Draft for legal review. Not yet in effect.

Resident Portal Privacy Notice

Pondview Property Management

What the portal shows you

Your leases, your rent and deposit ledger, statements, and notices or documents the office publishes for leases you are on. After you move out, you can still see that lease for one year. If you share a lease with roommates, everyone on that lease sees the same ledger, including each payment made toward it and its description, which may say who paid.

What we never show in the portal

Social Security numbers, dates of birth, other residents' contact details, and staff notes.

What we collect when you use the portal

  • Your account email, and your password stored only as a one-way hash (we cannot read it).
  • If you sign in with Google, your Google account ID and email address.
  • Requests you send the office, including any photos. We remove location and camera details from photos when you upload them.
  • Whether you agreed to receive notices electronically, and when you last changed that.
  • When you sign in or out, failed sign-in attempts, and which statements, notices and documents you open or download, with the IP address and browser that made the request. We use this to protect your account.

Who can see it

Pondview office staff who manage resident accounts. We use service providers to run the portal: our hosting provider stores the data, Google Workspace sends our emails, and Google handles sign-in if you choose "Sign in with Google". We don't sell your information or use it for advertising.

"Why do I owe this?"

If you ask for an explanation of your statement, the statement's dates, descriptions and amounts are sent to Anthropic, the company that makes the Claude AI model, to write it. Payment descriptions are sent only as "Payment", and no names, contact details or staff notes are sent. We keep each explanation for one year.

Email

Portal emails contain sign-in and set-up links. They never include amounts or account details; sign in to see those.

Keeping your account safe

Sessions end after 30 minutes without activity and after 12 hours in total. Sign-in pauses for 15 minutes after repeated wrong passwords. If you think someone else has used your account, contact the office and we will sign it out on every device.

If something goes wrong

If personal information is exposed in a data breach, we will notify affected residents as Washington law requires (RCW 19.255.010), within 30 days of discovering it.

How long we keep it

[To confirm with counsel: retention period for portal activity records, and for accounts after move-out.]

Questions

Contact the Pondview office.

Privacy Notice · Terms of Use