Privacy Policy

1. Who we are

DoorProfits (“we,” “us,” or “our”) is a subscription software service for do-it-yourself landlords with up to 10 rental units. It is operated by Rocca Enterprise LLC. This Privacy Policy explains what information we collect when you use DoorProfits at doorprofits.com, how we use it, and the choices you have.

Contact us with any privacy questions at roccaenterprisellc@gmail.com.

2. Information we collect

We collect only what the service needs to function:

Account information

• Name, email address, and password (stored as a one-way bcrypt hash — we never store or see your plaintext password).
• Account name and billing details needed to manage your subscription (see Section 6).

Data you enter into the service

• Properties and units: addresses, unit labels, and rental details you add.
• Tenants and leases: tenant names, contact details, lease terms, and rent amounts.
• Rent and expenses: rent charges and payments, expense records, and receipt information you enter or photograph.
• Maintenance: work orders, statuses, notes, and related vendor information.
• Vendors: names, contact details, payment records, and tax-reporting details you enter (for example, 1099-related information).
• Documents: files you upload, such as leases and receipts, stored with our cloud storage provider.
• Mileage: trip logs you record for your rental activity.

Bank CSV imports

If you import a bank or credit card CSV file, we process the transactions in that file so you can categorize them as rent income or expenses. We do not connect directly to your bank, and we never ask for your bank login credentials.

Billing identifiers

Payments are processed by Stripe. We store Stripe customer and subscription identifiers for your account. We never see or store your full card number — card details go directly to Stripe.

Technical and session data

We collect basic technical information needed to run and secure the service, such as login timestamps, session records, and server logs (for example, IP addresses and request times used for rate limiting and abuse prevention).

3. How we use your information

We use the information above only to:

• Operate, maintain, and improve the DoorProfits service;
• Create and manage your account, sign you in, and keep your sessions secure;
• Process your subscription, renewals, and billing through Stripe;
• Generate the reports and calculations you request (rent roll, P&L, NOI, cap rate, DSCR, and similar metrics);
• Provide customer support and respond to your messages;
• Detect, prevent, and investigate fraud, abuse, or security incidents;
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your data to train third-party AI models. [CONFIRM: whether any in-app AI assistant features send user data to a third-party model provider, and disclose that provider here if so.]

4. Cookies and sessions

DoorProfits uses a session cookie (named doorprofits.session) to keep you signed in. It is HTTP-only and set with SameSite=Lax and Secure flags. We do not use advertising or cross-site tracking cookies. If we add analytics or other cookies in the future, we will update this policy and, where required, ask for your consent.

5. How we share your information

We share information only with the providers that run the service:

• Hosting and infrastructure: our web hosting provider, managed PostgreSQL database provider, and object storage provider, which store and serve your account data. [NAME THE PROVIDERS, e.g., Vercel, Neon/Supabase, Cloudflare R2.]
• Payments: Stripe, Inc., to process subscription payments. Stripe’s own privacy policy governs the payment information it collects.
• Email: our email delivery provider for transactional messages such as sign-up confirmations and receipts. [NAME THE PROVIDER, e.g., Resend.]

We do not sell, rent, or trade your personal information.

We may disclose information if required by law (for example, a court order or subpoena), to protect the rights, property, or safety of DoorProfits, our users, or others, or in connection with a merger, acquisition, or sale of assets — in which case the acquiring party will be bound by this policy or notified of any changes.

6. Data retention and deletion

We keep your account data for as long as your account is active and as needed to provide the service, comply with legal obligations (such as tax or financial record-keeping), and resolve disputes.

If you cancel your account, you may request deletion of your account data by emailing roccaenterprisellc@gmail.com. We will delete or anonymize your personal data within [DELETION TIMEFRAME, e.g., 30 days] of a verified request, except for records we are legally required to retain (for example, billing records), which we keep only as long as the law requires and then delete.

7. Your rights

You may, at any time:

• Access the personal information we hold about you;
• Correct inaccurate information in your account settings or by contacting us;
• Export your data using the in-app reports (rent roll, P&L, expense reports, and CSV exports) or by requesting a copy from us;
• Delete your account and personal data as described in Section 6.

[ADD STATE-SPECIFIC RIGHTS DISCLOSURES IF APPLICABLE, e.g., California (CCPA/CPRA), and describe how to exercise them and appeal a denial.]

We will not discriminate against you for exercising your privacy rights.

8. Security

We protect your data with measures including:

• HTTPS encryption for all traffic to and from the service;
• Passwords hashed with bcrypt (cost factor 12) — never stored in plaintext;
• Server-side session tokens stored as SHA-256 hashes, with automatic expiration and revocation on logout;
• Rate limiting on sign-in to slow down brute-force attempts;
• Tenant isolation in the database so one account can never see another account’s data;
• Webhook signature verification for payment events.

No system is completely secure. If we learn of a data breach affecting your personal information, we will notify you as required by law.

9. Children’s privacy

DoorProfits is intended for adults managing rental property. It is not directed at children under 13 (or under 16 where applicable law requires), and we do not knowingly collect personal information from children. If we learn that a child has provided us personal information, we will delete it promptly. Contact us at roccaenterprisellc@gmail.com if you believe this has happened.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above and, for material changes, notify you by email or through an in-app notice. Continued use of the service after changes take effect means you accept the updated policy.

11. Contact us

Rocca Enterprise LLC
[BUSINESS MAILING ADDRESS — required before launch]
Email: roccaenterprisellc@gmail.com