At Varden Homes LLC ("Varden," "we," "us," or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our property management platform, mobile applications, and related services (collectively, the "Service").

By accessing or using our Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide when using our Service:

• Account Information: Name, email address, phone number, password, profile photo, and account preferences
• Identity Verification: Government-issued identification (driver's license, passport, state ID), Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) for landlord payouts and tenant screening, date of birth, and photographs for identity verification
• Financial Information: Bank account details (account number, routing number), payment card information, income verification documents, tax documents (W-9, 1099), and billing address
• Property Information: Property addresses, unit details, rental amounts, lease terms, property photos, amenity information, and property ownership or management documentation
• Tenant Application Information: Employment history, rental history, income documentation, references, and authorization for background and credit checks
• Communications: Messages between landlords and tenants, support requests, feedback, and survey responses
• Document Uploads: Leases, addendums, inspection reports, maintenance photos, receipts, and other documents you upload

1.2 Information Collected Automatically

When you access our Service, we automatically collect certain information:

• Device Information: IP address, browser type and version, operating system, device identifiers (IDFA, GAID), device model, screen resolution, and language settings
• Usage Data: Pages visited, features used, time spent on the platform, click patterns, navigation paths, search queries, and interaction with notifications
• Location Data: General location based on IP address (country/region from your IP); precise location if you enable location services for property-related features
• Sign-in and Session Data: Each successful sign-in is recorded with the time, IP address, country, browser, and operating system. We use a derived "device fingerprint" (browser + OS + IP prefix) to recognize previously-used devices and alert you when you sign in from a new one. We retain sign-in events for 30 days, and active session metadata for as long as you remain signed in. You can review and revoke active sessions on your security settings page.
• Authentication Failures: We log failed sign-in attempts (without the password or one-time code itself) for the purposes of detecting credential-stuffing attacks, applying short-term account lockouts after repeated failures, and notifying you of suspicious activity.
• Two-Factor Authentication Secrets: If you enable TOTP-based two-factor authentication, we store your authenticator secret encrypted at rest using AES-256-GCM. We do not store your one-time codes; we only check that the code you provide matches the expected value for the current time window and that it has not already been used.
• Suspicious-Activity Signals: We compare each sign-in against your recent history to flag patterns such as logins from countries you've never used before, multiple distinct IP addresses in a short window, or two logins separated by less time than realistic travel between their geographic locations. When we flag a sign-in, we send you an email notification.
• Log Data: Access times, error logs, referring URLs, and pages viewed before and after using our Service
• Cookies and Similar Technologies: We use cookies, web beacons, pixel tags, and similar technologies. See our Cookie Policy for details

1.3 Information from Third Parties

We receive information from third-party services to provide and improve our Service:

• Credit Bureaus: Credit reports, credit scores, and credit history for tenant screening, collected only with applicant's written consent as required by the Fair Credit Reporting Act (FCRA)
• Background Check Providers: Criminal history records, sex offender registry checks, and eviction history from national and state databases
• Identity Verification Services: Document verification results, identity confirmation, and fraud risk assessments
• Payment Processors: Payment processing, bank account verification, identity verification, fraud detection, and chargeback information
• Property Data Providers: Public property records, ownership information, tax assessments, and property characteristics
• Social Media Platforms: If you choose to connect social media accounts, we may receive profile information you authorize

1.4 Sensitive Personal Information

We collect certain categories of sensitive personal information necessary for our Service:

• Social Security Number (for identity verification, payouts, and tenant screening)
• Government identification numbers
• Financial account information
• Precise geolocation (when enabled)

We only use sensitive personal information for purposes permitted by law and as disclosed in this Privacy Policy. We do not use or disclose sensitive personal information for purposes other than those for which it was collected.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Improving Our Service

• Create and manage your account
• Process rent payments, security deposits, and other financial transactions
• Facilitate communication between landlords and tenants
• Enable digital lease creation and electronic signatures
• Track and manage maintenance requests
• Generate financial reports and accounting records
• Syndicate property listings to third-party platforms
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve user experience
• Develop new features and services

2.2 Tenant Screening (FCRA Compliance)

• Obtain consumer reports (credit reports, criminal background checks, eviction history) at landlord request and with applicant consent
• Provide screening reports to landlords for housing decisions
• Generate adverse action notices when required by the FCRA
• Maintain records of screening requests and results as required by law

2.3 Identity Verification and Fraud Prevention

• Verify your identity when you create an account or request payouts
• Detect, prevent, and investigate fraud, unauthorized access, and other illegal activities
• Comply with anti-money laundering (AML) and know-your-customer (KYC) requirements
• Protect the security of our Service and users

2.4 Legal and Compliance

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from government authorities
• Enforce our Terms of Service and other agreements
• Protect our rights, privacy, safety, or property
• Generate tax documents (1099-K, 1099-MISC) as required by the IRS

2.5 Communications

• Send transactional notifications (payment confirmations, lease reminders, maintenance updates)
• Provide customer support communications
• Send service announcements and updates
• With your consent, send marketing communications about our products and services

3. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Service to you, including account creation, payment processing, and lease management
• Legitimate Interests: Processing for our legitimate business interests, including fraud prevention, service improvement, and marketing (where not overridden by your rights)
• Legal Obligations: Processing required to comply with applicable laws, such as tax reporting and anti-money laundering requirements
• Consent: Processing based on your specific consent, such as for marketing communications or optional features

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 With Service Providers

We share information with third-party service providers who perform services on our behalf. The vendors below are named explicitly because their terms of service require us to disclose them to you when we route your data through their products. The full canonical list, including data residency and cross-border transfer mechanisms, is published in our Data Processing Agreement and on our Trust page.

• Payment processing (Stripe, including Stripe Connect and Stripe Identity): Processing rent and security-deposit payments, ACH bank transfers, payouts to landlords, identity verification (government ID + selfie), fraud detection, and 1099-K tax reporting
• Bank-account verification (Plaid): When you link a bank account for ACH payments, Plaid retrieves a tokenized account/routing reference and account-holder name on our behalf. See the Rent-Ready bank-verification notice for the specifics on what is collected and retained.
• Credit bureaus and background check providers: Consumer reports for tenant screening, including credit history, criminal background checks, and eviction records
• Tenant rent-payment credit reporting (Experian RentBureau): When a tenant opts in, we report their rent-payment history (on-time, late, missed) to Experian RentBureau in Metro 2 format. For multi-tenant leases, we report each on-lease tenant's share-payment status individually so each roommate's credit reflects their actual contribution. You can opt out of credit reporting at any time from your account settings; opting out stops new reports but does not delete previously-submitted entries from the bureau's records.
• Cloud hosting and database infrastructure (Firebase / Google Cloud, Vercel, Cloudflare): Authentication, Firestore database, Cloud Storage, application hosting and edge delivery, plus bot management, DDoS mitigation, and WAF protection
• Communication services (Brevo for email + SMS, Twilio for voice): Transactional email delivery, SMS notifications, phone number verification, and outbound voice for support and dispatch
• Mapping and location services (Mapbox): Property geocoding, mapping tiles, and location-based features
• AI-powered analysis tools (OpenAI, Anthropic Claude, Google Gemini, ElevenLabs): Document analysis and drafting, lease and document field extraction, semantic search, maintenance issue assessment, property verification, and voice synthesis for tenant support. PII is redacted before submission to these providers; the providers are contractually prohibited from using your data to train their foundation models.
• Product analytics and feature flags (PostHog, GrowthBook): Behavioral event capture, session replay (with PII masking), and feature-flag/A-B-test assignment used to evaluate and improve the platform
• Error monitoring and performance tracking (Sentry): Application error monitoring, crash reporting, and performance analytics to maintain service reliability (PII scrubbed at the SDK layer)
• Mail delivery and address verification (Lob): Physical mail delivery for legal notices (including certified mail) and address verification services
• Property data and market analysis providers (RentCast): Property records, ownership verification, public records lookup, rental market data, and comparable analysis
• Mobile notification services: Push notification delivery infrastructure for real-time alerts on mobile devices
• Accounting and financial integrations: Financial management tools and accounting integrations for landlord bookkeeping

All service providers are contractually obligated to protect your information and may only use it for the purposes for which it was disclosed.

4.2 With Other Users

Our Service facilitates communication and transactions between landlords and tenants:

• Landlords can view tenant contact information, payment history, and maintenance requests for their properties
• Tenants can view landlord/property manager contact information for their rental units
• Co-owners and property managers can access shared property information
• Tenant screening reports are shared with the requesting landlord

4.3 With Third-Party Listing Partners

If you choose to syndicate your listings, we share property information with platforms such as:

• Zillow, Trulia, and HotPads
• Apartments.com and Rent.com
• Realtor.com
• Facebook Marketplace

4.4 For Legal Reasons

We may disclose information:

• To comply with laws, regulations, legal processes, or governmental requests
• To enforce our Terms of Service and other agreements
• To protect the rights, property, or safety of Varden, our users, or others
• To detect, prevent, or address fraud, security, or technical issues
• In response to lawful requests from law enforcement or other government authorities

4.5 Business Transfers

If Varden is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

4.6 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Consumer Reports and FCRA Compliance

Varden provides tenant screening services that include obtaining consumer reports as defined by the Fair Credit Reporting Act (FCRA). This section describes our practices regarding consumer reports.

5.1 Permissible Purpose

We only provide consumer reports to landlords who certify they have a permissible purpose under the FCRA, specifically to evaluate a consumer's application for residential rental housing.

