Privacy Policy

Tusk ("Tusk," "we," "us," or "our") provides a compliance and renewal tracking platform for property management teams (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the rights you have regarding it. By using the Service, you agree to the practices described below.

Information We Collect

• Account information: your name and email address, used to identify you and communicate with you.
• Property and compliance data: property names, addresses, unit counts, and compliance record details you create, including categories, issue and expiration dates, renewal history, notes, and any documents you upload (such as certificates, permits, or insurance policies).
• Team and organization data: information about your organization, team members you invite, their roles, and which properties they're assigned to.
• Payment-related metadata: limited billing information such as subscription status, plan type, and renewal dates. Tusk does not collect or store full payment card numbers — see "Payment Processing" below.
• Usage data: basic log data such as sign-in events and feature interactions, used to operate and secure the Service.

How We Use Your Information

• To provide and maintain the Service, including displaying your portfolio and compliance records.
• To send automated compliance reminders and overdue escalations based on the thresholds your organization configures.
• To operate authentication, sessions, and access controls so only authorized team members see your organization's data.
• To process payments and manage subscriptions through our payment processor.
• To provide customer support and improve the Service.

Legal Basis for Processing

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, we process your personal data on the following legal bases:

• To perform the contract with you — we process your account, property, and compliance data to provide the Service you signed up for.
• Based on our legitimate interests — we use basic usage and log data to operate, secure, and maintain the Service, such as managing sessions and preventing unauthorized access.
• To comply with a legal obligation — for example, retaining certain billing records as required by tax or accounting law.

Third-Party Service Providers

We rely on the following third-party providers to operate the Service. We do not sell your personal information to any third party.

• Base44 (application platform and infrastructure): Base44 hosts the Service, provides our database, authentication system, file storage for uploaded documents, and our transactional email delivery. Base44 processes data on our behalf as our infrastructure provider.
• Creem (payment processor): Creem is our payment processor and merchant of record, handling checkout, subscription billing, and payment method storage. See "Payment Processing" below.

If we add or change service providers that process personal data in a materially different way, we will update this Privacy Policy.

Payment Processing

All payments are securely processed by Creem, our payment processor and merchant of record. When you subscribe, your payment card details are entered directly into Creem's secure checkout and are never transmitted to or stored on Tusk's own servers. Tusk retains only limited billing metadata necessary to operate your subscription, such as your subscription status, plan type, and renewal date. For details on how Creem handles your payment information, please refer to Creem's own privacy policy.

AI Processing

Tusk's current features do not use artificial intelligence to process your account, property, or compliance data as part of the live Service. If we introduce AI-powered features in the future that process your data (for example, to assist with document analysis or data entry), we will update this Privacy Policy to describe how that data is used before such features are enabled.

Data Storage and International Transfers

Your data is stored on secure cloud infrastructure provided by Base44. Each organization's data is logically isolated and accessible only to its own team members based on their assigned roles. Uploaded documents are stored in managed object storage and linked to the relevant compliance records.

Because our infrastructure and processors may operate in different countries, your data may be transferred internationally, including to the United States. Where this happens, we use appropriate safeguards — such as standard contractual clauses or equivalent mechanisms recognized under applicable law — to help ensure your data receives a comparable level of protection wherever it is processed.

Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If your account is deleted, or if you are the last member of an organization and that organization is deleted, we remove the associated property assignments, notification preferences, and user record from our active systems. Property and compliance records tied to a deleted organization are also removed. Backup copies of data may persist for a limited period after deletion (typically no longer than 30 days) as part of routine infrastructure backup cycles before being permanently purged; we do not use backup data for any purpose other than disaster recovery during that window. Certain billing records may be retained longer where required by tax, accounting, or other legal obligations.

Your Rights

You have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Correction: request that inaccurate or incomplete data be updated.
• Deletion: request that your account and associated data be deleted.
• Export and portability: download a copy of your data in a structured, machine-readable format.
• Object or restrict: object to or request that we restrict certain processing based on legitimate interests.
• Lodge a complaint: you have the right to lodge a complaint with the data protection supervisory authority in your country of residence if you believe your personal data has been processed unlawfully.

You can download your data or delete your account at any time from the Settings page within the app. To exercise other rights, contact us using the details below.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we collect, use, and disclose, as described in this Privacy Policy.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information — Tusk does not sell or share your personal information, so there is nothing to opt out of.
• Right to limit use of sensitive personal information — Tusk does not collect sensitive personal information as defined by the CCPA/CPRA beyond what is necessary to provide the Service.
• Right to non-discrimination for exercising any of these rights.

California residents may exercise these rights using the same contact details and account tools described in "Your Rights" above. You may also designate an authorized agent to make a request on your behalf.

Children's Privacy

The Service is intended for use by property management professionals and is not directed to, marketed to, or intended for use by children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us using the details below.

Cookies and Sessions

We use essential session cookies and authentication tokens to keep you signed in and secure. We do not use advertising or cross-site tracking cookies. Session data is removed when you log out.

Security

We use industry-standard administrative, technical, and physical safeguards to protect your data, including: encrypted connections (HTTPS/TLS) for all data transmitted between your browser and our servers; authentication controls including secure password handling and email verification; and role-based access controls that ensure users can only access data belonging to their own organization and appropriate to their assigned role (admin or manager). Despite these measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

User Responsibilities

You are responsible for ensuring you have the necessary rights and permissions to upload or submit any documents, records, or personal information through the Service — including personal information about third parties (such as tenants, vendors, or employees) that may be contained within compliance documents you upload. You agree not to submit information you do not have the legal right to share.

Business Transfers

If Tusk is involved in a merger, acquisition, reorganization, or sale of some or all of its assets, your information may be transferred as part of that transaction. We will notify you (for example, via email or a notice on the Service) before your personal data becomes subject to a different privacy policy as a result of such a transaction.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will update the "Last updated" date above when we do, and for material changes, we will provide additional notice, such as an email or an in-app notification. Continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at support@jointusk.com.