Privacy policy
Owner onboarding privacy policy
How B Squared Property Management handles information submitted through the owner onboarding path and the owner inquiry form.
1. Purpose
We collect owner-onboarding data only to identify the owner and property, review readiness (lease, COI, checklist), keep an auditable record of consent and staff access, and contact the owner about their pack. We do not sell this data or use it for unrelated marketing in V1.
2. What we collect in V1
- Owner identity and contact (name, email, phone)
- Property address and onboarding checklist answers
- Versioned privacy consent
- Allowed documents only: current lease and certificate of insurance (
lease,coi) - Pack status on the ladder: draft → submitted → reviewed → accepted → governing
- Access logs (who read or changed a pack)
Object bytes are stored in R2 with Cloudflare server-side encryption once enabled. Until then, uploads fail closed.
3. What we do not collect in V1
- W-9 / tax ID documents
- Bank credentials or bank documents
- Government IDs (passport, driver’s license, or similar)
4. Who can access data (by role)
| Role | Access |
|---|---|
| owner | Their own pack only — create, read, update while draft, submit, upload/download allowlisted docs, request deletion. |
| staff_reviewer | Assigned packs only (pack_assignments). Not all packs. Opens logged as staff_access. |
| admin | Full desk operations. Acting on another owner’s pack logs impersonation. |
| Unauthenticated | No production pack access. |
Staff MFA (Cloudflare Access preferred) and owner auth (magic-link OTP) must be live before real packs are stored in production MODE.
5. Retention
Default retention is 2555 days (~7 years) from creation — stub pending counsel. Soft-delete hides a pack from normal reads. Hard delete (R2 removal, payload scrub) is not live; the retention job runs dry_run only until counsel and Guardian approve.
6. Correction and deletion
Correction: While draft, update via the authenticated API. After submit, email the privacy contact describing the field to correct.
Deletion: Submit a deletion request; the pack is soft-deleted. Hard delete remains a future job.
7. Consent
Before submit, the owner must accept this policy version. The Service stores a consent event with privacy_policy_version matching Worker var PRIVACY_POLICY_VERSION.
8. Contact
Privacy requests: desk@bsquaredprop.com (or the published privacy contact after counsel review).
9. Owner inquiry form
When you contact us through the owner inquiry form on our website, we collect your name, email, the borough and neighborhood (building or neighborhood) of your unit, the number of units, whether a tenant is in place, and any message you write. Please don't send tenants' personal details.
We use it only to reply to your inquiry. We don't sell it.
Our service providers process it for us: Cloudflare (website hosting, storage, and the Turnstile spam check, which may process technical data such as your IP address and browser signals) and Google Workspace (our desk@bsquaredprop.com email).
To see, correct or delete your information, email desk@bsquaredprop.com.
10. Emergencies
This website and the desk are not for emergencies. If there is a fire, gas smell, or you are in danger, call 911 first, then alert your building. Then text or email the desk.