Privacy Policy

PRIVACY POLICY M.S.J. & K. Inc. Effective Date: September 22, 2026 This Privacy Policy describes how M.S.J. & K. Inc. ("Company," "we," "us") collects, uses, discloses, and otherwise processes information in connection with the Services. This Policy is incorporated into, and should be read together with, the Terms of Service. Capitalized terms not defined here have the meaning given in the Terms of Service. 1. Scope 1.1 General. This Policy applies to information collected through the Services, including information submitted by Customer, Authorized Users, and any individual whose information is submitted to the Services by Customer (including without limitation tenants, applicants, owners, occupants, and vendors), without limitation. 2. Information We Collect 2.1 Broad Categories. We collect all information, data, content, files, documents, records, communications, metadata, submissions, and other materials of any kind that are submitted to, generated by, or processed through the Services, including without limitation, and by way of non-exclusive example only: account and registration information; tenant, lease, and property information; financial, accounting, and bank-feed information obtained through third-party financial data providers; payment and billing information; communications sent through or in connection with the Services; documents and files uploaded to the Services; usage, device, log, and analytics information; AI Feature inputs and outputs; and any other information provided to us or collected automatically in connection with the Services. This enumeration is illustrative only and does not limit the scope of information covered by this Policy. 2.2 Tenant Screening Information. Where an account holder obtains or stores tenant screening material — including a consumer report, credit report, credit score, criminal or eviction history, registry result, rental history, reference, or employment or income verification (collectively, "Screening Information") — we receive, store, transmit, and display that material solely as a service provider on that account holder's instructions. WE ARE NOT A CONSUMER REPORTING AGENCY, we do not assemble or evaluate consumer information to furnish consumer reports, we do not generate, verify, correct, or adopt any Screening Information, and we do not make or influence any tenant selection decision. Sections 28.1 through 28.4 of the Terms of Service and Section 5 of the Important Disclaimers govern. 2.3 Rent Reporting Information. Where an individual opts in to rent reporting, we collect and process the identifying and payment information necessary to furnish that individual's rent payment history to one or more consumer reporting agencies. That information may include full legal name, date of birth, current and prior addresses, lease and tenancy details, amounts due, amounts and dates paid, account status, and, WHERE THE RECEIVING AGENCY REQUIRES IT FOR IDENTITY MATCHING, A SOCIAL SECURITY NUMBER OR INDIVIDUAL TAXPAYER IDENTIFICATION NUMBER. A government identifier collected for this purpose is used only to match the record to the correct consumer file, to furnish and correct the information reported, and to meet our obligations as a furnisher; it is not used for marketing, is not used to infer characteristics about any person, and is retained in accordance with the Retention Policy. Rent reporting is optional and opt-in, and Section 30 of the Terms of Service governs it. 2.4 Identity Verification Information. Where an identity, document, address, income, employment, or business verification is offered and used, we or a third-party verification provider may collect identity documents, images, and the data extracted from them, together with the result of the check. We do not independently authenticate any identity document, and a verification result is not a consumer report and not a determination about any individual. Section 34 of the Terms of Service governs. 2.5 Payment Information. We collect and process information relating to payments requested, scheduled, recorded, or reconciled through the Services, including payer name and contact details, amounts, dates, descriptions, payment method type and last digits, authorization records, processor and transaction identifiers, status, fees, and return, dispute, and chargeback records. FULL PAYMENT CARD NUMBERS AND FULL BANK ACCOUNT CREDENTIALS ARE COLLECTED AND HELD BY THE PAYMENT PROCESSOR, NOT BY US, and we do not take custody of any funds. Section 29 of the Terms of Service governs. 2.6 Telephone Numbers and Messaging Information. We collect telephone numbers provided to us and, where messaging functionality is offered and used, records of the messages sent, their delivery status, consent and opt-in records, and opt-out and revocation records. Consent and opt-out records are retained for so long as necessary to honor a revocation and to evidence compliance. Section 35 of the Terms of Service and Section 18 of the Important Disclaimers govern. 2.7 Maintenance and Vendor Information. Where maintenance functionality is offered and used, we process maintenance and work-order records, including descriptions, photographs and other media submitted with a request, access and entry instructions, scheduling information, vendor contact and assignment details, and cost and invoice records. 2.8 Promotional Material. Where an account holder submits or designates a review, testimonial, quotation, recording, photograph, logo, or similar material for a public or promotional purpose, we process that material as described in Sections 2.5 through 2.8 of the User Content Terms. Material of that kind is processed for promotional purposes only where those Sections permit it, and never as an inferred permission arising from an account holder's ordinary use of the Services. 3. How We Use Information 3.0 Training and Testing AI Features. We use ONLY de-identified and aggregated information to train, tune, or test AI Features, in accordance with Sections 9.3 and 9.4 of the Terms of Service. WE DO NOT USE IDENTIFIABLE CUSTOMER DATA FOR THAT PURPOSE, and nothing in Section 3.1 authorizes it. Where the general purposes below refer to improving or developing the Services, that authority is limited accordingly. 3.1 Purposes. We use information for any purpose reasonably related to operating, providing, securing, supporting, maintaining, and improving the Services, including without limitation to: provide and maintain the Services; process transactions; communicate with Customer and Authorized Users; provide customer support; detect, prevent, and address fraud, security, and technical issues; develop new features and services; comply with legal obligations; enforce our agreements; and for any other business purpose, without limitation to the foregoing examples. 3.2 Purpose Limits on Specific Categories. Notwithstanding the breadth of Section 3.1, the categories described in Sections 2.2 through 2.7 are used only for the purposes for which they were collected and for the compatible operational purposes of securing the Services, preventing and investigating fraud and abuse, meeting our legal and recordkeeping obligations, and establishing, exercising, or defending legal claims. SCREENING INFORMATION IS NOT USED BY US FOR ANY PURPOSE OTHER THAN STORING, TRANSMITTING, AND DISPLAYING IT AT THE ACCOUNT HOLDER'S DIRECTION. A GOVERNMENT IDENTIFIER COLLECTED FOR RENT REPORTING OR IDENTITY VERIFICATION IS USED ONLY FOR THAT PURPOSE. WE DO NOT USE ANY OF THESE CATEGORIES FOR MARKETING, FOR TARGETED ADVERTISING, OR TO INFER CHARACTERISTICS ABOUT ANY INDIVIDUAL, and Section 3.0 continues to prohibit the use of identifiable Customer Data to train, tune, or test any model. 4. How We Share Information 4.1 Service Providers and Subprocessors. We may share information with service providers, subprocessors, hosting providers, and vendors that perform functions on our behalf, including without limitation cloud hosting, payment processing, bank-feed aggregation, communications, analytics, and AI infrastructure providers. The providers currently engaged are listed in the Third-Party Provider and Subprocessor Disclosure, which forms part of these Legal Documents. 4.2 Legal and Safety. We may disclose information where we believe in good faith that disclosure is necessary to comply with applicable law, legal process, or governmental request, to enforce our agreements, to protect the rights, property, or safety of Company, our customers, or others, or in connection with an investigation of suspected or actual fraudulent or illegal activity. 4.3 Business Transfers. We may disclose or transfer information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. 4.4 Affiliates. We may share information with our affiliates for purposes consistent with this Policy. 4.5 Screening, Verification, and Consumer Reporting Providers. Where an account holder or an individual requests or authorizes a tenant screening, background, credit, identity, income, or employment check, information necessary to perform it is disclosed to the third-party provider that performs it, under that provider's own terms and privacy notice. Where an individual opts in to rent reporting, the information described in Section 2.3 is disclosed to the rent-reporting service provider and to the consumer reporting agency or agencies that receive it. We do not disclose Screening Information to any consumer reporting agency, and we do not furnish any information about any individual who has not opted in to rent reporting. 4.6 Payment Processors and Financial Institutions. Payment information is disclosed to the payment processor engaged for an account holder's merchant account, and through that processor to card networks, the automated clearing house system, and the originating and receiving financial institutions, as necessary to initiate, settle, return, reverse, or dispute a payment and to meet the applicable network rules. We do not act as the merchant of record and do not take custody of funds. 4.7 Insurance, Maintenance, and Vendor Recipients. Where an insurance product is applied for through or alongside the Services, the information the applicant submits is disclosed to the insurer, agency, or producer that offers it, under that party's own terms. Where a maintenance request is routed or assigned, the information necessary to perform the work — which may include the property address, access instructions, a description of the issue, submitted photographs, and contact details for the occupant — is disclosed to the vendor selected by the account holder. WE DO NOT SELECT, SUPERVISE, OR VET ANY VENDOR, and Section 32 of the Terms of Service governs. 