Privacy Policy

Victor Platform by Victor Markus LLC

Effective Date: [EFFECTIVE DATE]

Last Updated: [LAST UPDATED DATE]

This Privacy Policy describes how Victor Markus LLC (“Company,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with the Victor Platform and related websites and services (collectively, the “Service”).

By using the Service, you consent to the practices described in this Privacy Policy.

1. Scope and Roles

This Privacy Policy applies to personal information we process about:

• Users who create or use accounts on the Service (owners, landlords, investors, property managers, contractors, tenants, and other individuals);
• Tenants and other individuals whose information is entered into the Service by Users; and
• Visitors to our websites.

If you provide us with information about another person (such as a tenant), you are responsible for ensuring you have the authority and any required consent to do so.

We generally act as a service provider / processor with respect to tenant and property information our Users submit, and as a controller / business with respect to information about our direct customer contacts and website visitors. The exact roles may vary under specific privacy laws and should be confirmed by counsel.

The Service is intended for Users in the United States and is not directed to residents of the European Union or United Kingdom.

2. Information We Collect

We may collect the following categories of information:

2.1 Account and Contact Information

• Name, email address, phone number, mailing address;
• Role (e.g., owner, property manager, contractor, tenant);
• Login credentials (e.g., hashed passwords);
• If applicable, business or organization name.

2.2 Property, Project, and Tenant Information

• Property addresses and details;
• Lease details, rental terms, unit identifiers;
• Tenant names, contact information, occupancy details;
• Project scopes, quotes, documents, and related notes.

2.3 Financial and Transaction Information

• Payment amounts, dates, and status (e.g., rent charges, fees, subscription fees);
• Partial payment method details (e.g., card type, last four digits, expiration month/year) as provided by Stripe;
• Bank-related tokens or identifiers provided by payment or banking data providers (e.g., Plaid) if enabled.

We do not store full payment card numbers on our systems. Payment card data is handled by Stripe and any other Payment Processor you authorize.

2.4 Usage Data and Technical Information

• IP address, browser type, and device identifiers;
• Pages and screens visited, features used, time and date of access.

2.5 AI Prompts and Outputs (Markus)

• Inputs you provide to Markus (e.g., natural-language questions or instructions, uploaded documents for analysis);
• Resulting AI-generated content (e.g., summaries, suggested maintenance tickets, draft communications, reports).

2.6 Communications

• Emails or messages you send to us (e.g., support requests, feedback);
• In-product communications between you and us (e.g., support chat, notifications).

2.7 Cookies and Similar Technologies

We use cookies and similar technologies to operate and improve the Service, remember your preferences, authenticate users, and measure usage. You may be able to manage cookies through your browser settings and any consent tools we provide.

3. How We Use Information

We use personal information for the following purposes:

• To provide and operate the Service. Including creating and managing accounts, authenticating users, handling permissions, and enabling property, project, and tenant workflows.
• To process payments. Using Stripe and other Payment Processors to collect subscription fees, rent, and other charges as directed by Users.
• To support AI Features (Markus). Including analyzing documents, generating summaries, logging maintenance requests, generating reports, and drafting communications.
• To communicate with you. Primarily through transactional communications, such as account notices, payment confirmations, service alerts, and support responses.
• To secure and improve the Service. Including monitoring usage, preventing fraud and abuse, debugging issues, and enhancing performance and reliability.
• To comply with legal obligations. Including responding to lawful requests, maintaining appropriate business records, and complying with applicable laws and regulations.

Where required by law, we rely on legal bases such as performance of a contract, legitimate interests, consent, and compliance with legal obligations.

4. AI Features and Data Use

4.1 Who Provides the AI

Markus runs on Claude models made by Anthropic, PBC, which we call through Anthropic’s commercial API under its Commercial Terms of Service. Anthropic is the only AI provider Markus uses. If we add another, we will name it here first.

4.2 What Markus Sends to Anthropic, and Why

Markus sends Anthropic only what the task in front of it needs. When you ask Markus something, it reads your records with the same access you have yourself. What is sent depends on the feature:

• Conversations with Markus (the Markus panel, the Markus page and the phone app): your message, the earlier messages in that conversation, the page you are on, the notes Markus has saved about your account, your Markus preferences, and the records Markus looks up to answer you, such as properties, units, tenants with their rent and payment history, transactions, repairs, inspections, appliances, projects, bids, team members, contractors, and the subjects and previews of messages sent to tenants. Purpose: to answer you and to propose changes that you confirm before anything is saved.
• Documents and files you hand Markus(for example leases, rent rolls, statements, photos, spreadsheets and PDFs): the file’s name and contents, any notes you add, and, when you hand it over in a Markus conversation, the names and addresses of your properties so Markus can match them. Purpose: to read the file and propose records for you to review.
• Morning briefing (for owners of properties in Victor): once a day, a snapshot of your account: your properties and their values, tenants with rent, lease dates and payment status, the last 30 days of transactions, open repairs with their cost estimates, overdue maintenance, failed automatic payments, change orders waiting on you, and the notes Markus has saved. If you turn on market updates, Markus may also run up to three web searches, through Anthropic, about the markets you named and where your properties are. Purpose: to tell you what needs attention today.
• Drafted replies to tenants(when drafting is on): the tenant’s name, the property, unit and lease dates, the owner’s or business name, open repair requests for that home, and up to the last 30 messages in that tenant conversation or repair thread, including the tenant’s own words. Purpose: to draft a reply for the property’s team. A person on the team reviews every draft, and nothing reaches a tenant until that person sends it.
• Projects and repairs:the job’s name, description, location, budget and dates, its scope items and prices, photos you attach, contractor bids (the contractor’s business name or email, line items, totals and notes), what you found when you raise a change order, the names of files on the job, and the accepted bid’s wording. Purpose: to scope work, compare bids, estimate change orders and draft contracts.
• Bookkeeping and history: the bank transactions you ask Markus to sort (date, payee, description, memo and amount), text you paste about past events, your property list and your category names. Purpose: to propose categories, properties and past records that you confirm.
• Settings in your own words: the sentence you type and your current view settings. Purpose: to change the setting you asked for.
• Feedback to the Victor team: the title, description and comments of feedback you send us. Purpose: to help our team group related feedback and write test steps.

