MaintFolio Privacy Policy

1. The short version

2. Who this policy covers

This policy applies to maintfolio.com, the MaintFolio web application, and our emails.

It covers two kinds of people:

• Owners — individuals who create or claim a portfolio for their own home, vehicles, and equipment.
• Pros — realtors, inspectors, contractors, property managers, and other professionals who use MaintFolio to create and gift portfolios to their clients.

Where a Pro enters information about a client before that client has claimed a portfolio, §7 explains how we treat it.

3. Information we collect

3.1 Information you give us

Account information. Name, email address, password (stored hashed — we never see it), and optionally a phone number and profile photo. For Pros: business name, logo, business phone, website, service specialty, and license number where you choose to provide it.

Portfolio content. This is the substance of the product, and it can be detailed:

• Property addresses, year built, square footage, and floor plans or reference photos you upload
• Assets and their attributes — make, model, serial number, purchase date, purchase price, warranty terms, filter sizes, paint colors, fluid types
• Vehicle information including VIN, mileage, and service intervals
• Equipment and personal property, including recreational gear
• Service history: what was done, when, by whom, and what it cost
• Documents you upload to the Vault — receipts, warranties, manuals, permits, inspection reports, insurance declarations
• Photos of assets, rooms, and serial plates

Payment information. Payments are processed by Paddle. Paddle receives your card details directly; we never receive or store full card numbers. We retain the last four digits, card brand, expiry, billing name, billing address, and transaction history.

Communications. Emails you send to support, and messages you send through in-app forms.

3.2 Information we collect automatically

• Usage data: pages viewed, features used, tasks completed, timestamps, referring URL
• Device data: IP address, browser type and version, operating system, screen size, language
• Email delivery: whether a message was delivered, bounced, or unsubscribed from
• Cookies and similar technologies: see §9

3.3 Information from other sources

• From a Pro. If a professional builds a portfolio for you, we receive whatever they entered about your property and its systems before you claimed it. See §7.
• From your smart home devices. If you connect a SmartThings account, we receive status and readings from the devices you link — for example leak, smoke and temperature sensors — and show them in your portfolio. We do not control those devices and cannot change their settings.
• From documents you upload. When you use Magic Inspection Upload or the AI Vision Scanner, we extract structured data (makes, models, serials, ages, recommended tasks) from the file or photo you provide. A document you upload may also name other people — for example, the inspector who prepared a report. We store that information as part of your record, use it only to show you where the record came from, and do not contact those people or use their information for any other purpose.
• Public and government data sources. Vehicle recall data from the National Highway Traffic Safety Administration (NHTSA); product recall data from the U.S. Consumer Product Safety Commission (CPSC). We query these sources using information from your portfolio. Neither agency endorses or is affiliated with MaintFolio.

4. How we use information

We use your information to:

• Create and operate your portfolio, and store the documents you upload
• Generate maintenance schedules and reminders based on asset type, age, and usage
• Send you reminders, recall alerts, warranty expiration notices, and service confirmations
• Match your assets against NHTSA and CPSC recall data
• Extract asset details from inspection reports and serial-plate photos
• Generate exports, logbooks, and reports you request
• Process payments, manage subscriptions, and prevent payment fraud
• Provide support and respond to your messages
• Understand which features are used so we can improve them
• Detect abuse, enforce our Terms, and protect the security of the service
• Comply with legal obligations

Legal bases (where applicable): performance of our contract with you; your consent for optional marketing email; our legitimate interests in securing and improving the service; and compliance with law.

5. What we do not do

We commit to the following, and we consider these binding:

• We do not sell personal information, as "sell" is defined under the California Consumer Privacy Act or any comparable state law.
• We do not share personal information for cross-context behavioral advertising, and we do not run advertising on the service.
• We do not use your uploaded documents, photos, or portfolio content to train artificial intelligence models, ours or anyone else’s. Our AI vendors are contractually prohibited from training on data we send them.
• We do not give Pros access to portfolio data they did not originate.
• We do not sell or rent Pro client lists, and we do not market our own services to a Pro’s clients on the basis of that relationship.
• We do not read the contents of your Document Vault except as strictly necessary to deliver a feature you invoked, to respond to a support request you initiated, or where required by law.

