Back to BoardFlow

Rental Privacy Policy

Last updated: May 11, 2026

1. Overview and Controller Status

This Rental Privacy Policy explains how Slatewood Labs LLC, a New York limited liability company doing business as BoardFlow ("we", "us", or "our"), collects, uses, discloses, and protects personal information from rental applicants and their licensed agents who use BoardFlow to prepare a rental application package. For the co-op/condo board-package flow, see our general Privacy Policy and Data Processing Agreement.

For the rental flow, BoardFlow acts as the independent Data Controller of the personal information you provide. We process this data to deliver the document-preparation service you have engaged us for — not on behalf of any landlord or property management firm. We are not a service provider, agent, or processor for any landlord in the rental flow; the prepared package is your property, held on your behalf, until you choose to transmit it through your own channel.

We maintain reasonable administrative, technical, and physical safeguards in accordance with the New York Stop Hacks and Improve Electronic Data Security Act ("SHIELD Act") and other applicable privacy laws.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and an encrypted password.

2.2 Application Materials

To prepare your rental application package, you may upload:

  • Financial documents — pay stubs, tax returns, bank statements, brokerage statements, employment verification letters, reference letters.
  • Identification documents — government-issued photo ID, credit report.
  • Structured form data you enter directly — household composition, employment, references, vehicles, pets, prior addresses, and similar fields.

Uploaded documents may contain Social Security numbers, bank account numbers, or other sensitive identifiers. BoardFlow does not request those identifiers as structured form fields. Every uploaded PDF is automatically rewritten on ingest to redact those identifiers before the document becomes viewable; the pre-redaction copy is stored in a service-role-only location and is purged shortly after redaction completes. SSNs and account numbers shown in our user interface are masked to the last four digits.

2.3 Usage Data

We collect audit logs of document access (who accessed what and when) for security and integrity purposes.

3. How We Use Your Information

  • To prepare, validate, redact, and compile your rental application package on your behalf.
  • To make the prepared package available to you for download and onward transmission through your own channel.
  • To enforce role-based access controls and data security.
  • To send transactional emails associated with your account and preparation work (account verification, password reset, completion confirmations).
  • To process the Package Preparation Fee via Stripe.
  • To maintain audit trails for security and integrity.

We do not:

  • Automatically transmit your prepared package or any portion of your data to any landlord or property management firm. You (or, where authorized, your licensed agent) choose when and where to send the package.
  • Share or sell your personal information for marketing purposes.
  • Use your data to train AI models or for any purpose unrelated to the preparation service you engaged us for.

4. Data Retention

  • Prepared rental packages: automatically deleted thirty (30) days after you mark the package complete, or after thirty (30) days of inactivity if the package is never marked complete.
  • Stale drafts: automatically cleaned up after thirty (30) days of inactivity.
  • Account data: retained until you request account deletion through your profile settings.
  • Audit logs and payment records: retained as required for tax, accounting, and dispute-resolution purposes.

5. Sub-Processors

We engage the following third-party service providers to deliver the rental flow:

  • Supabase — database hosting, authentication, and file storage. Row-level security enforced.
  • Vercel — application hosting and deployment.
  • Stripe — payment processing for the Package Preparation Fee. Card data does not touch our servers.
  • Resend — transactional email delivery.
  • Twilio — SMS one-time passcodes for optional two-factor authentication.
  • Google Cloud (Document AI, Gemini API — paid tier) — automated extraction and redaction of sensitive identifiers from uploaded documents. Under Google's paid-tier terms, prompts and attachments are not used to train Google's models.
  • Plaid — optional account aggregation (investments / bank statements) when you choose to use it instead of uploading PDFs.

None of these sub-processors are landlords, property managers, or building owners. We do not transmit your prepared rental package to any third party other than these processors as needed to run the preparation service.

6. Data Security

For the full technical and operational overview of our security program — including authentication, multi-factor authentication, SSN redaction, encryption, audit logging, sub-processors, and incident response — see our Security page.

7. Your Rights

7.1 California Residents (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information we collect about you
  • Request deletion of your personal information
  • Opt out of the sale of your personal information (we do not sell personal data)
  • Non-discrimination for exercising your privacy rights

7.2 All Users

Regardless of location, you may:

  • Export your data: request a copy of all personal data we hold about you via your profile settings.
  • Delete your account: request permanent deletion of your account and associated data via your profile settings. Upon deletion, your personal information is anonymized and documents are removed.
  • Correct your data: update your profile information at any time.

8. Cookies

We use essential cookies for authentication and session management. We do not use tracking or advertising cookies. See our Cookie Policy for details.

9. Children's Privacy

BoardFlow is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Rental Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. Your continued use of the rental flow constitutes acceptance of the updated policy.

11. Contact

For privacy inquiries or to exercise your data rights, contact us at privacy@nycboardflow.com, or by mail at:

Slatewood Labs LLC
Attn: Privacy
418 Broadway, Ste N
Albany, NY 12207