Privacy Policy

1. Introduction

This Privacy Policy describes how LLAVE ("Llave", the "Platform", "we", "our" or "us") collects, uses, stores, shares, and protects information in connection with the Llave property management and rent payment platform, including the websites llavepr.com and app.llavepr.com and any related applications. It is the "separate Privacy Policy" referenced in the LLAVE Master Terms of Service and is incorporated into those Terms by reference.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Capitalized terms not defined here have the meanings given in the Master Terms of Service ("Terms").

2. Who This Policy Covers

This Policy applies to every person who uses the Platform, regardless of role:

Landlords who register properties, invite tenants, and receive rent payments.

Property Managers who administer properties on behalf of landlords.

Tenants who maintain a profile, communicate with their landlord or property manager, and pay rent through the Platform.

Visitors who browse our public websites without an account.

3. Information We Collect

3.1 Information You Provide

• Account information: name, email address, password (stored only in cryptographically hashed form by our authentication provider), and account role.
• Landlord and property manager business information: legal name, business name, phone number, mailing address, and — solely for payment onboarding and identity verification — taxpayer identification details such as an EIN or the last four digits of a Social Security Number. Llave never collects or stores full Social Security Numbers.
• Tenant profile information: name, email address, phone number, and any employment, income, reference, or verification details a tenant chooses to add to their own profile.
• Property and lease information: property addresses, unit details, rent amounts, lease dates, security deposit amounts, and lease configuration.
• Payment records: rent amounts, due dates, payment status, and transaction references.
• Documents and content: leases, identification documents, credit check reports, pay stubs, employment certifications, inspection reports, property photos, and maintenance photos that users upload.
• Communications: messages sent between landlords, property managers, and tenants through the Platform, maintenance requests, and correspondence with our support team.

3.2 Payment and Financial Information

Payments on the Platform are processed by Stripe, our payment processor. When you connect a bank account or payment method, your bank account number, routing number, and card details are transmitted directly to and stored by Stripe — Llave stores only tokenized references (such as a Stripe account or payment method identifier), payment amounts, dates, and statuses. Identity verification for payout accounts (Stripe Connect onboarding) is performed by Stripe inside an embedded Stripe component; the underlying verification documents are held by Stripe, not by Llave.

3.3 Information Collected Automatically

• Log and device data: IP address, browser type, operating system, pages visited, and timestamps, collected by our hosting and infrastructure providers for security and operations.
• Session data: authentication cookies that keep you signed in (see Section 8).
• Security telemetry: our sign-up and sign-in forms use Cloudflare Turnstile to distinguish humans from bots; Turnstile evaluates limited browser signals to do so.
• Preferences: your language selection (English/Spanish), stored locally on your device.

3.4 Information From Third Parties

We receive payment outcomes, account verification status, and capability information from Stripe. If credit reporting or screening features are offered in the future, we would receive information from the relevant credit bureaus or screening providers only with the disclosure and consent required by applicable law, including the Fair Credit Reporting Act where it applies.

4. How We Use Information

We use the information described above to:

• Operate the Platform: create and manage accounts, link tenants to leases and properties, and display the dashboards, histories, and documents each role is entitled to see;
• Process payments: initiate and track rent payments and payouts through Stripe, including electronic debit and credit instructions authorized under the Terms;
• Send transactional communications: invitations, payment confirmations and receipts, maintenance updates, account notifications, and security alerts (sent through our email provider, Resend);
• Protect the Platform: authenticate users, enforce role-based access, prevent fraud and abuse, and comply with anti-money-laundering, OFAC, and other compliance obligations described in the Terms;
• Provide support: respond to questions, troubleshoot issues, and investigate reports;
• Improve the Platform: understand usage in aggregate and develop new features; and
• Meet legal obligations: maintain records and respond to lawful requests as described in Section 6.

We do not use your personal information for third-party advertising, and we do not sell personal data to third parties for their own marketing purposes.

5. Legal Roles: Controller and Processor

Consistent with Section 18.2.1 of the Terms, the parties play different roles depending on who supplies the data:

Tenant data uploaded by a Landlord or Property Manager. The Landlord or Property Manager acts as the "Data Controller" (or "Business") and Llave acts as the "Data Processor" (or "Service Provider"). The Landlord or Property Manager is responsible for having a valid legal basis and any required consents to upload and process that data.

Profiles and data created directly by a Tenant. Llave has a direct service relationship with the Tenant. Tenant-created profile data, payment history, and independently uploaded documents are the Tenant's own User Content and remain under the Tenant's control, independent of any landlord account (see Section 7).

