Privacy Policy

This Privacy Policy explains what information 50RH collects, how we use it, and who we share it with. It covers our website (50rh.com), the 50RH app (app.50rh.com), and the emails and links we send — including to contractors invited to bid and to tenants who receive an entry notice through the app.

50RH is a business service for property managers and building owners, but contractors and tenants meet it too. Section 1 is organized by who you are.

1. Information We Collect

Visitors to our website (50rh.com)

• Forms you fill in: when you request a demo, apply for the sensor beta, or contact us, we collect your name, email address, optional company name, the size of your portfolio, what you're interested in, and your message. Partner inquiry forms can also ask for your role, phone number, service area, services, certifications, and number of policyholders.
• Newsletter: your email address, if you subscribe in the site footer.
• How you found us: if the link you arrived from carries campaign tags (such as utm_source) or a Google Ads click ID, we keep them for your visit, along with the page you landed on, and attach them to any form you submit.
• Usage data: pages viewed, button clicks, when forms are started and submitted (not what you type), and device, browser and approximate location, through Google Analytics and Vercel Web Analytics. See Cookies and analytics.

Property managers, building owners and their teams (app.50rh.com)

• Account information: your name, email address, role, and password, which we store only as a bcrypt hash. If you sign in with Google or Microsoft, we receive your name and email address from them, plus an account identifier from Microsoft. We don't receive your Google or Microsoft password or access to your mailbox.
• Terms acceptance: when you accept our Terms, we record your name, email address, IP address, browser, the version you accepted, and when.
• Properties, units and residents: property names and addresses, unit numbers, and the tenant names and email addresses you add, whether typed in or imported from a rent roll.
• Jobs and bidding: job descriptions, the photos and documents you upload (such as bids, invoices and receipts), notes, milestones, bid requests, the bids you receive, and your approvals.
• Your contractor list: the contractors you add or import — company, contact name, email address, phone, trades, service area, certifications, license and insurance details, and whether they have a W-9 on file — plus your private notes and ratings.
• Owner reporting: the report narratives, contractor ratings and comments you write for building owners.
• Billing: your plan, unit count, subscription status, and a Stripe customer ID. You enter card details on Stripe's own checkout page; we never see or store your full card number.
• Settings and requests: notification preferences (such as time zone and quiet hours), alert recipients, and any feature request you send us, which records your name, email address, the page you were on, your IP address and your browser.
• Activity and security logs: sign-ins and sign-outs, and each request your signed-in browser makes to our servers — which page or action, when, your IP address, and your browser's user agent.

Contractors

• From property managers: when a property manager adds you to their vendor list, or imports their existing list, we receive what they enter: company and contact name, email address, phone, trades, service area, certifications, license number, insurance carrier and expiry date, whether you have a W-9 on file, and their private notes and ratings.
• From you: your bids (amount, scope, dates, notes, or your reason for passing), the before-and-after photos you upload, and any updates you make through a link a property manager sends you.
• Your shared profile: if you choose to share a profile, we store your contact name, trades, service area, license number, insurance carrier and expiry date, and whether you have a W-9 on file. Each time you turn sharing on or off, we record the date, your IP address and your browser.
• What we don't collect: W-9 forms, taxpayer identification numbers, Social Security numbers, or insurance certificate files. License and insurance details are what you or a property manager type in.

Tenants and residents

50RH has no tenant accounts. What we hold about you comes from the property manager who uses 50RH, and from your replies to the notices they send through it.

• From your property manager: your name and email address, and your home's address and unit number.
• What we send you: if your property manager schedules entry through 50RH, we email you the entry window, a summary of the work, the contractor's company name, and a link to respond. Your property manager may also send you a link to follow the job's progress.
• Your response: whether you approve, ask for a different time or decline, and any note you add. A note you give as access instructions (for example, a gate code or a pet) is shared with the contractor doing the work; a reason for declining is seen only by your property manager.
• Job photos: photos that property managers and contractors upload may show the inside of your home.

If sensors are installed in your building under our sensor beta, see our Tenant Privacy page.

Sensor beta participants

Sensor hardware is an unfinished, approval-only beta. Approved sensors send temperature, humidity, air-quality (VOC and CO₂-equivalent) and pressure readings, plus battery level, recorded against a unit rather than a person. To connect sensors, we store the Wi-Fi network name and password you provide for the building.

Business contacts we reach out to

We contact property management firms about 50RH using business contact details from public sources, such as the Oregon Real Estate Agency's licensee lookup and local rental-owner association directories. Reply to any of these emails and we'll stop.

