Privacy Policy

Godroox LLC ("Godroox", "we", "us", or "our") operates GodManager, a software-as-a-service property management platform available at godmanager.us (the "Service"). This Privacy Policy explains how we collect, use, share, and protect personal information when you use the Service.

Company details:
Godroox LLC, a Florida limited liability company
Registered address: 7480 Stone Creek Trail, Kissimmee, FL 34747, USA
Contact for privacy matters: contact@godmanager.us

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Who This Policy Applies To

GodManager is a business-to-business (B2B) platform for property management companies in the United States. The people whose information we process include:

• Client organizations — property management companies that subscribe to the Service.
• Client staff users — individuals at a client organization who hold accounts (administrators, managers, accountants, leasing agents, maintenance staff, and similar roles).
• Property owners — individuals or entities whose properties are managed through the Service, who may access an owner portal.
• Tenants — individuals who rent managed properties, whose information is entered by the client organization and who may access a tenant portal.
• Vendors — service providers (such as maintenance contractors) whose information is entered by the client organization and who may access a vendor portal.
• Prospective customers — visitors who submit contact, demo, or pricing requests through our marketing website.

In most cases, a client organization (the property manager) is the controller of the personal data of its owners, tenants, and vendors, and Godroox acts as a processor on the client's behalf. For account holders and marketing leads, Godroox is the controller.

2. Information We Collect

2.1 Information you or your organization provides

Depending on your role and how the Service is used, we may collect:

• Account and contact information: names, email addresses, phone numbers, company names, business addresses, and role assignments.
• Property information: property addresses, rent and deposit amounts, lease dates, and related notes.
• Tenant information: names, contact details, lease terms, rent and deposit amounts, and, where entered by the client organization, government identifiers such as Social Security Numbers (SSN) or Individual Taxpayer Identification Numbers (ITIN).
• Owner information: names, contact details, and notes.
• Vendor information: company and contact details, addresses, and, where provided, bank account information used for payments.
• Financial and transaction records: rent payments, owner statements, expenses, billing documents, invoices, and related accounting entries.
• Support communications: messages, attachments, and ticket details when you contact support.
• Marketing inquiries: information submitted through demo, contact, or pricing-request forms, such as name, company, email, phone, and business details.

2.2 Information collected automatically

• Authentication and session data: a secure session cookie ("gm_auth") that keeps you logged in, and a language-preference cookie ("NEXT_LOCALE").
• Technical and log data: IP address, browser type (user agent), and timestamps associated with certain actions, used for security, auditing, and fraud prevention.

2.3 Bank account connection (Plaid)

If you choose to connect a bank account through the Service, we use Plaid Inc. to facilitate that connection. Plaid allows you to securely link a financial account so that the Service can verify account ownership and identity.

When you connect an account, Plaid provides us with a secure access token and limited account metadata (such as the institution name, account type, and a masked account number showing only the last digits). We store the access token in encrypted form. We do not receive or store your online banking login credentials — those are handled directly by Plaid.

Your use of Plaid is also governed by Plaid's own privacy policy, available at https://plaid.com/legal

2.4 Information we do not collect

• We do not intentionally collect information from individuals under 18 years of age. The Service is not directed to minors.
• We do not store full credit card or debit card numbers. Card payments for subscriptions are processed by Stripe.
• We do not use Plaid to move money, initiate transfers, or access transaction history. Plaid is used solely to verify and link accounts.

3. How We Use Information

We use personal information to:

• Provide, operate, and maintain the Service.
• Authenticate users and secure accounts.
• Process subscription billing and payments.
• Generate property management records such as owner statements, invoices, and expense reports.
• Verify and link bank accounts when requested.
• Communicate with you about the Service, including transactional emails (for example, owner statements, maintenance notices, and account notifications).
• Respond to support requests and contact or demo inquiries.
• Maintain audit logs and detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell personal information, and we do not use it for third-party advertising.

4. How We Share Information

We share personal information only as needed to operate the Service:

4.1 Within a client organization

Information is accessible to authorized users of the client organization to which it belongs, according to their role and permissions. The Service is multi-tenant: each client organization can access only its own data.

4.2 Service providers (subprocessors)

We use trusted third-party providers to operate the Service. Each receives only the information needed to perform its function:

Each provider processes data under its own terms and privacy commitments.

4.3 Legal and safety

We may disclose information if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Godroox, our users, or the public.

4.4 Business transfers

If Godroox is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy.

5. Data Security

We take the security of personal information seriously and maintain administrative, technical, and organizational safeguards, including:

• Encryption in transit: data exchanged between your browser and our servers is protected using TLS.
• Encryption of sensitive credentials at rest: bank account access tokens are encrypted using AES-256-GCM.
• Password protection: account passwords are stored using industry-standard one-way hashing (bcrypt); we never store passwords in plain text.
• Access controls: role-based permissions and tenant isolation ensure users access only the data they are authorized to see.
• Audit logging: key actions are recorded with the actor, time, and context.
• Rate limiting: login attempts are rate-limited to deter brute-force attacks.

We describe our security practices in more detail in our Information Security Policy. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service. After an account is closed, we retain data for a limited period to allow for recovery and to meet legal, accounting, and audit obligations, after which it is deleted from production systems. Backup copies may persist for a limited additional period before being overwritten. Aggregated or anonymized data that does not identify an individual may be retained for analytics.

Client organizations control much of the data they enter and may request deletion of specific records. Where Godroox acts as a processor, we follow the documented instructions of the client organization regarding retention and deletion.

7. Your Rights and Choices

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent (for example, by disconnecting a linked bank account).

Because much of the data in the Service is controlled by client organizations, requests from owners, tenants, or vendors may be directed to the relevant client organization, or to us at contact@godmanager.us and we will assist or route the request appropriately.

You can control cookies through your browser settings. Disabling essential cookies (such as the authentication cookie) may prevent the Service from functioning.

8. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country. By using the Service, you consent to this transfer and processing.

9. Children's Privacy

The Service is intended for business use by adults and is not directed to individuals under 18. We do not knowingly collect personal information from minors. If we learn that we have collected such information, we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or how we handle personal information, contact us at:

Godroox LLC
7480 Stone Creek Trail, Kissimmee, FL 34747, USA
Email: contact@godmanager.us