Privacy Policy

Effective: 2026-10-22. Last updated: Oct 26, 2026 (co-tenants, payer on payments, linked bank account details, renters insurance and public listing pages).

Lockstead is a property operations product for rental property owners and operators. It is operated by Lockstead LLC, a limited liability company formed in Kansas, USA. This policy explains what personal information we collect through lockstead.io and the Lockstead application, how we use it, and how you can ask us to delete it.

Information we collect

• Account details. The name, email address, phone number and password credentials you give us when you create an account or are invited to one.
• Property and tenancy records you enter. Properties, units, leases, tenants, rent and payment records, maintenance requests and the notes and documents you attach to them. This includes the names and contact details of every tenant on a lease, including co-tenants, which tenant made each payment, and the renters insurance details and documents entered for a lease.
• Public listing pages. When a landlord publishes a listing, the content they choose to show on its public page, such as the unit description, photos, rent and contact details, is visible to anyone with the link.
• Phone numbers and email addresses for notifications. The contact details you or your tenants provide so that we can send the reminders and updates the account is set up to send.
• Rental applications. When an applicant applies for a unit, the details they enter: name, contact details, date of birth, address history, employer and income, and any documents they upload. If the landlord orders a screening report, we keep its status and the landlord's recommendation, not the report itself, which stays with TransUnion SmartMove.
• Owner tax details. Where a landlord records an owner's tax information for year-end reporting, the owner's taxpayer identification number (SSN or EIN), which we store encrypted and show only by its last four digits.
• Conversations with Stead. The questions you ask the assistant, its answers, and files you attach to a conversation.
• Sign-in and security data. If you sign in with Google or your organisation's single sign-on, the name and email address the provider shares with us. If you turn on two-factor authentication, the secret for your authenticator app, stored encrypted. An audit log of significant actions taken in a workspace.
• Usage logs. IP address, browser and device information, the pages and API routes requested, and timestamps. These are written automatically when you use the service.

How we use it

• To provide the service: to show you your portfolio and to keep your records available to you.
• To send the notifications an account is configured to send, by SMS or email: rent reminders, late rent notices, lease renewal reminders and maintenance updates.
• To keep the service secure and working: to investigate errors, abuse and unauthorised access.
• To process the rent payments an account collects.
• To reply to you when you write to us.

We do not use your records, or the contact details in them, to advertise to you or to anyone else. We do not sell your personal information, and we do not use it to train third-party AI models without your explicit consent.

Messages to tenants and owners

When a customer uses Lockstead to message their tenants and owners, we process those people's names and contact details as the customer's service provider, only to send those messages and to show the customer what happened to them.

For email we send on a customer's behalf, we record for each recipient when it was sent, delivered or bounced, when it was opened, and when the recipient followed the link in it to view the message. We show this to the customer. "Opened" is approximate: some email apps load images automatically, which counts as an open when nobody read the email, and others block images, which hides a real open.

SMS and opt-in data

Consent to receive text messages, and the phone numbers that consent applies to, are used only to deliver the messages described above. See the Terms of Service for the full SMS terms, including how to opt out.

Who else sees it

We use service providers to run the product: hosting and infrastructure, email delivery, payment processing, error reporting, and an SMS provider that carries our messages to the mobile networks. They receive only what they need to perform that work for us, and they are not permitted to use it for their own purposes. When you ask Stead, our AI assistant, a question, the question and the workspace records needed to answer it are sent to Anthropic, the provider of the AI models Stead uses, and text you choose to hear in a studio voice is sent to Google Cloud Text-to-Speech. Files you attach to a conversation are sent to Anthropic with your question. If you connect a third-party AI agent or application to your workspace, it receives the data you authorise it to access, under its own terms, and you can revoke that access at any time. We may also disclose information where the law requires it, or to protect the service and its users against abuse.

These are the service providers (subprocessors) that process personal information on our behalf. We update this list before we add a new one.