2. How We Use Information

• To provide the service: accounts, properties, jobs, bids, notices, owner reports, and billing
• To send the emails the service depends on: sign-in and password emails, invitations, bid invitations and reminders, entry notices, job updates, bids-ready notices for owners, and alerts you set up
• To answer demo requests, inquiries and sensor-beta applications, send the newsletter you signed up for, and contact property management firms about 50RH
• To keep 50RH secure: preventing abuse, limiting repeated requests, investigating problems, and keeping audit records
• To understand and improve the website and app, using the analytics, session recordings and error reports described below
• To show market benchmarks in the app: we combine bid amounts across customers into price ranges only when there are at least 10 bids from 5 contractors across 3 property managers, so no single customer's or contractor's bids can be picked out
• To meet legal obligations and enforce our Terms

We do not:

• Sell your personal information
• Use your information to target ads to you
• Put advertising tags on our website or app. Microsoft Clarity does set Microsoft cookies that Microsoft uses for its own advertising; see Cookies and analytics.

3. AI Features

The app has three optional AI features, which a property manager chooses to use. Each one sends content to Anthropic, which generates the result:

• Describe from photos: up to four of the job's photos, through links that expire after five minutes, to draft a job description. Photos taken inside a home can show people and belongings.
• Rewrite for resident: the work summary the property manager wrote, or the job title, to draft a plain-language note for the tenant.
• Summarize bids: the bids' contractor company names, amounts and statuses, together with aggregate market figures.

We don't send your name, email address or account details with these requests. The result comes back to you and isn't saved unless you save it. We log that a request happened — the job, the number of photos, and whether it worked — but not the photos, the text, or what the AI wrote. Anthropic handles this content under its commercial terms, which don't allow it to train its models on our customers' content.

4. Who Sees Your Information

Other people using 50RH, as part of how it works

• Contractors invited to bid see the job details in the bid request. Bids are sealed: contractors don't see each other's bids. The contractor who wins the job receives the property manager's name and email address to reply to, and any access instructions the tenant gave.
• Tenants see their entry notice or progress page: the address, unit, entry window, work summary, the contractor's company name, and notes the property manager writes for them.
• Building owners see the reports, trends and owner-paid jobs for their properties, including contractor company names, bid amounts and scopes of work.
• Property managers who already have a contractor's email address in their own vendor list see that contractor's shared profile and a reliability badge — but only if the contractor chose to share. Shared profiles aren't public, listed or searchable.

50RH staff

Our staff can access account information to run the service and to support you, including viewing the app as a particular user sees it when helping that user.

Legal requirements and business transfers

We may disclose information when the law requires it, or when it's needed to protect the rights, property or safety of our users, the public, or 50RH. If 50RH is involved in a merger, acquisition or sale of assets, information may be transferred as part of that deal, and we'll tell you before it becomes subject to a different privacy policy.

5. Service Providers

We use these companies to run 50RH. They process information to provide their services to us, under their own privacy policies.

Two of these also use data for their own purposes. Microsoft uses Clarity's cookies, such as MUID, for its own advertising and analytics; see the Microsoft Privacy Statement. For Google Analytics, see How Google uses information from sites or apps that use its services.

6. Cookies and Analytics

What runs where

• On 50rh.com: Google Analytics, and Vercel Web Analytics. Vercel's doesn't use cookies; it counts visits with a code derived from each request that it discards after 24 hours.
• In the app: PostHog product analytics on most pages; Microsoft Clarity session recordings and heatmaps only on the dashboard and onboarding pages, with all on-screen text masked; Google Analytics only on the sign-up, onboarding and checkout-return pages, with Google signals and ad personalization turned off; and Sentry error monitoring throughout.
• Pages opened from a link we emailed — contractor bid and profile pages, tenant entry and progress pages, and invitations — never record your screen, and PostHog sends nothing from them, though it may still set its cookie. Error monitoring and server logs still apply.
• While a 50RH staff member is viewing the app as you to help you, PostHog and Clarity capture nothing.

Cookies

Analytics cookies are set on the whole 50rh.com domain, so they apply on both our website and the app. Checkout, and the billing page where you manage your subscription, are on Stripe's own site. Stripe sets its own cookies there under its privacy policy, so they aren't listed here.

The app also keeps some information in your browser's storage: your signed-in profile (name, email address, role and property names), your email address if you tick “Remember me”, and your analytics choice. The website keeps the campaign tags from your visit until you close the tab.

