Privacy Policy

Last updated: [DATE TO BE INSERTED ON PUBLISH] Effective date: [DATE TO BE INSERTED ON PUBLISH]

This Privacy Policy describes how LeaseDrafts ("we," "us," or "our"), operated by Crowditory LTD (a company registered in the Republic of Cyprus), collects, uses, and shares information when you use our website at leasedrafts.com (the "Service").

By using the Service, you agree to the practices described in this Privacy Policy.

1. Information we collect

1.1 Information you provide

When you use the Service to generate a residential lease, we collect the information you enter into the form, which may include:

• Property details (address, type, bedrooms, bathrooms, square footage)
• Landlord legal name and mailing address
• Tenant name(s)
• Lease term, rent amount, security deposit, late fee policy
• Pet policy and utility arrangements
• Any special clauses or notes you provide
• Your email address (for delivery of the generated lease)

1.2 Payment information

When you purchase a lease, payment is processed by Stripe, Inc. We do not store full credit card or banking details on our servers. Stripe provides us with limited transaction metadata (payment confirmation, last four digits of card, billing country) which we retain for accounting and refund purposes.

1.3 Technical information

When you visit the Service, we automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring website
• Cookies and similar tracking technologies (see Section 6)

1.4 Information from third parties

We do not purchase or receive personal information from data brokers.

2. How we use information

We use the information we collect to:

• Generate the lease document you requested
• Deliver the generated lease to your email address
• Process payments and provide receipts
• Respond to support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations
• Improve the Service (in aggregate or anonymized form)
• Send transactional emails related to your purchase (we do NOT send marketing emails unless you explicitly opt in)

We do not sell your personal information to third parties.

3. Legal bases for processing (for users in the EEA/UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

• Contract performance: To provide the lease generation service you purchased
• Legal obligation: To comply with tax, accounting, and legal record-keeping requirements
• Legitimate interests: To prevent fraud, improve the Service, and respond to inquiries
• Consent: Where you have given explicit consent (e.g., for non-essential cookies)

4. Information sharing

We share your information only with the third-party service providers necessary to operate the Service:

Each provider is contractually required to maintain the confidentiality and security of your data.

We may also disclose information when required by law, court order, or to protect our legal rights or the safety of others.

5. International data transfers

Crowditory LTD is established in Cyprus. The Service is hosted on infrastructure located in Germany (Hetzner). Some of our service providers are located in the United States. When personal data is transferred outside the European Economic Area, we rely on the European Commission's adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms.

6. Cookies and tracking

The Service uses the following categories of cookies and similar technologies:

6.1 Strictly necessary

Required for the Service to function (e.g., session management, security, form state). These cannot be disabled.

6.2 Analytics

We use Plausible Analytics, a privacy-friendly analytics service that does not use cookies and does not collect personal data, to understand aggregate usage patterns.

6.3 Advertising (Meta Pixel)

If you arrive via a Facebook or Instagram advertisement, we use the Meta Pixel to measure ad effectiveness. You can opt out of personalized advertising in your Meta account settings or via consumer choice tools such as www.youradchoices.com.

7. Data retention

We retain personal data for the following periods:

• Form drafts (incomplete submissions): 14 days, then automatically deleted
• Completed transactions: 7 years (for tax and accounting compliance), then deleted
• Generated lease PDFs: 90 days in active storage; available on request thereafter for 7 years from secure backup
• Email logs (transactional): 12 months
• IP addresses and technical logs: 90 days

You may request earlier deletion of your data as described in Section 8.

8. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your data (subject to legal retention obligations)
• Restriction: Request restriction of processing in certain circumstances
• Portability: Receive your data in a portable, machine-readable format
• Objection: Object to certain types of processing, including direct marketing
• Withdraw consent: Withdraw consent where processing is based on consent

To exercise these rights, email privacy@leasedrafts.com. We will respond within 30 days (or as required by applicable law).

8.1 California residents (CCPA/CPRA)

California residents have additional rights, including the right to:

• Know what categories of personal information are collected
• Request deletion of personal information
• Opt out of "sales" or "sharing" of personal information (we do not sell personal information)
• Non-discrimination for exercising privacy rights

To exercise California-specific rights, contact us at privacy@leasedrafts.com.

8.2 EU/UK residents (GDPR/UK GDPR)

You have the right to lodge a complaint with your local data protection authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection: www.dataprotection.gov.cy.

9. Children's privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected such information, we will delete it promptly.

10. Security

We implement reasonable technical and organizational measures to protect your data, including:

• TLS encryption for all data in transit
• Encrypted storage of personal data at rest
• Restricted internal access on a need-to-know basis
• Regular security reviews of our infrastructure

No system is fully secure, and we cannot guarantee absolute security. You are responsible for the security of your account credentials (where applicable) and the device you use to access the Service.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify users by:

• Posting a notice on the Service
• Updating the "Last updated" date at the top of this policy
• Where required by law, sending email notice to users with active transactions

Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact us

For questions about this Privacy Policy or our data practices:

Crowditory LTD [Registered office address — TO BE INSERTED] Cyprus

Email: privacy@leasedrafts.com Data Protection Officer (if applicable): dpo@leasedrafts.com

End of Privacy Policy.