Payment and identity data

Rent payments are processed by Stripe, which acts as a payment processor and subprocessor for this data. Card numbers and bank account numbers are entered directly with Stripe and are never sent to, or stored on, Lockstead's systems. What we keep is the record of a payment: its amount, date, method, status, and Stripe's identifiers for it, and the tenant who made it.

When a tenant links a bank account for autopay through Stripe Financial Connections, Lockstead keeps only the bank's name and the last four digits of the account, so the tenant can see which account is used. Lockstead never stores full account numbers; Stripe holds them. We email the tenant a copy of their bank-debit authorisation.

Connecting a Stripe account to collect rent requires Stripe to verify your identity, which is a legal requirement for handling payments. Stripe collects that information from you directly, and it can include legal name, date of birth, home address, a government identification number such as an SSN or EIN, and bank account details. Lockstead does not receive or store it; we see only whether Stripe has verified the account and whether it can accept payments and pay out.

Tenants who pay rent through Lockstead have their payment details handled by Stripe on the same basis. We store the resulting payment record so the landlord's ledger is accurate.

Retention and deletion

We keep account details and the records you enter for as long as your account is active. When an account is closed we deactivate it and keep its data in a restricted archive, so it can be restored. We delete it permanently when you ask us to. Usage logs are kept for a shorter period, long enough to investigate errors and security events, and are then discarded. Backups are rotated on their own schedule, in an encrypted archive with restricted access, so a deleted record can persist in a backup for up to 180 days after it disappears from the product, and is then gone from every copy.

Some records are deleted on a fixed schedule. Messages between a landlord and a tenant are kept for as long as the tenancy lasts and for 3 years after it ends. In-app notifications are deleted 90 days after they are read, and no later than one year after they were created. Conversations with Stead, the assistant in the product, are kept for 365 days after the last message and are then deleted. Files attached to a conversation are kept for 30 days. Deleting your account also deletes your conversations. Email delivery records are kept for 365 days after the email was sent. A tenant message that was not sent is kept for 180 days once it has been handled. Signed-out or expired sessions are deleted 30 days later. When an application is declined, withdrawn or lapses, its supporting documents are deleted 90 days later, and the applicant's name, contact details and the rest of the application are erased 365 days later. An approved application becomes part of the tenancy record and follows that record's retention. Sign-ups to our launch list that were never confirmed are deleted after 30 days. Records of what a demo visitor viewed are kept for 90 days.

You can export your personal information as a JSON file, or delete your account, at any time from the privacy page of your account settings. If you are the only admin of a workspace, add another admin first, or email us to close the workspace and delete its records. Deleting your account erases your personal information and signs you out. You can also ask us to delete your account and the personal information in it by emailing [email protected]. We may need to keep a minimal record of the request itself, and anything we are separately required to keep.

Your choices

• Reply STOP to any text message from us to stop receiving them. Reply HELP for help.
• Use the unsubscribe link in a notification email, or write to us, to stop those emails.
• Ask us for a copy of the personal information we hold about you, or ask us to correct it.

If you live somewhere with privacy laws such as the GDPR or the CCPA, those laws give you further rights, including the right to object to processing and to complain to your local data-protection authority.

Cookies

We use first-party cookies to keep you signed in, and your browser's own storage to remember preferences such as your theme and the workspace you have open. We do not use third-party advertising cookies. Our bot-protection and payment providers may set cookies they need for security when you use their part of a page, such as a sign-up check or a checkout. Clearing cookies signs you out and resets those preferences.

Children

Lockstead is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13.

Changes to this policy

This policy will change as the product does. When it changes we will post the new version on this page and move the date at the top. If a change materially affects how we handle information you have already given us, we will tell account holders by email.

Contact us

Privacy questions and deletion requests: [email protected].
Security reports, including a vulnerability you have found: [email protected].
Anything else: [email protected].

Lockstead LLC, 12644 S Benedict St, Olathe, KS 66061, USA.