Your analytics choices

• In the app: turn on your browser's Do Not Track setting, or open app.50rh.com/?noanalytics=1 once, to stop PostHog and Clarity in that browser. ?noanalytics=0 turns them back on. This doesn't affect Google Analytics, error monitoring, or sign-in cookies.
• On 50rh.com: open 50rh.com/?noga=1 once to stop Google Analytics and Vercel Web Analytics in that browser. ?noga=0 turns them back on.
• Anywhere: install the Google Analytics Opt-out Browser Add-on, or block or delete cookies in your browser's settings.

Apart from honoring Do Not Track for PostHog and Clarity, we don't currently respond to browser privacy signals such as Global Privacy Control.

7. Data Security

• Everything is served over HTTPS, and browsers are told to use HTTPS only
• Passwords are hashed with bcrypt and never stored in plain text
• Sign-in cookies can't be read by scripts on the page. A sign-in lasts 24 hours, the token that renews it is replaced each time it's used, and you're signed out after 30 minutes of inactivity.
• Access is limited by role and by property: property managers see their own properties, owners see theirs, contractors see only their own bids, and tenants see only their own notice or progress page
• The links we email are long random codes. They lock after repeated failed attempts, and most stop working after a set time.
• Uploaded files are kept in private storage and shown only through links that expire after five minutes

No system is completely secure. If a breach affects your information, we'll notify you as the law requires.

8. Data Retention

• Accounts, properties and jobs: kept while the account is open, and after it closes until you ask us to delete them.
• When you ask us to delete your account: we delete it and what it holds, including uploaded files, activity logs, your terms acceptance and feature requests, and we delete your customer record at Stripe, which ends any subscription. Where your email address appears in our logs, such as our staff's record of changes to your account, we remove it. We keep only what we must for billing, tax, security or legal reasons: Stripe's records of your past payments and invoices, and a record that the deletion happened, without your name or email address. Anything you added to another customer's records, such as a report on a building you managed for them, stays with their records.
• Activity and security logs: the record of each request your signed-in browser makes — which page or action, when, your IP address and browser — is deleted after 90 days. Other records of account activity, such as sign-ins, changes to your account, and actions on jobs, are kept for 2 years to protect the service and investigate problems; we remove the IP address and browser details from them after 90 days.
• Notifications: our stored copies of the alerts and job updates we send, including their text, are deleted 30 days after they're sent.
• Uploaded files: kept with their job. Files whose job has been deleted are removed about 100 days later, and files uploaded but never saved to a job are removed after 7 days.
• Feature requests: kept until you ask us to delete them. The IP address and browser recorded with a request are deleted after 90 days.
• Backups: made nightly and kept for 30 days, so deleted information can remain in backups for up to 30 days.
• Sign-ins and links: expired sign-in sessions and password-reset links are deleted automatically. Contractor profile links last from 30 minutes (one you request yourself) to 30 days (one a property manager sends); tenant entry links work until 7 days after the entry window; progress links last 90 days. The IP address recorded when someone requests or sends a contractor profile link is deleted after 30 days.
• Contractor shared profiles: cleared as soon as you stop sharing. If no property manager on 50RH has you in their vendor list and you haven't used 50RH for 12 months, we clear your shared profile. We keep the record of your sharing choices.
• Tenant information: kept as part of your property manager's records while their account is open.
• Website inquiries and newsletter sign-ups: kept in our email and newsletter systems until you ask us to delete them or you unsubscribe.
• Analytics: Google Analytics keeps event data for 14 months. Microsoft Clarity keeps recordings for 30 days, and heatmap and click data for 9 months. PostHog and Sentry keep data under their own retention settings.

9. Your Choices and Rights

• Update your details: change your name and email address in the app's profile settings.
• Access, correct or delete: email privacy@50rh.com to ask for a copy of your information, or to have it corrected or deleted. We'll confirm your identity first, and we aim to respond within 30 days.
• Contractors: stop sharing your profile at any time from your profile page, which clears the details you entered. To be removed from a property manager's vendor list, ask that property manager, or us.
• Tenants: ask your property manager, or email us.
• Emails: unsubscribe from the newsletter using the link in any newsletter, and reply to any sales email to stop further ones. Emails the service depends on, such as password resets and entry notices, can't be turned off separately.
• Analytics: see Your analytics choices.

Depending on where you live, you may have other rights under state privacy law. We'll honor them as the law requires.

10. Children

50RH is a business service. It isn't directed to children under 13, and we don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

11. Where We Operate

50RH serves customers in the United States only, and our website and app aren't available to visitors outside it. We store your information in the United States. Some service providers may process it in other countries.

12. Changes to This Policy

We update this policy when our practices change. The effective date at the top of this page shows when it last changed. We'll tell account holders about significant changes by email or in the app.

13. Contact Us

Questions about this policy or how we handle information: privacy@50rh.com