only:

• With service providers who process it on our behalf under contract, such as cloud hosting and content delivery (Cloudflare and our hosting providers), email and SMS delivery, payment processing, applicant screening, electronic signatures, error monitoring, and the team-messaging tools we use to receive contact-form notifications.
• Within the Service, as directed by the customer. For example, a property manager may make an owner statement visible to that owner, or send a resident a payment receipt.
• With integrations you connect. When a customer connects a third-party service (a payment processor, bank feed, or screening provider), we exchange the data needed to make that integration work.
• For legal reasons, when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of DoorForm, our customers, or the public.
• In a business transfer, such as a merger, acquisition, or sale of assets, in which case this policy will continue to apply to the transferred information.

5. Cookies and local storage

The Site sets no first-party tracking cookies. It stores your light or dark theme preference in your browser's local storage so that the choice persists between visits; that value never leaves your browser. Cloudflare may set a small number of strictly necessary cookies to deliver the Site securely and to distinguish humans from automated traffic.

The Service uses session cookies to keep you signed in and to protect against cross-site request forgery. These are necessary for the Service to function and cannot be disabled while you are signed in.

6. Customer data in the service

Customers use the Service to manage properties, leases, accounting, payments, maintenance, and communications. In doing so they enter information about residents, applicants, owners, vendors, and staff, which may include names, contact details, lease and payment history, screening results, identification documents, and bank or card details handled by the payment processor.

For this information the customer is the data controller (or "business" under U.S. state privacy laws) and DoorForm is the processor (or "service provider"). We process it only on the customer's documented instructions and as needed to provide the Service, and we do not use it for our own marketing. Each organization's data is logically isolated from every other organization's within the Service.

If you are a resident, applicant, owner, or vendor and want to access, correct, or delete information held about you, please contact the property manager or organization that uses DoorForm. We will assist them in responding to your request. If you contact us directly we will forward your request to them where we can identify the organization.

7. Security

We use administrative, technical, and physical safeguards designed to protect the information we hold, including encryption in transit (TLS) and at rest, per-organization data isolation, role-based access control, audit logging, regular backups, and limited employee access on a need-to-know basis. Payment card data is handled by a PCI DSS-compliant processor and never touches our servers.

No system is completely secure. If we learn of a security incident that affects your personal information, we will notify affected customers without undue delay and in accordance with applicable law. To report a vulnerability, email hello@doorform.io.

8. Data retention

• Contact and demo requests are kept for as long as needed to respond and follow up, and for up to 24 months afterward unless you ask us to delete them sooner.
• Account and billing records are kept for the life of the subscription and as long afterward as required for tax, accounting, and legal purposes (typically seven years for financial records).
• Customer Data is kept for the life of the subscription. After termination it remains available for export for at least 30 days, after which it is deleted from active systems. Encrypted backups are retained on a rolling schedule and are then overwritten.
• Server logs are kept for a limited period for security and troubleshooting, then deleted or aggregated.

9. Where data is stored

DoorForm is based in the United States and the Service is hosted in U.S. data centers. If you access the Site or Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Enterprise customers who need a specific hosting region or a data-processing agreement cancontact us.

10. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to have it deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. We honor these rights for the information we control (visitor, account, and billing data). For data a customer has entered into the Service, see Section 6.

• Marketing emails: every marketing email we send includes an unsubscribe link. Opting out does not stop transactional messages such as invoices or security notices.
• Access, correction, and deletion: emailhello@doorform.io from the address on file. We may ask for information to verify your identity before acting on a request, and we will respond within the time required by applicable law.
• Do Not Track and opt-out signals: because the Site does not track visitors across sites and we do not sell or share personal information for targeted advertising, there is nothing for these signals to switch off.
• Non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercised a privacy right.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may also lodge a complaint with your local data-protection authority.

11. Children

The Site and Service are intended for businesses and adults. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies). Customers may record a minor's name as an occupant of a unit; that information is controlled by the customer and used only to administer the lease. If you believe a child has provided us personal information directly, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. If a change materially reduces your rights or changes how we use information we have already collected, we will notify customers by email or in the Service before it takes effect.

13. Contact

Questions, requests, or concerns about this policy? Emailhello@doorform.io, or use thecontact form. You can also review thesource codeto see exactly how the software handles data.