Privacy Policy

At Facility Box, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our property operations management platform.

By using Facility Box, you agree to the terms of this Privacy Policy. If you do not agree with our policies and practices, please do not use our service.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly when using our service:

• Account Information: Name, email address, phone number, and password when you register
• Organization Details: Organization name, contact information, building details
• Issue Reports: Descriptions, photos, contact information (optional), category, and severity
• Resources: Documents and files you upload for tenant access
• Communications: Messages sent through our internal chat system

1.2 Information Collected Automatically

When you use Facility Box, we automatically collect certain information:

• Usage Data: Pages visited, features used, actions taken, time stamps
• Device Information: Browser type, operating system, device identifiers
• IP Address (Hashed): For rate limiting and abuse prevention, we store only hashed versions of IP addresses, not the actual addresses
• Cookies: Session cookies for authentication and functionality

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To provide, maintain, and improve our platform
• Account Management: To create and manage user accounts and authenticate users
• Communication: To send account-related emails, notifications, and updates
• Issue Management: To route issue reports to appropriate property managers and track resolution
• Analytics: To understand usage patterns and improve our service
• Security: To detect, prevent, and address abuse, fraud, and security issues
• Legal Compliance: To comply with legal obligations and enforce our terms

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Within Your Organization: Information is shared with appropriate users based on role-based access controls (e.g., portfolio managers can see all data in their organizations)
• Public Information: Property manager names, phone numbers, and emails are displayed on public pages for tenant access. Resources uploaded by property managers are accessible to anyone with the building's link
• Service Providers: We use third-party service providers for hosting (Vercel), database (Neon), file storage (Cloudinary), and email delivery (Resend)
• Legal Requirements: We may disclose information if required by law or in response to valid legal requests
• Business Transfers: If Facility Box is involved in a merger, acquisition, or sale, your information may be transferred

4. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit using TLS/SSL and at rest in our databases
• Password Security: Passwords are hashed using bcrypt and never stored in plain text
• IP Privacy: IP addresses are hashed using SHA-256 for rate limiting—we never store actual IP addresses
• Access Controls: Role-based permissions ensure users only access data they're authorized to see
• Regular Updates: We regularly update our systems and dependencies to address security vulnerabilities
• Secure Infrastructure: Our platform is hosted on secure, industry-standard infrastructure

While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

5. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Active Accounts: Data is retained while your account is active
• Issue Reports: Archived for 7 years for record keeping and analytics
• Account Deletion: Upon account deletion, most personal data is removed within 30 days, except where retention is required by law
• Analytics Data: Anonymized analytics data may be retained indefinitely

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can access your personal information through your account dashboard
• Correction: You can update your account information at any time in your profile settings
• Deletion: You can request account deletion by contacting us at hello@facilitybox.com
• Data Export: Portfolio and property managers can export their data using our built-in export features
• Opt-Out: You can opt out of non-essential communications
• Cookie Control: You can disable cookies in your browser settings, though this may affect functionality

To exercise these rights, please contact us at hello@facilitybox.com.

7. Children's Privacy

Facility Box is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately so we can delete it.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using Facility Box, you consent to such transfers. We ensure appropriate safeguards are in place to protect your data in compliance with applicable laws.

9. Third-Party Links and Services

Our service may contain links to third-party websites or services (e.g., Cloudinary for file viewing). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification to registered users for significant changes

Your continued use of Facility Box after changes are posted constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: