Privacy Policy

1. Introduction

LeaseParser (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered lease analysis service at leaseparser.com (the “Service”).

2. Information We Collect

2.1 Information You Provide

• Lease Documents: PDF files you upload for analysis
• Payment Information: Billing details processed through Stripe (we never store credit card numbers). We keep a record of each purchase: the report type, amount, Stripe payment ID, refund status, and the email address you gave at checkout. We use that email address to send you a private link to your report, to create an account for you in the cases described under Account Information below, and to find your reports if you email our support team. The private link opens your report on any device. Anyone who has the link can open that report, so keep it private. It works for as long as we keep the report (see Section 4.2).
• Account Information: Email address and name if you create an account. If you ask to reset your password, we email a one-time link to your account's email address; it works for one hour. If you buy a report for a lease that isn't already in an account, and no account exists yet for the email address you gave at checkout, we create an account for that address and put the report in it. That account has no password. You can set one only from a browser that can already open one of the account's reports (the browser that uploaded the lease, or one that opened the private link we emailed you), or with a password reset link sent to that address. After that, it works like any other account. If an account already exists for your checkout email, we don't add the report to it automatically; the report is added to your account when you open it while signed in.
• “Email Me” Requests: If you enter your email address in the “Email Me” form on your results page, we store it together with the ID of your job and email you a summary of your free check: the key terms it found (property address, monthly rent, lease start and end dates, and lease term) and a private link to your free check. The link works for as long as we keep your results: for a free check with no purchase, that's about 72 hours after upload (see Section 4.2). Only someone who can already open your results (for example, from the browser that uploaded the lease or one that opened its private link) can use the form.
• Session Data: The ID of your current job, stored in your browser's local storage and session storage so you can get back to your results. If you open a private report link, we also store a cookie (lp_grants) in your browser that lists the reports you've opened through private links. It expires one year after you last open a private link.

2.2 Automatically Collected Information

• Usage Data: IP address, browser type, pages visited, and access times
• Cookies: A session cookie (lp_session) that links you to the documents you upload, and a sign-in cookie if you log in to an account. Both last 30 days. If you open a private report link, we also set a private-link cookie (lp_grants) that lists the reports you've opened through private links. It expires one year after you last open a private link (see Section 2.1). If you open a password reset link, we also set a password-reset cookie (lp_reset) that holds the code from that link. It lasts up to one hour and is deleted once your new password is set (see Section 2.1).
• Sign-in Records: Each time you sign in to an account, we record that sign-in: when you signed in and when the session was last used. For sign-ins with your email and password, the record also includes the IP address, an approximate location (city, region and country) that our host Vercel looks up from that IP address, and your browser's user-agent string. Your sign-in cookie carries the ID of this record. You can see your sessions on your Account page and sign any of them out. See Sections 3, 4.2 and 6.5.
• Device Information: Operating system, screen resolution, device type, and browser characteristics
• Analytics Data: Page views, clicks, feature usage events, and session recordings collected via PostHog, plus page views and traffic sources collected via Google Analytics. These are not anonymous: if you buy a report or submit the “Email Me” form, PostHog links your activity to your email address. See Sections 6.6 and 6.7.
• Device Fingerprint: Our site uses the open-source FingerprintJS library to calculate a visitor identifier in your browser. That identifier is sent only to our own servers, where we store it with your uploads and use it to prevent fraud and abuse, including blocking visitors who misuse the Service. We don't send it to Fingerprint (the company behind the library) or any other third party.

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To analyze your lease documents and generate reports
• Payment Processing: To process payments for purchased reports
• Fraud Prevention: To detect and prevent abuse, fraud, and unauthorized access to the Service
• Account Security: To show you where your account is signed in, let you sign any of those sessions out, and end a session once it has been signed out or the account has been banned
• Communication: To send service-related notifications and respond to inquiries
• Service Improvement: To analyze usage patterns and improve our Service
• Legal Compliance: To comply with legal obligations and enforce our Terms of Service

4. AI Processing and Data Handling

4.1 Third-Party AI Services

4.2 Document Retention

An automatic cleanup job runs once a day (at 02:00 UTC). Because it runs daily, data is actually removed up to about a day after each period below ends. Here's how long we keep things:

• Uploaded lease files: Deleted about 72 hours after upload, whether or not you buy a report. In practice, your file is gone within about 4 days of upload.
• Free initial checks (no purchase): The check result and the job record are deleted about 72 hours after upload.
• Paid reports: The text report you bought is kept for one year after upload so you can come back to it (from any device, if you're signed in or use the private link we emailed you). It's then deleted automatically.
• Payment records: The report type, amount, Stripe payment ID, refund status, and the email address you gave at checkout are kept after the report itself is deleted, for accounting, refunds, and legal and tax purposes.
• Server logs: Kept for 30 days.
• Page-view counts: Kept for 90 days.
• Rate-limit records: Stored using a salted hash of your IP address (not the address itself) and deleted after about 24 hours.
• “Email Me” addresses: We send the summary email to the address you enter and keep the address with your job ID. We don't currently delete these automatically; email us and we'll remove yours (see Section 7.2).
• Account information: Your email address and name are kept for as long as your account exists. This includes an account we create for you at checkout (see Section 2.1). You can ask us to delete your account (see Section 7.2).
• Sign-in records: Deleted 30 days after the session was last used or signed out. A session that isn't used for 30 days ends.

These periods cover data stored by LeaseParser. Data held by our service providers (see Section 6) is also subject to their own retention practices.

While we make reasonable efforts to delete documents promptly, exact deletion timing may vary due to technical factors such as processing queues, system maintenance, and cloud provider operations.

5. Data Storage and Security

5.1 Security Measures

We implement reasonable security measures to protect your data, including:

• Encryption of data in transit using SSL/TLS
• Restricted access to cloud storage systems
• Database encryption at rest
• PCI-DSS compliant payment processing through Stripe

No method of transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security.

5.2 Data Location

Your data may be processed and stored in the United States and other countries where our service providers operate. By using our Service, you consent to this transfer.

6. Third-Party Services and Sub-Processors

We transmit data to the following third-party service providers (“sub-processors”) as necessary to operate the Service. By using the Service, you acknowledge that your data may be processed by these providers in accordance with their respective privacy policies.

The open-source FingerprintJS library we use for fraud prevention runs in your browser and sends its result only to our own servers, so it isn't a sub-processor and isn't listed here. See Section 2.2.

We reserve the right to change sub-processors as necessary to operate and improve the Service. Material changes to this list will be reflected in updates to this Privacy Policy. We encourage you to review this section periodically and to consult the privacy policies of each sub-processor listed above.

7. Your Rights and Choices

7.1 Access and Control

You have the right to:

• Access your analysis reports during the retention period
• Request deletion of your data
• Export your reports before they are automatically deleted

7.2 Data Deletion

To request deletion of your data, contact us at support@leaseparser.com. We will make reasonable efforts to delete your information within 30 days of your request. Some data may be retained as required by law or for legitimate business purposes (e.g., fraud prevention records).

8. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your information)
• Right to non-discrimination for exercising your rights

10. International Users (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing

11. DMCA & Content Removal

If you believe your copyrighted material was uploaded without authorization, contact us at support@leaseparser.com with:

• Description of copyrighted work
• Job ID or file details
• Your contact information

We will investigate and take appropriate action as promptly as possible.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: