Legal
Privacy Policy
Version 2026-10-02 · Effective 2026-10-02
This policy explains what TraxKey AI does with information, both for the operators who subscribe to it and for the tenants, owners and vendors whose information passes through it.
1. Who this policy covers, and our role
TraxKey AI ("TraxKey", "we", "us") is software used by property management and rental businesses ("Operators"). This policy covers two different relationships, and our obligations differ between them.
1.1 Operators, where we are the controller
When an Operator visits our website, signs up, subscribes, or contacts us, we decide how that information is used. For that information we are the controller, and this policy describes our own practices.
1.2 Tenants, owners and vendors, where we are the processor
When an Operator puts information about a tenant, resident, guest, property owner, vendor or contractor into TraxKey, the Operator decides why and how that information is used. The Operator is the controller and we are the processor, acting on their instructions.
If you are a tenant, guest, owner or vendor and you want to access, correct or delete your information, contact the property management business you deal with. They control that record. We will support them in responding, but we cannot act on your data without their instruction, except where the law requires us to.
2. Information we collect
2.1 Information Operators give us
- Account information — company name, your name, email address, phone number, password (stored only as a salted hash, never in readable form), role, and time zone.
- Billing information — subscription plan and status. We do not receive or store your full card number. Card details go directly to Stripe; we hold only a customer identifier and, where Stripe provides it, the card brand and last four digits.
- Support communications — messages you send us.
2.2 Information Operators place into the Service about others
Operators enter and generate operational records, which typically include:
- property and unit details, including addresses;
- tenant, resident and guest names, email addresses, phone numbers, lease terms, rent and deposit amounts, and stay dates;
- property owner names, contact details, and the properties assigned to them;
- vendor and contractor names, contact details, trades, and performance history;
- maintenance requests, inspection records, turn and cleaning records, photographs where supplied, and invoice and purchase-order records; and
- messages exchanged through the Service, including replies received from tenants, guests and vendors.
2.3 Information collected automatically
- Log and security data — IP address, browser and device type, pages requested, and timestamps, used to operate and secure the Service and to detect abuse.
- Local storage — the application stores a session token and your theme preference in your browser's local storage. This is required for you to stay signed in.
2.4 Questions you send on our website
When you send a question to a chat assistant on our public website, or run one of our free tools (the Rental Property Analyzer or the Listing Audit), we store the question you sent, and for the tools the general market you looked at (city, state and a price range or score range). We use this only to understand what visitors need and to improve our website, answers and product. Before storing a question we automatically remove email addresses, phone numbers and street addresses. We do not store what you type before you send it, the listing text or photos you submit to the Listing Audit, or your IP address or a visitor identifier with these records, so they are not linked to you. We keep them for 12 months and then delete them. Customers using these tools inside the application are not included.
We do not run third-party advertising, analytics or cross-site tracking on our website or in the application. We do not sell personal information, and we do not share it for cross-context behavioural advertising.
3. How we use information
- to provide, operate, secure and support the Service;
- to send operational messages on an Operator's behalf, such as maintenance updates, vendor dispatch, renewal offers and payment reminders;
- to produce AI classifications, summaries, priorities and insights within an Operator's own account (see section 5);
- to process subscription payments and prevent fraud;
- to communicate with Operators about their account, including service, security and billing notices;
- to comply with law and to establish, exercise or defend legal claims; and
- to produce aggregated, de-identified statistics that do not identify any Operator, individual or property.
Where the GDPR or UK GDPR applies to our own processing of Operator information, we rely on performance of a contract, our legitimate interests in operating and securing the Service, and compliance with legal obligations.
4. Service providers and sub-processors
We do not sell personal information. We share it only with providers who help us run the Service, each under contract and only for that purpose. Our current sub-processors are:
| Provider | Purpose | What it receives |
|---|---|---|
| Railway | Cloud hosting, application and database | All Customer Data, as the hosting environment |
| Anthropic | AI models behind classification, summaries and insights | Only the specific text needed for a given task, such as a maintenance description or an inbound reply |
| Resend | Email delivery | Recipient email address, sender name, subject and message body |
| Stripe | Subscription payment processing | Operator billing contact and payment details, submitted directly to Stripe |
| AirROI | Short-term rental market comparison data | Property location only, at country, region, locality and district level. No personal information is sent. |
We may also disclose information where required by law or valid legal process, to protect our rights, safety or property, or in connection with a merger, acquisition or sale of assets, in which case we will give notice before your information becomes subject to a different privacy policy.
5. Artificial intelligence processing
The Service uses AI models provided by Anthropic to read and classify inbound messages, summarise maintenance requests, prioritise work, draft messages and produce portfolio insights.
Important points about that processing:
- Your data is not used to train the models. We use Anthropic's commercial API under terms that do not permit customer content to be used for model training.
- We send the model only the text needed for the specific task, not your whole database.
- Processing is scoped to a single Operator's account. One Operator's data is never used to generate another Operator's insights.
- AI output is probabilistic and can be wrong. It assists a human decision-maker and does not replace one. The Service records the reasoning behind automated decisions so an Operator can review them.
- We do not use AI to make decisions producing legal or similarly significant effects about any individual, and Operators are contractually prohibited from using the Service for tenant screening or selection.
6. How long we keep information
We keep Customer Data for as long as the Operator's account is active. After an account is terminated we retain Customer Data for 30 days to allow export, then delete it in the ordinary course.
Some records outlive that period because we are required to keep them or need them to defend a claim: billing and tax records, records of acceptance of our Terms, and security logs. Backups expire on their own rotation cycle rather than on individual deletion.
Operators can delete individual records at any time. Note that the Service is designed to archive rather than delete properties and units, so that lease, maintenance and financial history remains intact and auditable.
7. Security
We protect information with measures including encryption in transit, passwords stored only as salted bcrypt hashes, scoped session tokens with expiry, role-based access control, tenant isolation enforced at the database query level, and separate credentials for each portal.
No system is perfectly secure. We cannot guarantee absolute security, and Operators are responsible for the credentials they issue and for revoking access promptly when someone leaves their business. Report a suspected vulnerability or breach to support@traxkey.ai.
8. Your rights
8.1 California residents
Under the CCPA as amended by the CPRA, California residents may request access to the categories and specific pieces of personal information we hold, request deletion or correction, and request details of disclosures. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of in that respect. We will not discriminate against you for exercising these rights.
8.2 European Economic Area and United Kingdom
Where the GDPR or UK GDPR applies, individuals have rights of access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority.
8.3 How to exercise these rights
If you are an Operator, contact us at support@traxkey.ai. We will verify your identity and respond within the period the applicable law requires.
If you are a tenant, guest, owner or vendor, contact the property management business you deal with, because they control your record. If you contact us directly we will refer you to them and assist them in responding.
9. International transfers
We operate in the United States and our providers may process information there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from that of your country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
10. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has been provided to us, contact support@traxkey.ai and we will work with the responsible Operator to remove it.
11. Changes to this policy
We may update this policy. We will post the updated version here with a new version identifier and effective date. For material changes affecting Operators we will give notice by email at least 30 days before the change takes effect.
12. Contact
Iter8.42 AI Labs, doing business as TraxKey AI
Texas, United States
Privacy: support@traxkey.ai
Security: support@traxkey.ai
See also our Terms of Service.