4.8 Communications and Messaging Providers. Email, text-message, and other communications are transmitted through third-party delivery providers and, in the case of text messages, through wireless carriers, which handle the message and its metadata under their own practices and may filter, block, or fail to deliver it. 4.9 Promotional Use Is Not a Disclosure of Account Data. Publication of Promotional Material under Sections 2.5 through 2.8 of the User Content Terms is limited to the material an account holder submits or designates for that purpose. IT NEVER EXTENDS TO CUSTOMER DATA HELD IN AN ACCOUNT, TO SCREENING INFORMATION, TO PAYMENT OR BANK FEED DATA, TO A GOVERNMENT IDENTIFIER OR FINANCIAL ACCOUNT NUMBER, OR TO THE PERSONAL INFORMATION OF A TENANT, APPLICANT, OCCUPANT, GUARANTOR, OWNER, OR VENDOR, except where that individual is the source of the material and has given the release required by Section 3.2 of the User Content Terms. Where those Sections and this Policy conflict as to personal information, this Policy and the Data Processing Addendum control. 5. AI Features 5.1 General. Information submitted to or generated by AI Features may be processed by third-party AI infrastructure providers in order to generate output. AI Feature output should be independently verified and is subject to the disclaimers set forth in Section 10 of the Terms of Service. 6. Bank Feed Data 6.1 General. Where Customer elects to connect a financial institution account, financial data is obtained through third-party account-aggregation providers subject to the Bank Feed Terms, incorporated herein by reference. We do not control such third-party providers and are not responsible for their practices, subject to the disclaimers set forth in the Bank Feed Terms and the Terms of Service. 7. Cookies and Tracking Technologies 7.1 General. We and our service providers may use cookies, web beacons, and similar technologies to operate and secure the Services, remember preferences, and analyze usage, without limitation to these examples. 8. Data Retention 8.1 General. We retain information in accordance with our Retention Policy, incorporated herein by reference, which permits retention for business, operational, audit, security, legal, compliance, dispute-resolution, fraud-prevention, and business-continuity purposes, for extended periods or indefinitely where appropriate, and including retention of backups, audit logs, and acceptance records. 9. Your Choices and Rights 9.1 General. Depending on applicable law and an individual's relationship to Customer, certain rights may be available with respect to information processed through the Services. Because Company generally acts as a processor or service provider with respect to Customer Data, requests from tenants, applicants, or other individuals regarding their information should generally be directed to Customer, who is solely responsible for responding to such requests in accordance with Section 7 of the Terms of Service; Company will provide assistance as described in the DPA. 10. Data Security 10.1 General. We maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect information, but no method of transmission or storage is completely secure, and we do not guarantee absolute security. 10.2 Incident Response. We maintain an internal process for identifying, investigating, containing, assessing, and remediating suspected security incidents affecting information we hold. The specific measures are determined by us, may change, and are not a commitment to any particular outcome, timeline, or technique. 10.3 Notification. Where we confirm a breach of security affecting information we process on an account holder's behalf, we notify that account holder in accordance with Section 8 of the Data Processing Addendum, which governs the timing and content of the notice. THE ACCOUNT HOLDER IS SOLELY RESPONSIBLE for determining whether any law requires it to notify tenants, applicants, occupants, owners, regulators, or any other person, and for making any such notification within the time that law requires; we make no such notification on an account holder's behalf. Where an incident affects information for which we are ourselves the business or controller, we will notify affected individuals and any regulator to the extent, and within the time, applicable law requires. A notice given under this Section is not a determination that any law requires notification, and is not an admission of fault, liability, or breach by us. Unsuccessful attempts that do not result in unauthorized access to information - including pings, port scans, failed log-in attempts, denial-of-service attempts, and similar events - are not security incidents and require no notice. 11. Children's Privacy 11.1 General. The Services are not directed to individuals under the age of eighteen (18), and we do not knowingly collect information from such individuals through direct account registration. 12. International Users and Scope of Offering 12.1 Where Information Is Processed. Information may be processed and stored in the United States and other jurisdictions in which we or our service providers operate, without limitation. 12.2 The Services Are Offered in the United States. The Services are offered and directed to customers in the United States. They are not offered or directed to individuals located in the European Economic Area, the United Kingdom, or Switzerland, and we make no representation that the Services or this Policy comply with the General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, or any other non-United States data protection law. 12.3 Customer's Obligation. A customer must not use the Services to collect, submit, or process the personal data of any individual located in the European Economic Area, the United Kingdom, or Switzerland, or any other information subject to a non-United States data protection law, without first entering into a separate written agreement with us covering that processing. Absent such an agreement, we do not offer, and are not required to provide, Standard Contractual Clauses, an international data transfer addendum, a representative under Article 27 of the General Data Protection Regulation, or any other transfer mechanism, and any claim arising from a customer's use of the Services in breach of this Section is within the scope of the customer's indemnification obligation under Section 19 of the Terms of Service. 12.4 Access from Outside the United States. A person who accesses the Services from outside the United States does so on their own initiative and is responsible for compliance with local law. 13. Your California Privacy Rights 13.1 Scope. This Section applies to residents of California and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"). Terms used in this Section have the meanings given to them in the CCPA. This Section does not apply to information exempt from the CCPA, including without limitation information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or the Driver's Privacy Protection Act, and it creates no right beyond those the CCPA confers. 13.2 Our Two Roles, and Where a Request Must Go. Company handles information in two capacities, and the capacity determines who must answer a request. - For information about the ACCOUNT HOLDER - the person or entity that registers for, administers, or pays for the Services, and its Authorized Users - Company is a business under the CCPA, and this Section describes how to exercise rights against Company. - For information about TENANTS, APPLICANTS, OCCUPANTS, OWNERS, VENDORS, and any other individual whose information an account holder submits, Company is a SERVICE PROVIDER processing on that account holder's documented instructions. The account holder is the business. A request from such an individual must be directed to the account holder, not to Company. Where Company receives a request directly from an individual for whom it acts only as a service provider, Company may decline the request, and will where practicable tell the requester to direct it to the account holder, without confirming or denying whether any information about that person exists. 13.3 Categories of Personal Information Collected. In the twelve months preceding the effective date of this Policy, Company may have collected the following statutory categories, whether as a business or as a service provider: identifiers, including name, postal address, email address, telephone number, account name, unique personal identifier, online identifier, and Internet Protocol address; personal information described in Cal. Civ. Code section 1798.80(e), including signature, address, telephone number, bank account or other financial information, and employment information; characteristics of protected classifications under California or federal law, where an account holder submits them in the course of tenancy administration; commercial information, including subscription, purchase, payment, and transaction records; Internet or other electronic network activity information, including access, usage, and diagnostic logs; geolocation data, approximate only, derived from Internet Protocol address; professional or employment-related information; and inferences drawn from the foregoing. Company does not itself collect biometric information, sensory information, or education information, and Section 7.3 of the Terms of Service prohibits customers from submitting biometric information to the Services at all. 13.4 Sensitive Personal Information. As a business, Company collects account log-in credentials in combination with the credentials required to access the account. As a service provider, Company may process sensitive personal information that an account holder chooses to submit, including without limitation Social Security or taxpayer identification numbers and financial account information. Where an individual opts in to rent reporting, Company additionally collects and furnishes the information described in Section 2.3 of this Policy, including a government identifier where the receiving consumer reporting agency requires one for identity matching, at that individual's own request and solely to perform the service requested. Company uses and discloses sensitive personal information only for the purposes permitted by Cal. Civ. Code