What we collect, and what we do with it.

Aspire Property Management LLC, a New York limited liability company operating in Kingston, New York. For anything in this policy, write to hello@aspirepropertymgmt.com, or by post at 15 Railroad Avenue, Kingston, New York.

When you contact us. Your name, company, email address, phone number, and the message you send.

When you register as a tenant. Your name, company, email address, phone number, a password, and the property, unit, and lease start date you are registering against.

When you claim a property as a landlord. Your name, company, email address, phone number, the property address and city, the property type and approximate square footage, and your role in relation to the property.

Once your account is active. Your lease terms and history, invoices, payments, security deposits, any late fees, the documents you or we upload against your lease, and any maintenance requests you submit.

Operational records. A log of transactional emails we sent you, an audit trail of changes made to financial and account records, timestamps recording when a signed-in session was last active, and short-lived counters used to rate-limit our public forms.

Card and bank account numbers are collected by Stripe directly and never reach our servers or our database. What we store is the payment method type, the last four digits, and Stripe’s own identifier for the method — enough to show you “Visa ending 4242” and to charge a method you have authorised, and not enough to make a payment anywhere else.

The same principle applies to our own bank details for printed cheques: the system stores an account nickname, the bank name, and the last four digits. The full routing and account numbers live on pre-printed cheque stock and are not in the database at all.

To operate the tenancy or property relationship you have with us: to verify who you are, to bill and collect rent, to keep the books, to respond to maintenance requests, to send you receipts and notices, and to meet our own record-keeping and tax obligations.

We do not sell personal information, we do not share it for advertising, and we do not use it to build profiles for anyone else.

We use a small number of service providers. Each one only receives what it needs to do its job:

• Supabase — our database, sign-in system, and document storage.
• Vercel — hosting for this site and the portals.
• Stripe — card and bank payments. Stripe holds the payment details themselves, under their own privacy policy.
• Resend — sending transactional email such as receipts, verification links, and password resets.
• Cloudflare — bot protection on our public forms and sign-in page.

Our database is hosted in Supabase’s East US (Northern Virginia) region, and the site is served from Vercel’s United States infrastructure. If you are contacting us from outside the United States, your information will be processed in the United States.

This site sets only the cookies needed to keep you signed in. There is no advertising network, no analytics product, and no third-party tracker on this site — which is why you are not being asked to accept anything.

Cloudflare’s bot check runs on our public forms and sign-in page to tell a person from a script. It is designed not to track you across sites.

Lease and financial records are kept for the life of the tenancy and for at least seven years afterwards, which is the period over which we may need to reconstruct them for tax, accounting, or a dispute. Enquiries that never become a tenancy are kept for up to two years. Audit and email logs are kept for as long as the related account exists.

These are minimums rather than automatic deletion dates — we do not currently purge records the moment a period elapses. If you want something removed sooner, ask us and we will delete whatever we are not required to keep.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Write to hello@aspirepropertymgmt.com and we will respond within 30 days of confirming who you are.

Deletion has a real limit worth stating plainly: where a record is part of a lease, a payment, or our accounting records, we may be required to keep it even after you ask us to delete it. In that case we will tell you what we are keeping and why.

You can update your own name, company, and contact details at any time from your portal settings.

Access to your data is enforced in the database itself, not only in the interface, so a tenant can only read their own lease and a landlord only their own properties. Traffic is encrypted in transit, passwords are hashed by our sign-in provider and never visible to us, and documents are stored privately and served through short-lived links rather than public URLs.

No system is perfect. If we discover a breach affecting your personal information, we will notify you and any regulator we are required to notify.

These services are for commercial tenants and property owners and are not directed at children. We do not knowingly collect information from anyone under 18.

If we change this policy we will update the date at the top of this page. If a change materially affects how we use information we already hold about you, we will tell you directly.

See also our Terms of Service.