Privacy Policy

1. Information We Collect

Account Information

When you sign in through Google or Microsoft, we receive your name and email address from the authentication provider. We also store your account role and organization membership.

Property Listing Data

Information you enter about rental properties, including address, apartment number, city, state, postal code, monthly rent, security deposit, bedroom and bathroom count, square footage, amenities (pets allowed, dishwasher, laundry, doorman), available date, application links, deadlines, and scheduling times.

Inquirer & Prospect Data

Information about prospective tenants, including first and last name, phone number, email address, annual income, employer, employment status, desired move-in date, number of occupants, pet details (name, size, type), concession requests, and guarantor information (name, relationship, income).

Communication Data

Email templates you create (subject lines, message bodies, sender/recipient addresses, CC/BCC recipients), and email thread identifiers used to maintain conversation continuity. When an inbound email is processed as a rental inquiry or maintenance request, we store the extracted content of that message — the inquiry text and structured fields parsed from it (such as the sender's name, contact details, move-in date, and the property it concerns) — so the conversation can be tracked and answered inside Lintel. Your mailbox itself remains in your Gmail or Outlook account; full conversation threads are fetched from your provider on demand when you view them.

Workflow & Automation Data

Workflow configurations you create, including block definitions, node settings, and connection rules used to automate your communication processes.

Uploaded Application Documents

Documents you or your applicants upload through the household drop zone — PDFs, JPGs, PNGs, or WebPs containing pay stubs, bank statements, employment letters, government-issued IDs, tenant-screening (Weimark) reports, lease applications, or similar rental-application material. The original files are stored only briefly while we run AI extraction (see §7); the structured fields extracted from them — such as credit score, annual income, employer, prior address — are retained on the applicant's record.

2. Google Account Permissions

When you connect a Google account, we request the following OAuth scopes:

• gmail.modify — Read, send, and label email in your Gmail account. Used to display incoming inquiries and conversation threads within Lintel; to send replies and outreach emails to prospective tenants from your Gmail address; to apply Lintel labels (Follow up, Important, Resolved) so you can triage from Gmail; and, when you import or simulate an inquiry from within Lintel, to insert that message into your own mailbox so it threads like any other conversation. Lintel never permanently deletes or moves your mail.
• calendar.readonly — Read your calendars and calendar events. Used to identify your primary calendar and display your availability for property showings and scheduling.
• calendar.events — Create, update, and delete calendar events. Used by the Calendar view to schedule property showings, send invites to prospective tenants, and keep listing availability in sync with your calendar.

We store encrypted OAuth access and refresh tokens to maintain your connection. You can revoke these permissions at any time through your Google Account settings.

Limited Use disclosure. Lintel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we only use Google user data to provide and improve the user-facing features described in this policy; we do not use it for advertising; we do not sell it; we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or as part of aggregated and anonymized internal operations; and we do not use or transfer Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

3. Microsoft Account Permissions

When you connect a Microsoft account, we request the following permissions via Microsoft Graph API:

• User.Read — Read your basic profile (name and email address). Used to identify your connected mailbox.
• Mail.Read — Read your Outlook messages. Used to display incoming inquiries and conversation threads within Lintel.
• Mail.Send — Send emails on your behalf. Used to send replies and outreach emails to prospective tenants from your Outlook address.
• Mail.ReadWrite — Create and update draft emails in your mailbox. Used to send replies as proper threaded responses within the existing email conversation (Outlook requires draft access to preserve threading). We do not modify or delete your existing emails.
• Calendars.ReadWrite — Read and write your calendar events. Used to display your availability for property showings and to create, update, and cancel showing events on your Outlook calendar, including invites to attendees.
• offline_access — Maintain your connection without requiring you to sign in each time you use Lintel.

You can revoke these permissions at any time through your Microsoft Account privacy settings.

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the Lintel platform
• Send and read emails through your connected Gmail or Outlook account
• Display your calendar availability and schedule showings on your calendar
• Manage property listings and track prospective tenant communications
• Run workflow automations you have configured
• Classify incoming inquiries and draft suggested replies with AI assistance (see §7)
• Provide address autocomplete when entering property addresses (via Google Maps/Places API)
• Communicate with you about your account and service updates

5. Data Storage & Security

• All account data is stored in a PostgreSQL database hosted by Supabase with enterprise-grade security controls.
• OAuth access and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption.
• Access tokens are temporarily cached in Redis (up to 55 minutes) for performance and are automatically cleared on expiration.
• All data in transit is protected by HTTPS/TLS encryption.
• Your mailbox is not copied into Lintel. We store the extracted content and parsed fields of messages processed as inquiries or maintenance requests (see §1); full threads are fetched directly from Gmail or Outlook APIs when you view them.

