[BRACKET], make the described controls real, and have counsel finalize — including any obligations under the [applicable privacy laws — e.g., NY SHIELD Act, CCPA/CPRA if applicable].This Privacy Policy explains how [LEGAL ENTITY NAME] ("BaseRentIQ," "we," "us") collects, uses, discloses, and protects information in connection with the BaseRentIQ service (the "Service"). By using the Service you agree to this Policy and our Terms of Service.
DHCR rent registration histories and leases you upload contain personal information about third parties — tenants and occupants (for example, names, apartment numbers, rents, and tenancy dates). You are responsible for having a lawful basis to submit these records, and for using the Service's output only for legitimate due-diligence purposes and never to harass, re-identify, or unlawfully discriminate against any occupant. We handle this information as a processor acting on your instructions and apply the protections described below.
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, password (hashed), company, role | You, at registration |
| Billing data | Subscription tier, transaction records; card details are handled by our processor and not stored by us | You / [Stripe] |
| Uploaded documents | DHCR rent histories, leases, rent rolls — which may contain tenant personal information | You |
| Property & audit data | Addresses, BIN/BBL, generated audit results | You / public records |
| Public records retrieved | DOB/HPD/ECB/311 records for an address | NYC Open Data |
| Usage & device data | Log data, IP address, pages/actions, cookies or similar | Automatically |
We use information to: provide and operate the Service (including extracting and analyzing uploaded records to generate audits); authenticate accounts and process payments; maintain security, prevent fraud and abuse, and enforce our Terms; provide support; comply with legal obligations; and improve the Service. We do [not] use your uploaded documents or tenant personal information to train our own or third parties' machine-learning models, and we configure our AI processor to prohibit such training on your content [confirm this against your processor's data-processing terms and make it accurate].
We do not sell personal information. We share it only with: (a) service providers / sub-processors that host and operate the Service under contract, including [hosting provider], our payment processor [Stripe], and our AI extraction provider [Anthropic]; (b) authorities where required by law, subpoena, or to protect rights and safety; and (c) a successor in a merger, acquisition, or asset sale, subject to this Policy. A current list of sub-processors is available at [link].
We use reasonable administrative, technical, and physical safeguards designed to protect information, including [encryption in transit (TLS) and at rest], access controls, and least-privilege practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a breach affecting personal information, we will notify affected users and authorities as required by applicable law (including the [NY SHIELD Act]).
We retain account and audit data for as long as your account is active and as needed to provide the Service, then for [retention period] to meet legal, tax, and security obligations, after which it is deleted or de-identified. You may delete individual uploads and audits from within the Service, and you may request deletion of your account and associated personal information by contacting [privacy@yourdomain.com], subject to obligations that require retention.
Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise these rights, contact [privacy@yourdomain.com]; we will respond as required by applicable law. Because much of the tenant information in uploads originates from public DHCR records and is submitted by you as the controller of that use, certain requests from third parties may be directed to you.
We use cookies or similar technologies that are [strictly necessary for authentication and, if applicable, analytics]. You can control cookies through your browser. [If you add non-essential/analytics or marketing cookies, add a consent mechanism and describe it here.]
The Service is operated from the United States and intended for U.S. property due diligence. If you access it from outside the U.S., you understand your information will be processed in the U.S. [Add transfer-mechanism language if you knowingly serve non-U.S. users.]
The Service is a business tool not directed to individuals under 18, and we do not knowingly collect their personal information.
We may update this Policy; material changes will be posted here with a new effective date and, where required, notified to you.
Privacy questions or requests: [privacy@yourdomain.com], [MAILING ADDRESS].