Privacy Policy

1. Who we are

Unpickled (“we”, “us”, “our”) provides a maintenance coordination platform for independent landlords. This policy explains how we collect, use, store, and protect personal data when you use our service. The service is currently available to landlords in the United States, the United Kingdom, and Canada.

2. Data we collect

From landlords (account holders)

• Email address (used for authentication and account communications)
• Name and optional business name
• Phone number (optional, displayed on work orders)
• Property addresses and unit identifiers
• Contractor contact details you add to your directory (names, phone numbers, emails)
• Payment information (processed by Stripe; we do not store card numbers)

From tenants (via SMS or web form)

Tenants do not create accounts. They interact with Unpickled by texting your dedicated maintenance number or by submitting a request through your property's web form. We collect:

• Phone number (used to identify the tenant and route messages)
• Name (provided by the landlord, extracted from messages, or entered by the tenant on the web form)
• Message content (maintenance request details submitted via SMS or web form)
• Photo attachments (uploaded via MMS or the web form, stored securely for maintenance documentation)
• Unit selection (if the tenant selects their unit on the web form)

Automatically collected

• Timestamps of all requests, messages, and status changes
• AI-generated triage classifications and draft responses
• Work order details and status history
• Anonymous page view data (cookie-free, via Vercel Analytics — no personal information)
• Error diagnostics when application errors occur (via Sentry — stack traces, browser/device type)

3. How we use your data

• To provide the Unpickled service — routing requests, generating AI drafts, creating work orders
• To send and receive SMS messages on your behalf via Twilio
• To classify request urgency using AI (Anthropic Claude)
• To process subscription payments via Stripe
• To send you account-related emails (billing, security, material changes to the service)
• To maintain maintenance records for dispute resolution and legal compliance

We do not sell your data. We do not use your data to train AI models. We do not share personal data with third parties except the service providers listed in section 5.

4. Data roles and responsibilities

Landlords are the data controller for tenant personal data they input into Unpickled. As a landlord, you are responsible for having lawful grounds to collect and process your tenants' personal information (for example, as part of your tenancy agreement or legitimate interest in property management).

Unpickled acts as a data processor on the landlord's behalf. We process tenant data only as necessary to deliver the service and in accordance with this policy and our Terms of Service.

5. Third-party services

Personal data is shared with the following services solely to operate the platform:

6. AI processing and fair housing

Maintenance request content is sent to Anthropic's Claude API for two purposes: urgency classification (using a fast model) and response drafting (using a more capable model). Anthropic does not retain input data for model training under their commercial API terms.

AI triage decisions are based solely on the nature of the maintenance issue — never on tenant identity, demographics, or protected characteristics. Hard-coded safety overrides ensure that critical issues (gas leaks, flooding, loss of heating, sewage backup) are always classified as emergencies regardless of AI output.

7. Data security

• All data is encrypted at rest (AES-256 via Supabase/AWS infrastructure)
• All data is encrypted in transit (TLS 1.2+)
• Row-level security (RLS) ensures landlords can only access their own data at the database level
• Authentication uses magic links (no passwords stored)
• Service role keys are used only in server-side webhook processing, never exposed to browsers
• Photo attachments are stored in private buckets with scoped access

8. Data retention

We retain data for as long as necessary to provide the service and to meet legal obligations. Maintenance records may be required for housing disputes, insurance claims, regulatory audits, or legal proceedings — these needs can arise years after the original request.

Active accounts

All data is retained for the duration of your account.

Departed tenants

When a tenant is marked as moved out, their personally identifiable information (name and phone number) is automatically anonymised after 3 years. Maintenance records are retained in anonymised form for a further 3 years (6 years total from departure), then permanently deleted.

Deleted accounts

If you delete your account, your personal information (name, email, phone) is removed immediately. Maintenance records, messages, and work orders are anonymised and retained for up to 6 years from the date of the most recent record, to satisfy statutory retention requirements. After this period, all data is permanently deleted.

Lapsed subscriptions

If your subscription lapses and is not renewed within 90 days, the account deletion process begins automatically.

Interest signups

If you submit your email via our waitlist form, we store only your email address. You can request its removal at any time by emailing us.

9. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to statutory retention obligations.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data in certain circumstances.

For US residents (CCPA/CPRA): You have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information.

For UK residents (UK GDPR): Our lawful basis for processing landlord data is contract performance. For tenant data, the landlord (as data controller) determines the lawful basis. You may lodge a complaint with the Information Commissioner's Office (ICO).

For Canadian residents (PIPEDA): You have the right to access your personal information, request correction of inaccurate data, and withdraw consent to its collection or use (subject to legal or contractual restrictions). We collect, use, and disclose personal information only for the purposes identified in this policy. You may file a complaint with the Office of the Privacy Commissioner of Canada.

10. Tenant rights

Tenants whose data is processed through Unpickled have the right to request access to, correction of, or deletion of their personal data. Because the landlord is the data controller, tenants should direct these requests to their landlord in the first instance.

If a tenant is unable to resolve their request with their landlord, they may contact us directly at privacy@getunpickled.com and we will assist.

11. Cookies

Unpickled uses only essential cookies required for authentication and session management. Our analytics (Vercel Analytics) and error monitoring (Sentry) are cookie-free and do not use tracking scripts. We do not use advertising cookies or third-party tracking.

12. Changes to this policy

We may update this policy from time to time. We will notify account holders of material changes via email at least 30 days before they take effect. The “last updated” date at the top of this page reflects the most recent revision.

13. Contact

For any privacy-related questions or to exercise your rights, contact us at privacy@getunpickled.com.