6. Third-Party Services

We use the following third-party services to operate Lintel:

• Supabase — user authentication and PostgreSQL database hosting
• Google APIs — Gmail (email read/send/label), Google Calendar (event read/write), and Google Maps/Places (address autocomplete)
• Microsoft Graph API — Outlook email (read/send/drafts) and calendar (event read/write)
• Vercel — frontend application hosting
• Railway — backend API server and Redis hosting

Each third-party service has its own privacy policy. We encourage you to review them.

7. AI-Powered Features & Data Sub-Processors

Email processing. Lintel's core features are AI-assisted: when an inbound email is processed as an inquiry or maintenance request, its content is sent to one or more of the AI providers listed below to classify the message, extract the structured fields described in §1, and draft suggested replies that you review before anything is sent. This processing happens solely to provide those user-facing features. Under our API agreements with each provider, this data is not used to train their models, and we do not use Google user data to develop, improve, or train generalized AI or machine-learning models.

Document processing. When you or your applicants upload a document through the household drop zone, the file's contents are sent to one or more third-party AI providers (our “sub-processors”) for structured extraction — for example, identifying the document category and pulling credit score, income, employer, and similar rental-application fields. Each provider has a Data Processing Addendum (DPA) or equivalent that governs their handling of personal data and is automatically incorporated into our agreement with them:

• Anthropic (Claude) — No standalone DPA PDF for commercial customers; the DPA, including Standard Contractual Clauses (SCCs), is automatically incorporated into Anthropic's Commercial Terms of Service. View / sign instructions: privacy.claude.com.
• OpenAI — Data Processing Addendum: openai.com/policies/data-processing-addendum. Incorporated into the OpenAI Business Terms / Enterprise Agreement; the DPA controls where it conflicts with the Agreement. DPA execution: openai.com/enterprise-privacy.
• Microsoft Azure (Azure OpenAI Service) — Microsoft Products and Services DPA: aka.ms/DPA. An addendum to the Microsoft Product Terms, automatically included when you subscribe to an Azure product. Azure OpenAI Service is covered.

What we send. The raw file bytes and a short instruction prompt. The sub-processor returns structured fields (credit score, income, etc.) which we persist on the applicant's record.

Source-document retention. Original uploaded files are deleted from our storage shortly after the AI extraction completes successfully. Failed extractions retain the file temporarily to allow automatic retry.

No training on your data. Under our enterprise / API agreements with each provider, your uploaded documents and the data extracted from them are not used to train any foundation model.

Protected-class exclusion. Our extraction prompts explicitly instruct the AI to skip protected-class indicators (national origin, citizenship, immigration status, religion, familial status, disability, source of income, etc.) so they are not extracted into the applicant's record, even if mentioned in the source document.

Output review. AI-extracted data may contain errors. Real-estate agents using Lintel are responsible for verifying any AI-extracted field before relying on it for a leasing decision; Lintel itself does not make leasing decisions.

8. Data Retention & Deletion

• Your data is retained for as long as your account is active.
• When your account is deleted, all associated data is permanently removed, including property listings, inquirer records, workflows, email templates, and OAuth tokens.
• If you revoke OAuth access through Google or Microsoft, your stored tokens are automatically invalidated and deleted.
• Extracted inquiry and maintenance-request content (see §1) is retained with the conversation record it belongs to and is deleted with it. Thread identifiers are kept for conversation threading; your wider mailbox is never copied into our systems.
• Original uploaded application documents (PDFs, images) are deleted from storage shortly after AI extraction completes. The structured fields extracted from them remain on the applicant's record until the record is deleted.
• To request deletion of your account and all associated data, contact us at the email address listed below.

9. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and all associated data
• Disconnect your Google or Microsoft account at any time, either within Lintel or through your provider's account settings
• Request a copy of your data in a portable format
• Withdraw consent for data processing at any time

To exercise any of these rights, contact us at the email address below.

10. Children's Privacy

Lintel is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date at the top of this page. Continued use of Lintel after changes are posted constitutes acceptance of the revised policy.

12. Contact

For questions about this Privacy Policy, your data, or to exercise your rights, contact us at nate@usedealdesk.com.