6. Artificial intelligence processing

Several features send content to third-party AI providers for processing:

Current AI subprocessor(s): Google (Gemini models) and OpenAI, accessed through the Lovable AI gateway. Content is transmitted encrypted, processed to return a result, and is subject to the vendor’s zero-retention or limited-retention terms. We do not permit training on your content.

AI output can be wrong. Extracted details should be checked against the source document, and recall matches for appliances and equipment are probabilistic — see §14.

7. Gifted portfolios and the Pro relationship

This is the most unusual data flow in MaintFolio, so we describe it in full.

7.1 Before you claim a portfolio

A Pro can build a portfolio about a property and send you a claim link. Until you claim it:

• The Pro controls that data and is responsible for having a lawful basis to enter it. Our Terms require Pros to have your permission before entering your personal information.
• We store it on the Pro’s behalf and use it only to operate the service and deliver the claim invitation.
• The invitation email and the claim page both include a decline option. You do not need an account to use it.
• Declining stops us contacting you. We remove your email address from the invitation and add it to our do-not-email list, which blocks further messages about the invitation and prevents that professional inviting that address again.
• Declining does not remove the professional’s own records. They keep the client entry they created — the name, email, phone, address and notes they entered — and the portfolio they built, including the property details. That is their record of their own client, and declining does not erase it. If you want it removed, ask them directly, or email support@maintfolio.com and we will handle it under §12.
• The professional is told that the invitation was declined, and when. They are not told why, and they cannot ask.
• Our record that the invitation email was sent keeps your address until it is anonymized at 24 months. See §11.

7.2 After you claim it

Ownership of the portfolio transfers to you. From that point:

• You control the portfolio, its documents, and who else may see it.
• The Pro retains an "originator" association with the specific assets and records they created. This is what powers the "Provided By" card and the Preferred Pro contact.

7.3 What a sponsoring Pro can and cannot see

A Pro can see: the assets and service records they originated; whether and when you claimed the portfolio; how many times your portfolio has been opened and when it was last opened; and whether you contacted them through the app.

A Pro cannot see: your System Health score; your tasks, their status, or whether you have completed any; your inspection tasks or whether you resolved them; assets you added yourself; documents in your Vault; photos you upload; your service history with other providers; your other properties or vehicles; or the contents of any report you did not share with them.

During an approved service visit. If you grant a professional service access to a specific item, they can view and update that item and the records attached to it — its details, tasks, documents, parts and upgrades — while the access lasts for 24 hours. The access covers only the item you approved, nothing else in your portfolio, and it ends by itself. Unlinking them ends it immediately. Everything above still applies the rest of the time.

7.4 Unlinking a Pro

You can unlink a sponsoring Pro from your portfolio at any time, from Settings. When you do:

• Their branding is removed from your view.
• They stop receiving new activity signals about you. New views, contact clicks and website clicks are no longer recorded, your last-active signal stops, you drop out of their quarterly recap, and they can no longer request service access. Any service access they already had ends immediately.
• Signals recorded before the unlink stay in their history. We do not delete what was already recorded, so they can still see past views, past contacts, and whether and when you claimed the portfolio.
• They keep a record of which assets they delivered to you — names and types only — together with the originator association behind the "Provided By" card. They cannot see the contents of those assets, or anything else in your portfolio.
• They keep their own copies of any documents they delivered to you, held in their own account. See §11.
• For a short time after an unlink, a file they had already opened may still load from a link their browser holds — up to 24 hours for a photo or floor plan, and two minutes for a document. Documents are checked against your permissions every time they are opened, so once you unlink, a document cannot be opened again.

If you want the originator record erased entirely, email support@maintfolio.com and we will delete it, subject to any records we must keep for tax or legal reasons.

7.5 Email from Pros

Reminder emails relating to assets a Pro originated may carry that Pro’s branding. These are service messages about your portfolio, sent by us — not marketing sent by the Pro, and not a transfer of your email address to them. You can turn off co-branding by unlinking the Pro, and you can switch reminder categories on or off in Settings.

7A. Household members

You can invite another person to share your Personal portfolio as a household member.

A household member has full access to the homes you share. They can see and change your items, tasks, documents and photos, and anything they add becomes part of your portfolio. They cannot see your Life documents, anything on your Business side, or your billing.

They receive their own copies of your reminder emails, sent to their own address.

Removing a household member ends their access immediately. It does not reach an export they already ran — see §11.

If you delete your account, every household member is emailed to say the household has ended, and loses access at once.

8. Who we share information with

We share information only with service providers who help us operate MaintFolio, and only for that purpose. Our current subprocessors:

We will keep this list current.

Affiliate links. Some product links in MaintFolio are Amazon affiliate links. We log that a link was clicked so we can see whether the feature is used. We do not send Amazon any of your personal information — clicking a link takes you to Amazon, where their own privacy practices apply.

Service Directory. Professionals listed in the Service Directory are independent third parties. We do not give them your information. If you choose to contact one through the app, we transmit only what you send. Saving a vendor to your list does not disclose anything to that vendor.

We may also disclose information:

• When you direct us to — for example, using Smart Transfer to hand an asset’s history to a buyer, sharing a portfolio with a household member, or generating a seller’s report you distribute
• For legal reasons — to comply with a valid legal process, enforce our Terms, or protect the rights, safety, or property of any person. We will notify you of a legal demand for your data unless we are legally prohibited from doing so.
• In a business transfer — if MaintFolio is acquired or merged, your data may transfer to the successor, who will be bound by this policy or a materially equivalent one. We will notify you before your data becomes subject to a different policy.

9. Cookies and tracking

We use almost no cookies. The only cookie we set remembers whether the side menu on your dashboard was open or closed. Nothing about you travels in it.

Everything else is kept in your browser’s local storage on your own device: your sign-in session, your light/dark appearance choice, which workspace (Personal or Business) you were in, and similar display settings. These stay on your device and are not sent to us except as part of the requests the app normally makes when you use it. We set no advertising cookies and no third-party analytics cookies, because we have no advertising and no third-party analytics.

MaintFolio has no advertising trackers and no third-party analytics, and we never sell or share your personal information. That means there is nothing for a Global Privacy Control (GPC) signal to opt you out of in the usual sense.

We go one step further anyway. When your browser sends GPC, we also switch off our own optional usage analytics: we stop recording which features you open and which product links you click. We keep only one thing about it — a daily count of how many browser sessions had GPC on, with nothing attached that identifies you. Error reports and what the service needs to work (signing in, saving your records) continue as normal.

10. Security

• Data encrypted in transit (TLS) and at rest
• Row-level security in the database, so one account cannot reach another’s records
• Documents stored in encrypted object storage with access controls
• Encrypted daily backups of the database, retained 14 days (uploaded files are not included — see Terms §8)
• Passwords hashed; we cannot recover them
• Access to production data restricted to personnel who need it, and logged

No system is perfectly secure. If a breach affects your personal information, we will notify you without unreasonable delay and no later than 30 days after determining a breach occurred, consistent with Washington law, and we will notify the Washington State Attorney General and any other required regulator within the timeframes the law requires. Our notice will describe what happened, what information was involved, and what you can do.

Your part. Use a unique password and enable two-factor authentication when available. Do not upload government identification numbers, financial account numbers, or health records — MaintFolio is not designed to safeguard those categories.

11. How long we keep information

What we keep after you delete your account

A small amount of information survives, either because we are required to keep it or because removing it would break something for someone else:

• Billing and transaction records, for 7 years.
• If you had unsubscribed, bounced or declined a gift invitation before deleting, your address stays on our do-not-email list so that choice is still honored. Deleting your account does not by itself add you to that list — if you sign up again later, you will hear from us normally.
• Copies in encrypted database backups, until they cycle out within 14 days.
• Sign-in and email delivery logs held by our providers, under their own retention.
• The record a professional keeps of work they performed for you, described in §7.4.

Copies other people hold

Deleting your account removes your data from MaintFolio. It does not reach copies other people already have, and we cannot retrieve them.

• A household member who ran an export while they had access holds the real files from the homes you shared — documents, inspection reports and photos, not just a list. That export is on their own device. It survives you removing them and you deleting your account. It does not include anything from your Life documents, which household members cannot read.
• A professional who delivered documents to you keeps their own copies in their own account. Those survive you deleting the original, unlinking them, and closing your account. Only they can delete them.
• Anything you shared outside MaintFolio — a report you sent, a record you handed to a buyer — is wherever you sent it.

If a deletion does not finish

Deletion runs immediately when you confirm it. Very occasionally a step does not complete, most often removing your sign-in record. When that happens we tell you so on the confirmation page rather than reporting success, the account is queued for us to finish by hand, and we complete it as soon as we can. Your portfolio content is removed either way.

12. Your rights and choices

Regardless of where you live, you can:

• Export everything. Full backup export including uploaded files, from Settings, free, on every plan.
• Correct any information, by editing it directly.
• Delete your account and its data from Settings, or by emailing support@maintfolio.com.
• Choose which emails you get. Email alerts and both kinds of reminder start on, and you can change them in Settings. We send task reminders when something is due or overdue, notices before warranties and renewals expire, and a seasonal checklist in spring and fall. When nothing is due but tasks are still overdue, we send a list of them on a weekday, at the frequency you choose. Possible recalls appear in the app, not by email. When a reminder email is already going out, it carries a line saying how many possible recalls are flagged on your items. You can turn email alerts off entirely, switch either kind of reminder off on its own, or change how often the overdue task list arrives — weekly, every two weeks, or monthly. Billing and security notices cannot be disabled while your account is open.

Depending on your state — including under the Colorado Privacy Act, the California Consumer Privacy Act as amended, and comparable laws in Virginia, Connecticut, Utah, Texas, Oregon, Montana, and others — you may also have the right to confirm whether we process your data, access it in a portable format, correct or delete it, and opt out of sale, targeted advertising, and profiling with legal effects. We do not sell data, do not conduct targeted advertising, and do not engage in profiling of that kind, so those opt-outs have nothing to apply to, but the right exists.

To exercise a right, email support@maintfolio.com. We respond within 45 days and may extend once by another 45 where permitted, with notice. We may need to verify your identity, usually by confirming control of your account email.

Appeals. If we decline a request, our response will explain why and how to appeal. To appeal, reply to that response or email support@maintfolio.com with "Appeal" in the subject line. We will respond within 45 days. If we deny the appeal, you may contact your state’s attorney general. By default, that is the Washington State Attorney General at atg.wa.gov/file-complaint.

Authorized agents may submit requests with written proof of authorization.

Non-discrimination. We will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.

13. Children

MaintFolio is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children under 13. If we learn we have, we delete it. If you believe a child has provided us information, email support@maintfolio.com.

14. Recall data disclaimer

Recall information comes from NHTSA and CPSC published data. Vehicle matching uses the year, make and model you enter, or the ones decoded from your VIN. Appliance and equipment matching is probabilistic — it compares your asset details against recall notices and may produce both false matches and missed matches.

MaintFolio is not a safety monitoring service. Always verify a recall directly with the manufacturer or the issuing agency using your serial number, and do not rely on MaintFolio as your only source of safety information. Neither agency is affiliated with or endorses MaintFolio.

15. Users outside the United States

MaintFolio is operated from and hosted in the United States, and is intended for U.S. users. We do not market the service in the European Economic Area or the United Kingdom, and it is not designed to meet the requirements that apply there. If you access it from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

16. Changes to this policy

We will post any change here and update the "Last updated" date. For material changes — particularly anything narrowing the commitments in §5 — we will notify you by email at least 30 days before the change takes effect, so you have time to export your data and close your account if you disagree.

17. Contact

MaintFolio LLC
A Washington limited liability company
support@maintfolio.com

Postal correspondence: contact us by email for our mailing address.