5.2 Applicant Consent

Before obtaining a consumer report, we require the applicant's written authorization. This consent is obtained through our online application process and clearly discloses the types of reports that may be obtained.

5.3 Adverse Action Notices

When a landlord takes adverse action (denial, higher rent, or additional deposit) based in whole or in part on information in a consumer report, the landlord is required to provide the applicant with an adverse action notice. Our platform facilitates this process by providing templates and delivery mechanisms.

5.4 Dispute Rights

If you believe information in your consumer report is inaccurate or incomplete, you have the right to dispute it directly with the consumer reporting agency. Contact information for credit bureaus:

• TransUnion: 1-800-916-8800 | transunion.com/credit-disputes
• Experian: 1-888-397-3742 | experian.com/disputes
• Equifax: 1-866-349-5191 | equifax.com/personal/credit-report-services

5.5 Free Report Rights

Under the FCRA, you have the right to obtain a free copy of your consumer report if adverse action is taken against you based on the report. Request must be made within 60 days of receiving the adverse action notice.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide our Service. Specific retention periods include:

• Account Information: Duration of account plus 30 days after closure
• Financial Records: 3 years (tax and accounting purposes)
• Lease Documents: Duration of lease plus 3 years
• Tenant Screening Reports: 2 years or as required by FCRA
• Consumer Report Certifications: 5 years (FCRA requirement)
• Payment Records: 3 years
• Support Communications: 1 year
• Marketing Data: Until consent is withdrawn

When you initiate account deletion, we apply a 30-day cooldown period before permanently removing your personal data. During the cooldown your account is disabled (you cannot sign in), but you can restore the account at any time using the link sent to your email at the time of deletion. After 30 days, your account, sign-in history, co-tenant invites, share proposals, and shared-expense records are hard-deleted. Lease records and payment records are retained per the financial-records and lease-documents schedules above for legal and tax-compliance reasons. Anonymized financial summaries may be retained for platform analytics. If you believe any data remains after the cooldown elapses, contact us at privacy@vardenhomes.com.

7. Your Privacy Rights

7.1 All Users

Regardless of location, all users have the following rights:

• Access: Request a copy of the personal information we hold about you. You can self-serve a full data export from your account settings — we package your user record, sign-in history, payments, leases, applications, maintenance requests, messages, shared-expense records, and notification history into a single JSON file and email you a 7-day signed download link.
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information through your account settings, subject to the 30-day cooldown described in Section 6 and the legal retention requirements that apply to lease and payment records
• Data Portability: Request your data in a structured, machine-readable format (the data-export feature above produces JSON suitable for re-import elsewhere)
• Opt-Out of Marketing: Unsubscribe from marketing communications at any time
• Account Closure: Close your account and request deletion of associated data

7.2 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, and shared
• Right to delete personal information (with certain exceptions)
• Right to correct inaccurate personal information
• Right to opt-out of the sale or sharing of personal information
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information as defined by the CCPA. For more details, see our CCPA Notice.

7.3 EEA, UK, and Swiss Residents (GDPR)

Residents of the European Economic Area, United Kingdom, and Switzerland have additional rights:

• Right to object to processing based on legitimate interests
• Right to restrict processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority
• Right not to be subject to automated decision-making, including profiling

7.4 Other State Privacy Laws

We comply with privacy laws in other states including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA). Residents of these states may have additional rights similar to those described above.

7.5 Exercising Your Rights

To exercise any of these rights, you may:

• Email us at privacy@vardenhomes.com
• Use the privacy controls in your account settings
• Submit a request through our online privacy request form

We will respond to verifiable requests within 45 days (or as required by applicable law). We may request additional information to verify your identity before processing your request.

8. Security

We implement industry-standard security measures to protect your information. Our security program includes:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication, and least-privilege principles
• Infrastructure: SOC 2 Type II compliant hosting with geographic redundancy
• Monitoring: 24/7 security monitoring, intrusion detection, and automated threat response
• Testing: Regular penetration testing, vulnerability assessments, and security audits
• Employee Training: Security awareness training and background checks for employees with data access
• Incident Response: Documented procedures for detecting, responding to, and recovering from security incidents

While we take extensive measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. For more details, see our Security page.

9. International Data Transfers

Varden is headquartered in the United States. Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to countries without adequate data protection laws, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Supplementary security measures where required

10. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@vardenhomes.com, and we will take steps to delete such information.

11. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that sends a signal to websites requesting that your browsing activity not be tracked. Our Service does not currently respond to DNT signals. However, you can manage your cookie preferences through our cookie preference center.

12. Third-Party Links and Services

Our Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access through our platform.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you by email or through a prominent notice on our Service
• For material changes, provide at least 30 days' notice before the changes take effect

Your continued use of our Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For EEA residents, you may also contact our EU representative at: eu-rep@vardenhomes.com

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection authority in your jurisdiction.