section 1798.121 and its implementing regulations - to perform the Services, to prevent, detect, and investigate security incidents and fraudulent or illegal activity, to verify and maintain the quality and safety of the Services, and as otherwise permitted - and DOES NOT use or disclose it to infer characteristics about a consumer. Because of that, Company is not required to, and does not, offer a "Limit the Use of My Sensitive Personal Information" link. 13.5 Sources. Company collects personal information directly from account holders and their Authorized Users; from account holders about other individuals; automatically from devices and browsers used to access the Services; and from service providers, including payment processors and financial-data aggregators engaged at an account holder's direction. 13.6 Business and Commercial Purposes. Company collects and processes personal information to provide, operate, secure, support, maintain, and improve the Services; to authenticate users and administer accounts; to process payments and prevent fraud; to communicate about the Services; to comply with legal obligations and respond to legal process; to establish, exercise, or defend legal claims; and for the additional purposes described in Section 3 of this Policy. 13.7 Disclosure for a Business Purpose. In the twelve months preceding the effective date of this Policy, Company may have disclosed each category listed in Section 13.3 for a business purpose to the following categories of recipients: hosting and infrastructure providers; payment processors; financial-institution and account-aggregation providers, where an account holder connects an account; artificial-intelligence and document-processing providers, only for a feature the account holder purchased and separately consented to; communications, email-delivery, and messaging providers, and wireless carriers where a text message is sent; tenant screening, background, and identity verification providers, where an account holder or an individual requests a check; rent-reporting service providers and the consumer reporting agencies that receive furnished information, where an individual has opted in; insurers, insurance agencies, and producers, where an applicant applies for a product; maintenance vendors and contractors selected by an account holder, where a work order is routed to them; security, monitoring, and analytics providers; professional advisors; and governmental or judicial authorities where required. Each provider that receives Customer Data is identified in the in-app Subprocessor Registry, and the Services refuse to transmit Customer Data to a provider that is not identified and enabled there. 13.8 No Sale and No Sharing. COMPANY DOES NOT SELL PERSONAL INFORMATION AND DOES NOT SHARE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING, and has not done so in the twelve months preceding the effective date of this Policy. Company does not sell or share the personal information of any consumer it knows to be under sixteen (16) years of age. Because Company neither sells nor shares personal information, no "Do Not Sell or Share My Personal Information" link is required or provided. A disclosure to a service provider or contractor for a business purpose under a written contract meeting the requirements of the CCPA is not a sale or a share. Company's use of Promotional Material under Sections 2.5 through 2.8 of the User Content Terms is a use of material an account holder submitted or designated for that purpose under a licence granted to Company; IT IS NOT A SALE OR A SHARE OF PERSONAL INFORMATION, and it does not extend to any of the information excluded by Section 4.9 of this Policy. 13.9 Retention. Company retains each category of personal information for as long as reasonably necessary for the purposes described in Section 13.6, and thereafter as described in the Retention Policy and in Section 11 of the Data Processing Addendum. The criteria used to determine the period include the duration of the account relationship, the period during which a claim may be brought, the existence of a legal hold or an unresolved dispute, applicable recordkeeping obligations, and the ordinary expiry of backup, archival, and audit records. 13.10 Your Rights. Subject to verification and to the exceptions the CCPA allows, a California resident whose personal information Company holds as a business may: request to know the categories and specific pieces of personal information collected, the categories of sources, the business or commercial purpose for collecting it, and the categories of recipients; request a copy in a portable format; request correction of inaccurate personal information; request deletion; and not be discriminated against for exercising any of these rights. Because Company neither sells nor shares personal information and does not use sensitive personal information to infer characteristics, the right to opt out of sale or sharing and the right to limit the use of sensitive personal information do not arise. 