4.3 How Long Anthropic Keeps It

Under Anthropic’s Commercial Terms of Service, Anthropic may not train its models on what we send it. Anthropic’s Privacy Center states that it deletes API inputs and outputs within 30 days of receiving or generating them, except where it must keep them longer to comply with the law, or to enforce its Usage Policy (inputs and outputs flagged as violating that policy are kept for up to 2 years, and safety classification scores for up to 7 years).

Separately, Victor keeps your Markus conversations, the notes Markus saves about your account, and Markus’s drafts in our own database, under the retention periods in Section 6.

4.4 Per-Customer Improvement Only

We design and operate AI Features with the following principles:

• Per-account context. We use your data to make Markus more helpful within your account (for example, recognizing your property names, common phrases, or communication templates).
• No intentional cross-customer training. We do not intentionally use your customer data to train generalized models across unrelated customers, except to the limited extent necessary to operate and secure the underlying AI infrastructure.

4.5 Opt-Out

You may request to opt out of per-account AI improvement using your historical data by contacting support@victormarkus.com. Opting out may reduce personalization or performance of AI Features. We may introduce in-product AI preference controls over time.

4.6 Sensitive Information

You should avoid including unnecessary sensitive personal information (such as Social Security numbers, protected health information, or highly confidential details) in AI prompts or uploads unless strictly necessary and permitted by law.

5. How We Share Information

We may share information with:

5.1 Service Providers and Subprocessors

Third-party service providers that process data on our behalf, such as:

• Supabase (hosted on AWS in the United States): database, authentication, file storage, edge functions;
• Vercel: hosting and delivery of our websites and the web app;
• Anthropic: the Claude models that power Markus (see Section 4);
• CloudConvert: making a readable PDF or CSV copy of office files you upload (such as Word, Pages or Excel files). CloudConvert’s privacy policy states that it deletes files within 24 hours at the latest;
• Resend: transactional email delivery;
• Stripe: payment processing for subscriptions, tenant payments and contractor payouts;
• Plaid: bank account linking and transaction sync, when you connect a bank;
• Google: address autocomplete, validation and geocoding, and Google Calendar when you book a call with our team;
• Expo, with Apple’s and Google’s push services: notifications to the Victor phone app;
• Other infrastructure providers we may add in the future.

5.2 Other Users Within Your Account Context

Depending on permissions and access you configure, information may be visible to other Users to whom you grant access (for example, property managers, contractors, or other individuals who have been given access to your properties or projects).

5.3 Business Transfers

In connection with a merger, acquisition, financing, or sale of all or part of our business, personal information may be transferred as part of the transaction, subject to confidentiality obligations.

5.4 Legal and Safety

We may disclose information if we believe it is reasonably necessary to:

• Comply with applicable laws, regulations, legal processes, or governmental requests;
• Protect the rights, property, or safety of the Company, our Users, or the public;
• Detect, investigate, and prevent fraud, security incidents, or abuse.

We do not sell personal information for monetary consideration. If we engage in conduct that constitutes “selling” or “sharing” personal information under any applicable law, we will provide appropriate notices and rights.

6. Data Retention

We retain personal information for as long as reasonably necessary to:

• Provide and maintain the Service for you;
• Meet our contractual, legal, tax, and accounting obligations;
• Resolve disputes and enforce our agreements;
• Support legitimate business needs (e.g., historical reporting, security logs).

In general, and subject to legal requirements and our Data Retention / Export / Deletion Policy:

• Account and profile data are retained for the life of the account and for approximately 3 years after account closure, unless earlier deletion is requested and permitted by law.
• Financial and transaction records are retained for at least 7 years from the date of the transaction, to comply with tax, accounting, and audit obligations.
• Property, project, and tenant records within an active account are retained while the account is active and for approximately 3 to 7 years after closure.
• Communications and support records are typically retained for approximately 3 years from the last interaction.
• System logs and security-related data are generally retained for approximately 12 to 24 months.

7. Your Rights and Choices

Depending on your jurisdiction and applicable law, you may have rights with respect to your personal information, including:

• Accessing or obtaining a copy of your personal information;
• Requesting correction of inaccurate information;
• Requesting deletion of certain information;
• Objecting to or restricting certain processing;
• Withdrawing consent where processing is based on consent.

You may exercise these rights by contacting us at support@victormarkus.com with sufficient detail to identify your account and request. We may need to verify your identity before responding.

If you are a tenant or other individual whose information has been entered into the Service by a User (such as a property owner or manager), we may need to direct you to that User, who may be the primary data controller, and/or coordinate with that User to process your request.

Some rights may be limited by applicable law or by our need to retain certain information for legal or operational purposes.

8. Security

We use reasonable technical and organizational measures designed to protect personal information from unauthorized access, use, or disclosure. These include the use of reputable infrastructure providers (such as Supabase/AWS and Stripe) and controls around authentication and access.

However, no system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your login credentials and for promptly notifying us of any suspected unauthorized access to your account.

9. Children’s Privacy

The Service is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take appropriate steps to delete it.

10. International Data Transfers

We are based in the United States, and the Service is intended for US Users. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

Where required by law, we will implement appropriate safeguards for such transfers.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last Updated” date and may provide additional notice (for example, by email or in-app notifications). Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acceptance.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact: