Privacy Policy

The information we collect depends on how you interact with us:

• If you inquire — the name, email, phone, and any message you submit through the contact or interest forms.
• If you apply for a unit — additionally your date of birth, current + prior addresses, employer + income, references, and (with your explicit written consent) your Social Security Number so a background/credit check can be run.
• If you become a tenant — signed lease documents, payment method details you set up (see below), rental ledger, maintenance requests you submit (including any photos), building access records, pets/vehicles/emergency contacts you register in the portal, and communications you exchange with us.
• If you use our website or portal — the IP address of your request, a session cookie used to keep you signed in, browser type, pages visited, and errors that occur.

We do not store your bank account number or card number on our servers. Payments are processed by third-party payment processors — currently Stripe (stripe.com/privacy), and, once enabled for you individually, Dwolla (dwolla.com/legal/privacy) with bank verification via Plaid (plaid.com/legal). When you enter card or bank data during setup, it goes directly to those processors. What we store on our side is a token, the last 4 digits of the account or card, the card brand or bank name, and the expiration month/year for cards.

When you link a bank account through Plaid, you are agreeing to Plaid’s end user privacy policy in addition to this one. Plaid gives us a limited access token that lets our payment processor debit the account you selected — it does not give us your online banking credentials.

• To provide the service — evaluate applications, sign leases, bill rent, process payments, respond to maintenance requests, and let you use the tenant portal.
• To communicate with you — send lease documents, receipts, late-rent notices, building announcements, and replies to messages you send us. Transactional messages are not marketing.
• To meet legal obligations — comply with fair-housing rules, landlord-tenant law, tax reporting, and lawful government requests.
• To prevent fraud and abuse — flag suspicious sign-ins, block payment fraud, and investigate abuse reports.
• To operate and improve the property — track maintenance trends, understand which amenities get used, and plan renovations. Aggregated, not individually identifying.

We share your information only in the ways you would expect:

• Service providers we use to run the property — payment processors (Stripe, Dwolla, Plaid), background/credit-check services when you apply (with your written consent), email delivery (Resend), our database and hosting (Supabase, Vercel), and vendors we dispatch for maintenance work at your unit (they see enough to do the job — name, unit, ticket details — and no more).
• Co-owners and staff of the property — beneficial owners of Holtman Holdings, and members of the on-site management team, need to see rent status, lease terms, maintenance history, and communications to run the building.
• Legal or safety requests— courts, law enforcement, or other government agencies when we’re required by law or when we reasonably believe disclosure is necessary to protect a person’s safety or investigate a crime committed on the property.
• A successor if the property is sold — if we sell the building or the business, tenant records may transfer to the new owner so leases can be honored. We will notify you before that happens.

We do not sell your personal information, and we do not share it with advertising networks or data brokers.

• Applications and background-check data — approved applications are kept for the duration of the lease plus seven years for tax and fair-housing compliance. Declined applications are kept for two years and then deleted.
• Signed leases and payment records — seven years after move-out (IRS + Missouri record-retention baseline).
• Maintenance history + building access logs — three years after move-out, then deleted.
• Marketing inquiries that don’t become tenancies — deleted after two years of inactivity.
• Backups — encrypted database backups roll off within 30 days of a deletion request, so a fully-deleted account may still appear in an unrestored backup snapshot for up to a month.

The tenant portal is served over HTTPS. Data is encrypted at rest in our Supabase database. Access control is enforced at the database level (row-level security) so a tenant can only see rows tied to their own leases and staff roles are scoped to what they need. Admin accounts require two-factor authentication. Every field-level change to leases, applications, and payment records is written to an append-only audit log with actor and timestamp.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and any regulators the law requires, and we will tell you what happened, what was affected, and what we’re doing about it.

You can, at any time:

• Accesswhat we have on file — email us and we’ll compile it within 30 days.
• Correct anything wrong — you can edit contact info, pets, vehicles, emergency contacts, and payment methods directly in the portal; for anything else, email us.
• Deleteinformation about you, subject to legal retention (see “How long we keep it”). We’ll delete what we can and explain what we can’t delete and why.
• Withdraw consent for background checks. This means we cannot complete a pending application, but existing tenants remain unaffected.
• Opt out of non-transactional emails like building announcements. You cannot opt out of transactional emails (receipts, lease notices, maintenance status) while a lease is active.

If you are a resident of California, Colorado, Virginia, Connecticut, or another state with a comprehensive privacy law, you have additional rights specific to that law (including data portability and, in some cases, the right to appeal a decision we make on your request). Email us at hello@theholtmankc.com and reference your state — we will confirm receipt within 10 days and respond within 45.

We use a first-party session cookie to keep you signed in and to remember your light/dark theme choice. We do not use third-party advertising cookies, retargeting pixels, or cross-site trackers. We use anonymized server-side analytics (Vercel Web Analytics) to understand which pages people visit — this data is not tied to your tenant record.

The tenant portal and marketing site are intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information to us, email us and we will delete it.

If we make a material change (for example, a new category of data, a new processor, or a new use), we will update the effective date at the top of this page and notify signed-in tenants via a portal banner at least 14 days before the change takes effect. Continued use of the portal after that date means you accept the updated policy.

Questions, requests, or complaints about privacy:
hello@theholtmankc.com
Holtman Holdings · Kansas City, Missouri

If you feel we haven’t adequately addressed a privacy concern, you can also file a complaint with the Missouri Attorney General’s office or, if you’re a resident, with your state’s attorney general.