13.11 How to Submit a Request. Send a request to support@tavolawest.com with the subject line "California Privacy Request." Company operates exclusively online and has a direct relationship with each account holder, so an email address is the designated method for submitting requests. Company will acknowledge a request within ten (10) business days and respond within forty-five (45) calendar days, which may be extended by a further forty-five (45) days where reasonably necessary, with notice of the extension and the reason for it. 13.12 Verification. Company must verify that a requester is the person about whom the information relates before acting on a request to know, correct, or delete. Verification is ordinarily performed by matching information supplied in the request against information already held, and by requiring the request to be made from the email address on the account. Company may request additional information where necessary to verify identity, will use it only for verification, and will delete it as soon as practicable afterwards. WHERE COMPANY CANNOT VERIFY A REQUESTER TO THE DEGREE OF CERTAINTY THE CCPA REQUIRES, IT WILL DECLINE THE REQUEST AND EXPLAIN WHY. Company will not create, collect, or retain personal information solely to be able to verify a future request. 13.13 Authorized Agents. An authorized agent may submit a request on a consumer's behalf. Company may require the agent to provide written permission signed by the consumer, may require the consumer to verify their own identity directly with Company, and may require the consumer to confirm directly that the agent is authorized. Company may deny a request from an agent who does not provide these materials. 13.14 Non-Discrimination. Company will not deny goods or services, charge a different price or rate, impose a penalty, provide a different level or quality of goods or services, or suggest that it will do any of these things, because a consumer exercised a right under the CCPA. Company offers no financial incentive or price or service difference in exchange for the retention or sale of personal information. 13.15 Shine the Light. Company does not disclose personal information to third parties for those third parties' own direct marketing purposes, and therefore makes no disclosure under Cal. Civ. Code section 1798.83. 13.16 California Minors. The Services are not directed to individuals under eighteen (18) and Company does not knowingly permit such individuals to register an account. A California resident under eighteen (18) who nevertheless holds a registered account may request removal of content they posted, as described in Cal. Bus. & Prof. Code section 22581, by writing to support@tavolawest.com. Removal from public display does not guarantee complete or comprehensive removal from Company's systems. 13.17 Notice at Collection. This Policy, and the Section headings referenced in it, serve as Company's notice at collection under Cal. Civ. Code section 1798.100(a). Company does not collect additional categories of personal information, or use personal information for additional purposes, without first updating this Policy in accordance with Section 16 of the Terms of Service. 13.18 Accessibility. A consumer who requires this Policy in an alternative format may request one at support@tavolawest.com. 14. Other United States State Privacy Laws 14.1 General. Residents of other states with comprehensive privacy legislation - including without limitation Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, and any other state whose law applies to Company from time to time - may have rights to confirm whether Company processes their personal data, to access, correct, delete, or obtain a copy of it, and to opt out of targeted advertising, sale, or certain profiling. Company does not engage in targeted advertising, does not sell personal data, and does not conduct profiling that produces legal or similarly significant effects. 14.2 How to Exercise Them. The role division in Section 13.2 applies equally: where Company acts only as a processor or service provider, the request belongs to the account holder. Otherwise, requests may be submitted to support@tavolawest.com and are handled using the same verification, timing, and authorized-agent procedures described in Sections 13.11 through 13.13, adjusted to whatever the applicable state law requires. 14.3 Appeals. Where an applicable state law confers a right to appeal a refusal, a consumer may appeal by writing to support@tavolawest.com with the subject line "Privacy Request Appeal" within a reasonable period after the refusal. Company will inform the consumer in writing of the outcome of the appeal, and of the reasons for it, within the period the applicable law requires, and will provide information about how to contact that state's attorney general to submit a complaint. 14.4 No Additional Rights Created. This Section describes rights conferred by law. It does not create a contractual right, and it does not extend a right to a person to whom the applicable law does not give it. 15. Changes to this Policy 15.1 General. We may modify this Policy at any time in accordance with Section 16 of the Terms of Service (Modifications to Terms and Policies), which governs the manner and effectiveness of any revision to this Policy. 16. Contact Us Questions regarding this Privacy Policy may be directed to support@tavolawest.com or M.S.J. & K. Inc., 27530 Caradoc Springs Ct, Spring, TX 77386.