Privacy Policy

1. Who We Are

Dwelt ("Dwelt", "we", "us") provides a property management platform that helps landlords and property managers advertise rental listings, manage properties, tenants, and leases, communicate with tenants and vendors, and handle payments and accounting. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

This policy applies to our websites, applications, tenant and vendor portals, and related services (together, the "Service").

2. Information We Collect

• Account information. When you create an account we collect your name, email address, and authentication details (managed by our authentication provider).
• Property management data. Landlords and property managers using the Service enter information about their properties, units, leases, tenants, applicants, vendors, and finances. This can include contact details, lease terms, payment records, and — where a customer chooses to record them — sensitive details such as government ID numbers or bank account details, which we encrypt at rest.
• Rental inquiries. When you submit an inquiry on a public rental listing, we collect the name, email address, phone number, desired move-in date, and message you provide, and share them with the property manager who posted the listing.
• Rental applications and screening. When you apply for a rental, we collect the application details you provide (such as residence history, employment, income, and household occupants) and, where the property manager orders screening with your consent, receive screening results — such as credit scores and background check results — from a screening provider on the property manager's behalf.
• Documents. Files uploaded to the Service (such as leases, notices, and insurance certificates) are stored, and supported document types may be processed by our AI model providers to extract key terms (see Section 5).
• Payment information. Payments are processed by Stripe. We do not store full card numbers or bank credentials used for payment processing; we receive limited information such as payment status and the last digits of a payment method.
• Communications. Messages sent through the Service — including email, SMS, and conversations with our AI assistant — are stored so we can deliver them and keep a record for your organization.
• Usage and technical data. We collect log data such as IP address, browser type, pages viewed, and actions taken, used for security, rate limiting, and improving the Service.

3. How We Use Personal Information

• To provide, operate, and secure the Service.
• To deliver features you request, including listings, tenant and vendor portals, payments, and communications.
• To power AI-assisted features — including our assistant, Ellie, document data extraction, and automated analysis — which may process data within your organization's account, including documents you upload, to answer questions, extract information, and perform tasks. Depending on the autonomy settings your organization configures, the assistant may also draft and send communications (such as email or SMS) on your organization's behalf.
• To send service-related notifications and, where permitted, product updates.
• To prevent fraud and abuse, enforce our terms, and comply with legal obligations.

We do not sell personal information, and Dwelt does not use the personal information our customers store in the Service to train general-purpose AI models. Personal information processed by our AI model providers is handled under their API terms of service (see Section 5).

Where the GDPR or similar laws apply and Dwelt acts as a controller, we rely on the following lawful bases: performance of a contract (providing the Service you or your organization signed up for), our legitimate interests (securing the Service, preventing fraud and abuse, and improving our features), your consent (for example, for optional marketing communications, which you may withdraw at any time), and compliance with legal obligations.

4. Our Role: Controller and Processor

For account holders and visitors to our own websites, Dwelt acts as a data controller. For information that landlords and property managers enter about their tenants, applicants, owners, and vendors, the customer organization is the controller and Dwelt processes that information on their behalf. When you submit an inquiry or application on a public listing, we collect that information on behalf of the property manager who posted the listing; that organization is the controller of the resulting record and Dwelt processes it on their behalf. If you are a tenant, applicant, or prospective renter with questions about how your information is handled, please contact the property manager first; we will support them in responding to your request.

5. How We Share Information

We share personal information only with service providers who help us run the Service, under contracts that restrict their use of the data. These include providers for hosting and infrastructure, background job and workflow processing, database hosting, authentication, payment processing (Stripe), tenant screening, email delivery, SMS delivery, push notification delivery, file storage, and bot protection (Cloudflare Turnstile runs on our public forms).

AI-assisted features are powered by AI model providers — currently Google, whose Gemini models power our assistant and document extraction — which process the content sent to those features, including assistant conversations and uploaded documents. We also use AI observability and quality-monitoring providers, which receive AI-assistant conversation logs (including any personal information they contain) so we can debug and improve assistant behavior. We may also disclose information where required by law or to protect the rights, safety, or property of Dwelt, our customers, or others.

6. Data Retention

We retain personal information for as long as needed to provide the Service to you or your organization, and afterwards as necessary to comply with legal obligations, resolve disputes, and enforce agreements. Customers control the records they keep within their organization and may delete them through the Service; deleted records may persist in backups and internal systems for a limited period before permanent removal. When an organization is deleted, its data is permanently purged after a 30-day recovery window.

7. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest for particularly sensitive fields (such as government ID numbers and bank details), hashed credentials and tokens, role-based access controls, and rate limiting. No system is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on where you live (including under the GDPR and CCPA), you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. To exercise these rights, contact us at the address below. If your information was entered by a property manager using the Service, we may refer your request to them as the controller of that data.

Where we rely on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal. You can opt out of marketing emails using the unsubscribe link in any marketing message, and opt out of promotional SMS by replying STOP. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the ICO).

9. California Residents

If you are a California resident, the CCPA/CPRA gives you the rights described in Section 8, including the right to know the categories of personal information we collect (described in Section 2, which include identifiers, financial information, commercial information, and internet activity), the right to delete, and the right to correct. We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. We use sensitive personal information (such as government ID numbers and financial account details recorded by our customers) only to provide the Service. To submit a request, contact us as described in Section 14. We will verify your request by confirming your control of the email address associated with the relevant records, and you may use an authorized agent by providing signed permission.

10. Cookies

We use cookies and similar technologies that are necessary to sign you in, keep your session secure, and remember your preferences. We do not use third-party advertising cookies.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information directly from them. Rental applications may include limited information about minor household members (such as name and date of birth) provided by an adult applicant or recorded by a property manager; we process that information on the property manager's behalf.

12. International Transfers

We are based in the United States and process information there and in other countries where our service providers operate. Where we transfer personal data from the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses. You may contact us as described in Section 14 for more information about these safeguards.

13. Changes to This Policy

We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date. For material changes, we will provide additional notice through the Service or by email.

14. Contact Us

For privacy questions or to exercise your rights, contact us at privacy@dwelt.ai.