Privacy Policy
How Ledger, eBerry's property management portal, handles your information.
This policy covers the Ledger portal at app.ebberry.com, operated by eBerry (Elijah Berry), Vashon Island, Washington. It applies to applicants, tenants, owners, and anyone else who uses the portal.
What we collect
- Applicants. Name, email, phone, current address, employer, monthly income, number of occupants, desired move in date, and any note you add on an application. If your application goes through screening, we also keep the screening checklist and outcome.
- Tenants. Everything collected as an applicant, plus payment records, autopay enrollment details, messages between you and your manager, maintenance requests (including any photos related to them), and security deposit records.
- Owners. Your contact details, monthly statements, distribution records, and the properties and units you own.
- Manager and staff accounts. An account record and an entry in the audit log for actions you take.
- Mobile app users. A device push token, so the app can notify you, for example about an approval waiting on you.
Why we collect it
To run the tenancy or ownership relationship: bill and collect rent, process payments, track maintenance, produce statements, meet Washington landlord tenant requirements, and let you reach your manager, or your tenants, directly.
Who processes it
Ledger uses a small set of outside services to do this work. Each one is off until eBerry has configured it; if one isn't configured, that feature simply doesn't run.
- Stripe processes rent, deposit payments, and autopay. Ledger never sees or stores your full card or bank account number.
- QuickBooks Online is the accounting system of record for owner and manager books.
- Resend delivers email: receipts, notices, and marketing email you've opted into.
- Twilio delivers text messages, where you've opted in.
- Amazon S3, Cloudflare R2, or local disk storage holds uploaded documents and photos: leases and maintenance photos.
- Anthropic powers the in app assistant and reads vendor bills to pull out line items. It does not see payment card data.
- Expo delivers push notifications to the mobile app.
- Sentry receives error reports so we can fix bugs. It does not receive payment card data.
Cookies and tokens
Signing in to the web portal sets one cookie: a signed session cookie that expires after 8 hours, marked HttpOnly, Secure, and SameSite=Lax, so it can't be read by scripts or sent cross-site. The mobile app also holds a refresh token that keeps you signed in for up to 30 days. It rotates every time it's used, and reusing an old one signs out every device on that account, since that is a sign the token may have been stolen. Ledger sets no analytics or advertising cookies.
Marketing email tracking
If you've subscribed to hear about new vacancies, our emails include an open pixel and links that record a click, so we know what's useful. Unsubscribing is one click, always honored, and we never re-add an address to the list ourselves. We do not sell your information, run ads, or track you across other websites.
How long we keep it
Financial records and the audit log are kept for 7 years by default; this period is pending confirmation by counsel. If you apply and are not approved, your screening data is kept only as long as required under the Fair Credit Reporting Act and RCW 59.18.257, then deleted; the exact schedule is pending confirmation by counsel.
Your rights
You can ask us to show you, correct, or delete the information we hold about you by emailing ebberry@gmail.com. We will act on it unless we're required to keep something longer by law, for example tax or landlord tenant recordkeeping rules. You can unsubscribe from marketing email at any time with the link in the email.
Security
Every table in the database enforces row level access control, so an owner only ever sees their own data and a tenant only sees their own. Traffic to the portal is encrypted in transit. Every consequential action is written to an append only, tamper evident audit log.
If something goes wrong
If we learn of a breach involving your personal information, we will notify you as required under Washington's breach notification law, RCW 19.255.
Children
Ledger is not directed to, and is not knowingly used by, anyone under 18.
Changes to this policy
We may update this policy as the portal changes. The date below shows the last update.
Contact
Questions about this policy: ebberry@gmail.com.
Last updated: September 21, 2026.
This is a draft, prepared for attorney review. It is not yet final legal advice or a finished policy.