Privacy Policy

Who we are

The Mindful Landlord LLC ("TML", "we", "us") is a property management company registered in Maryland. We manage residential rental properties on behalf of owners in Maryland and Ohio and provide tenants and owners with our apps for rent payment, maintenance requests, statements, and lease communication: the TML tenant and owner apps for iPhone and Android, and the portals at app.the-mindful-landlord.com and owner.the-mindful-landlord.com. This policy covers all of them. Our apps run on Aether, property-management software; landlords who use Aether to manage their own rentals are covered by Aether's privacy policy at app.aether.rent/privacy.

What we collect

We collect only what we need to run the business.

From tenants

• Name, phone number, email address, and lease terms.
• Payment method details. To pay by bank account, you link it through Stripe Financial Connections; to pay by card, Stripe collects the card. We do not store your bank login, full account number, or full card number — only Stripe's reference to your payment method and the last four digits for display.
• Messages you send us through the app or SMS.
• Photos, videos, and text you submit when reporting a maintenance issue. The app uses your camera only when you choose to take a photo.
• Your words when you use push to talk to report a repair. Your phone's or browser's own speech recognition turns your voice into text; we keep only the text, never a recording. The app uses your microphone only while you hold the button.
• If you sign in with Google or Apple: the name and email address they share with us.
• If we ask you to verify your identity (for example before a lease is signed): your legal name and date of birth, and a photo of your government ID with a selfie, which Stripe Identity collects on its own pages. We keep only the result of the check.
• Device identifiers when you use our mobile app, strictly for push notifications.

From owners and landlords

• Entity name, mailing address, phone, email, EIN last four digits, bank-account last four digits, and ownership records for the properties you entrust to us or manage in Aether.
• If you link a bank account: the account's name, type, institution and last four digits, and its transactions (date, amount, description and status). See Section 5.

From vendors

• Business name, contact, phone, email, service categories, license and insurance metadata.
• If we pay you by bank transfer: the account you link, and the name and address on it, which we use to confirm the account is yours before paying into it. See Section 5.

Automatically

• IP address and basic device information from app sessions, strictly for security and fraud prevention.
• Error reports when something in the app or our servers breaks, so we can fix it.

Why we collect it

• Rent collection and accounting.
• Lease administration (including issuing notices, renewing, and terminating leases in compliance with state law).
• Owner disbursements and reporting.
• Keeping rental books accurate (matching each deposit and payment in a linked bank account to the right lease, loan or bill).
• Confirming who owns a bank account before we pay into it.
• Maintenance dispatch and vendor coordination.
• Fraud prevention, security, and legal compliance.

We do not sell your personal information, and we do not use it for advertising.

How we share

• Stripe to process card and bank payments and, through Stripe Financial Connections, to link bank accounts, read the data you allow, and confirm who owns an account; and, through Stripe Identity, to verify a government ID when we ask for it. Stripe's privacy practices: stripe.com/privacy
• Firebase (Google) for secure phone-OTP login and push notifications.
• Google and Apple when you choose to sign in with them.
• Resend to deliver our emails to you.
• ElevenLabs to read our app's replies aloud. It receives only our words, never your voice.
• Sentry to receive error reports when something breaks.
• Vouch to sign leases electronically.
• Supabase for encrypted data storage.
• Anthropic and OpenAI to power AI features, such as sorting maintenance requests, transcribing voice notes, reading documents and applications you send us, and drafting messages. They process this data only to provide those features to us, under business terms that don't let them train their models on it. We don't send bank-account data (Section 5) to AI services.
• Vendors dispatched to a maintenance job receive only the information they need: unit access, issue description, your contact number, and scheduling.
• Property owners receive a monthly statement showing only their units and only the tenants in those units.
• Law enforcement or regulators if required by a valid subpoena, court order, or state statute.

Bank accounts you link

Landlords can link bank accounts to Aether so we can keep their rental books accurate, and vendors and owners we pay can link the account they want paid. Linking happens through Stripe Financial Connections: you sign in to your bank in Stripe's window, and we never see your bank login.

• What we read. Only what you allow when you link: the account's name, type, institution and last four digits, and its transactions (date, amount, description and status). Before paying a vendor or an owner, we also read the name and address on their account once, to confirm it belongs to the person or business we're paying.
• What we don't do. Linking for bookkeeping is read-only: we can't move money in or out of that account. We don't use this data for credit decisions or advertising, we don't sell it, we don't share it beyond the service providers in Section 4 that store and process it for us, and we don't send it to AI services.
• Where it lives. In the United States, encrypted in transit and at rest (Section 9).
• How to stop. Disconnect an account at any time in Aether's settings, or email privacy@the-mindful-landlord.com. We stop receiving new data from that account right away.

Mobile information & SMS data

Mobile information, including phone numbers and SMS/MMS opt-in data and consent, will not be sold or shared with any third party for promotional or marketing purposes. We share mobile information only with service providers that help us deliver our messaging services — including our SMS gateway provider (Telnyx), payment processor (Stripe), and authentication provider (Firebase/Google) — and only to the extent necessary for those providers to perform services on our behalf.

All of the data-sharing categories described elsewhere in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties for purposes unrelated to providing you with the services of the SMS program you opted into.

You may opt out of SMS/MMS at any time by replying STOP to any message you receive. For help, reply HELP or email help@the-mindful-landlord.com. Message frequency varies based on tenancy or vendor activity. Message and data rates may apply.

Your choices

• You can delete your account inside the app: tenants under Account, owners under Me, then Delete my account. This deletes your login and stops the app's notices; lease, payment, and tax records stay as the law requires.
• You can stop using the app and request deletion of your personal data at any time by emailing privacy@the-mindful-landlord.com, subject to our legal obligation to retain lease and tax records.
• You can opt out of marketing/SMS notices at any time; transactional and legal notices continue for the life of your lease.
• You can request a copy of the data we hold about you.
• You can disconnect a linked bank account at any time (Section 5).

Retention

• Tenants: we retain your data for the duration of your lease plus seven (7) years thereafter, matching IRS and MD/OH landlord recordkeeping requirements.
• Applicants who don't sign a lease: we retain your data for twelve (12) months, then delete.
• Maintenance request media: retained for three (3) years after the request is closed.
• Linked bank accounts: transactions we match to your leases, loans or bills become part of your accounting records and follow the seven-year rule above; everything else from that account, including the connection itself, is deleted within 30 days after you disconnect it.
• Identity checks: we keep the result with your tenant record for the retention period above; your ID photo and selfie stay with Stripe under its own policy.
• Bank-ownership checks: we keep the result of the check with the payee's record; the name and address we read for it are deleted within 30 days.

Security

Our full security posture is documented in our Information Security Policy. In brief:

• TLS 1.2+ for all data in transit.
• AES-256 at rest for all databases and file storage.
• Bank and card details stay with Stripe; we store only Stripe's references and the last four digits.
• Least-privilege role-based access; MFA on all administrative accounts.
• Annual security review and quarterly access review.
• Incident notification within 72 hours per state law.

Children

Our services are not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, email privacy@the-mindful-landlord.com and we will delete it.

Changes

We will post changes to this policy at the-mindful-landlord.com/privacy with a new effective date. Material changes will be communicated via email or SMS.

How to reach us

• Email: privacy@the-mindful-landlord.com
• Security issues: security@the-mindful-landlord.com