6. How We Share Information

6.1 With Other Users of the Platform

The Platform exists to connect landlords, property managers, and tenants, so certain sharing between them is inherent: a landlord and their property manager can see the tenants, leases, payment statuses, maintenance requests, and documents for the properties they own or manage; a tenant can see their own lease, payment history, documents shared with them, and communications. Role-based access controls restrict every user to the records connected to their own properties or tenancy.

6.2 With Service Providers

We share information with third-party providers only as necessary to operate the Platform, subject to appropriate data processing terms. Our current providers include:

• Stripe — payment processing, payout accounts, and identity verification for payment onboarding;
• Supabase — database, authentication, and encrypted file storage;
• Vercel — application hosting and content delivery;
• Resend — transactional email delivery; and
• Cloudflare — DNS, network security, and the Turnstile anti-bot service.

6.3 Legal and Safety Disclosures

We may disclose information when we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request; to enforce the Terms; to detect or prevent fraud or security issues; or to protect the rights, property, or safety of Llave, our users, or the public.

6.4 Business Transfers

If Llave is involved in a merger, acquisition, financing, or sale of all or part of its business, information may be transferred as part of that transaction, subject to this Policy or a successor policy with equivalent protections.

6.5 What We Do Not Do

We do not sell personal data, and we do not share personal data with advertising networks or data brokers.

7. Data Retention

We retain information for as long as an account is active and as needed to provide the Platform. In line with Sections 9.4 and 9.4.1 of the Terms:

• After a Landlord or Property Manager account is cancelled or terminated, the data and documents associated with that account are retained for sixty (60) days so the user can export them, after which they may be permanently deleted or anonymized;
• Tenant profiles are independent: a tenant's own profile, payment history, and independently uploaded documents are not deleted because a landlord cancels — only at the tenant's own request or as required by law; and
• Transaction and compliance records may be retained for longer periods where required by tax, accounting, anti-money-laundering, or other legal obligations.

8. Cookies and Similar Technologies

The Platform uses a small set of operational technologies: authentication cookies that maintain your signed-in session, local storage for preferences such as your language selection, and Cloudflare Turnstile on authentication forms for bot protection. We do not use third-party advertising cookies or cross-site tracking. You can manage cookies through your browser settings, but disabling authentication cookies will prevent you from signing in.

9. Security

We implement commercially reasonable safeguards designed to protect your information, including: encryption of data in transit (TLS); database row-level security that restricts every query to the records the signed-in user is entitled to see; private, non-public file storage where documents are served only through short-lived signed links after an access check; tokenized payment data held by Stripe rather than Llave; server-side-only handling of administrative credentials; and CAPTCHA protection on authentication endpoints.

As stated in Section 18.1 of the Terms, no technological system is completely secure. Users must keep their credentials confidential and notify us immediately at info@llavepr.com of any suspected unauthorized access. Users are also strictly prohibited from placing unencrypted highly sensitive data (such as full Social Security Numbers or unmasked card numbers) in open-text fields, chat, or general file uploads (Terms Section 13.4).

10. Your Rights and Choices

Subject to applicable law, you may:

• Access and update your profile and account information through the Platform settings;
• Request a copy or export of your data;
• Request correction of inaccurate information;
• Request deletion of your account and personal data ("right to be forgotten"), subject to the retention obligations in Section 7;
• As a tenant, keep and port your own profile, payment history, and documents independently of any landlord account; and
• Opt out of non-essential communications. Transactional messages (such as payment receipts and security notices) are part of operating the Platform and cannot be disabled while your account is active.

To exercise any of these rights, contact us at info@llavepr.com or use the account settings interface. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.

11. Children's Privacy

The Platform is intended for users who are at least eighteen (18) years of age or the age of majority in their jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at info@llavepr.com and we will delete it.

12. Where Information Is Processed

Llave operates from the Commonwealth of Puerto Rico, and information is stored and processed on cloud infrastructure located in the United States. By using the Platform you understand that your information will be processed in the United States under applicable U.S. federal law and the laws of the Commonwealth of Puerto Rico.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that affect your rights, we will provide at least thirty (30) days' advance notice by email to the address on file or through a prominent in-Platform notification, consistent with Section 26 of the Terms. Non-material changes (such as typographical corrections or clarifications) may be reflected by updating the "Last Updated" date. Continued use of the Platform after the effective date of an update constitutes acceptance of the revised Policy.

14. Language

This Privacy Policy is provided primarily in English. In the event of any conflict, ambiguity, or inconsistency between the English version and any Spanish translation, the English version governs and controls, consistent with Section 27 of the Terms. Users who require assistance understanding this Policy in Spanish may contact us at info@llavepr.com.

15. Contact Us

For questions, requests, or complaints about this Privacy Policy or our data practices, please contact:

Email: info@llavepr.com

Website: www.llavepr.com

Mailing Address: San Juan, Puerto Rico