Privacy Policy

We collect only the data needed to operate the product and support your team:

• Account information — name, work email, organization, role, and authentication credentials.
• Property data — delinquency lists, ledger entries, payment histories, lease terms, and unit/property identifiers your team uploads or syncs.
• Usage data — actions taken inside the product, packets generated, recommendations approved or rejected, features used.
• Device and browser data — IP address, user agent, and session metadata, used for security and abuse prevention.

We use the data above to:

• Generate resolution packets and the recommendations inside them.
• Run compliance flagging against the rules your team configures.
• Produce portfolio reports and audit trails for your team.
• Improve product quality, reliability, and accuracy.
• Communicate account status, billing, security notices, and product updates.

We do not use resident data for any purpose other than generating your resolution packets and the artifacts that surround them.

Resident data — names, unit numbers, balances, ledger histories, lease terms — is the most sensitive data DuePact processes. We treat it as your data, not ours.

• We process resident data solely to generate resolution packets for your team.
• We do not contact residents. DuePact has no resident-facing communication channel.
• We do not share resident data with third parties for marketing, analytics, or any purpose other than the subprocessors listed below.
• We do not use resident data for advertising or to build cross-customer profiles.
• Retention follows your customer agreement and applicable law (see Retention).

We share data only with the subprocessors required to deliver the service:

• Database and infrastructure hosting — for storing account, property, and packet data.
• AI model providers — for packet generation. Data sent for inference is not retained for model training under our provider agreements.
• Transactional email — to deliver account, billing, and security messages to you, never to residents.

We do not sell personal information. We do not run third-party advertising. A current subprocessor list is available for procurement review at privacy@duepact.com.

Resident and account workflow data is retained for 7 years by default and can be configured by client to meet state-specific tenant-law requirements. Deletion and export requests are handled according to the customer agreement and legal retention obligations.

You may request access to, correction of, deletion of, export of, or restriction on processing of personal data we hold about you or your account. Contact privacy@duepact.com and we will respond within 30 days.

DuePact does not sell personal information and does not share personal information for cross-context behavioral advertising. California residents have rights to know, delete, correct, and limit use of sensitive personal information; submit requests to privacy@duepact.com.

DuePact is a business product for property management organizations and is not directed at individuals under 18. We do not knowingly collect data from children.

We provide at least 30 days' notice for material changes to this policy, by email to account administrators and a notice in the product. Continued use after the effective date constitutes acceptance.

Privacy questions, data requests, and subprocessor inquiries: privacy@duepact.com.