Privacy Policy

1. Who we are and what this covers

Cornerhold (a working name) is operated by Lionary LLC, a California limited liability company ("we", "us"). This policy explains how we handle personal information when you visit our website, request access, create an account, or use the web application, the iPhone application, the API or the connector for AI assistants (the "Service").

Our customers are businesses, such as property owners, brokerages and property managers. When a customer puts information about other people into the Service, such as tenants, guarantors, vendors or owner clients, the customer decides how that information is used and we process it on the customer's behalf as its service provider or processor, under our agreement with the customer and the Data Processing Addendum. If you are one of those people, please contact the customer first; we will help them respond.

2. Information we collect

Information you give us

• Account information: name, email address, organization, role, and sign-in details such as a password (stored only as a salted hash) or a two-step sign-in setup.
• Requests and messages: what you send through our request and contact forms or by email, such as your company, portfolio size and the tools you use today.
• Customer Data: documents, leases, financial records, contacts and other content your organization uploads or creates in the Service.
• Billing information: when your organization subscribes, the billing contact, plan, invoices and payment history. Card and bank details are entered on and stored by our payment processor, Stripe; we receive only a reference to the payment method, its brand and last four digits, and payment outcomes.
• Support messages: what you send through the Get help form in the Service, with the page you were on.

Information collected automatically

• Log and device information: IP address, browser and device type, pages and features used, and error reports, kept for security and troubleshooting.
• Cookies and local storage: we use cookies that are needed to sign you in and keep your session secure, and local storage to remember preferences such as light or dark appearance. We do not use advertising cookies, and the website does not currently use third-party analytics.

Information from services you connect

If you sign in with Google or Apple, or connect a service such as QuickBooks Online, ChatGPT or Claude, we receive the information that service shares with your permission, such as your name and email.

3. How we use information

• To provide the Service: accounts, organizations, importing files, abstracting leases, accounting, reconciliations, portals and notifications.
• To perform AI features you use, as described in section 4.
• To keep the Service and its users safe: authentication, rate limits, abuse prevention, audit trails and investigating incidents.
• To reply to requests and support questions, and to send service messages such as security notices and changes to our terms.
• To understand and improve the Service using information about how it is used, in a form that does not identify you or any person. We do not use Customer Data to train machine learning models.
• To meet legal obligations and enforce our agreements.

4. AI features and AI subprocessors

Some features use machine learning models to read documents, extract terms, check figures, answer questions and draft text. To do that we send the needed content, such as the text and images of a lease or an invoice, or a question and the records needed to answer it, to AI providers that act as our subprocessors. They are listed, with their status, on our subprocessors page.

• We use these providers under terms that do not permit them to use the content we send to train or improve their models.
• Providers may keep inputs and outputs for a limited time for abuse monitoring, as their terms allow, and then delete them. Where a provider offers zero data retention to us, we use it.
• We send only what a task needs. AI outputs are shown as drafts until a person at your organization approves them.
• We do not use Customer Data to train our own models, and we do not use AI features to make decisions about individuals that have legal or similarly significant effects.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only:

• With subprocessors that host, operate and support the Service, such as hosting, email, payment and AI providers, under contracts that limit their use of it.
• At your organization's direction, for example with the tenants and owner clients it invites to a portal, or with services it connects, such as an AI assistant.
• When the law requires, to protect rights, safety and security, or to investigate fraud or abuse.
• With your consent.

Business transfers

If Lionary LLC is involved in a merger, acquisition, financing, corporate reorganization, bankruptcy or receivership, sale of all or part of its assets, or a transfer of the Service to an affiliate or to a new or existing entity that will operate it (including under a different name), personal information we hold, including Customer Data processed for our customers, may be transferred to the acquirer, affiliate or successor as part of that transaction. Any recipient will be bound to handle the information consistently with this policy and our agreements with customers. We will notify you by email or in the Service before or promptly after such a transfer, and tell you of any choices you have.

6. How long we keep information

We keep account information while your account is active, and Customer Data while the customer's organization is active. Requests sent through our website forms are kept while we are in touch with you and for up to two years after, unless you ask us to delete them sooner. Logs are kept for a limited period for security.

• Deleting your account. You are signed out everywhere and AI apps you connected lose access at once. Fourteen days later your account, sign-in methods, settings and private assistant conversations are deleted; until then you can sign in and cancel. Records you created inside an organization (for example a lease you entered or an approval you gave) belong to that organization and stay with it.
• Deleting an organization. An owner asks for it; the organization becomes read-only for 30 days, during which everyone can still sign in, read and export, and an owner can cancel. Then every record and every stored file of the organization is deleted, and its subscription is cancelled first.
• Exports. A full organization export is kept for 7 days, then deleted. A download of your own data is made when you ask for it and not kept.
• Backups. Encrypted backups are kept for up to 35 days and age out on their own; deleted data disappears from them by then.
• Billing records. Invoices and payment records are kept as long as tax and accounting law requires (generally up to seven years), by us and by Stripe, even after an organization is deleted.

7. Security

We protect information with safeguards described on our security page, including isolation of each customer's data with database row-level security and encryption in transit and at rest. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you and the relevant customer as the law requires.

8. Your choices

• You can review and update your account information in the Service. Download a copy of your personal data, or delete your account, in Settings, Your account (or in the iPhone app).
• You can turn off non-essential emails, such as getting-started tips, in Settings or with the one-click link in each such email. Service messages about security, billing and your account will still be sent.
• Your organization's owners and admins control Customer Data, including a full export (Settings, Data) and deletion, which only an owner can ask for.
• Our support staff can look inside your organization only while an owner allows it in Settings, Support access, for a set time. Every view is listed there for your organization to see.

9. California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended, gives you rights over personal information we handle as a business. In the last 12 months we have collected the categories below, from the sources and for the purposes shown. We disclose them for business purposes to the service providers described in section 5. We have not sold or shared personal information, and we do not knowingly collect personal information of anyone under 16.

You have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• ask us to delete it, subject to exceptions the law allows;
• ask us to correct inaccurate information;
• opt out of the sale or sharing of personal information (we do not sell or share it, and we treat a Global Privacy Control signal as a valid opt-out);
• limit the use of sensitive personal information (we use account credentials only to sign you in and keep your account secure);
• not be discriminated against for using these rights.

To make a request, write to privacy@cornerhold.com. We will verify your request by matching information you give us with what we hold, and respond within 45 days (or tell you if we need more time, as the law allows). You may use an authorized agent with your signed permission. For information a customer put into the Service about you, we will refer your request to that customer and help them respond. California's "Shine the Light" law does not apply because we do not share personal information with third parties for their direct marketing.

10. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

11. Where information is processed

We are based in the United States and process information in the United States. If you use the Service from elsewhere, your information will be transferred to the United States, and where the law requires, we use appropriate safeguards such as standard contractual clauses.

12. Changes to this policy

We will post changes on this page and update the date at the top. For material changes we will notify customers by email or in the Service before they take effect.

13. Contact

Privacy questions and requests: write to privacy@cornerhold.com. Lionary LLC, a California limited liability company.