Privacy policy

We collect only what is needed to bill you correctly and take your rent payment. In practice that is:

Account information. Your name, email address and — if you provide one — your phone number. Your account is created by the leasing office; you do not register yourself. We store your password only as a salted bcrypt hash and cannot read it.

Residency information. Your unit number, lease start and end dates, and the monthly charges attached to your unit — rent, trash, pest control, amenity fee, and your metered water usage in gallons.

Billing and payment records. Each statement and its line items, amounts paid, the card processing fee, payment status and timestamps. For card payments we store the card brand and the last four digits only, the Stripe payment and customer identifiers, and a link to your Stripe receipt.

Optional billing details. If you choose to bill your card to a different name or address than your account — a company card, a co-signer, a parent paying on your behalf — we store the billing name, email, phone and address you enter for that purpose. These fields are optional and blank unless you fill them in.

Security and activity records. An audit log of significant account actions — sign-ins, password changes, payments, statement changes — recording who acted, what changed, when, and the IP address the request came from. We also record the time of your most recent sign-in.

Cookies. Two, both strictly necessary and both set only after you sign in. One holds your session token and is httpOnly, so it cannot be read by scripts in your browser. The other holds routing hints — your role, name, email and whether you still need to set a password — so the portal can send you to the right screen. We use no advertising, analytics or third-party tracking cookies, and the portal is not indexed by search engines.

What we never receive. Your full card number, expiry date and CVC are entered directly into fields hosted by Stripe and sent from your browser to Stripe. They never reach our servers and we cannot see or store them. Bank account credentials are likewise never collected by us.

We use the information above to:

• Produce your monthly statement and calculate what you owe, including metered water.
• Take and settle your card payment, and apply it to the correct statement.
• Send you a payment receipt and, where needed, contact you about a payment or charge.
• Give you access to your own statements and payment history.
• Let the leasing office administer the property — recording payments taken at the office, correcting statements and managing leases.
• Detect and investigate fraud, disputed charges and unauthorised access, and keep an accurate audit trail.
• Meet our legal, tax and accounting obligations as a property manager.

We do not sell your information, rent it, or share it for advertising. We do not use it to build marketing profiles, and we do not use automated decision-making that produces legal effects about you.

We disclose personal information only to the parties below, only for the purposes described, and only to the extent each one needs it.

Stripe, Inc. — payment processing. When you pay by card we transmit your name, email address, billing address and phone number (where you have given them), the amount, and a description identifying your unit and statement period, over an encrypted server-to-server connection. Your card details go directly from your browser to Stripe and never through us. Stripe acts as an independent controller of the payment data it collects and handles it under its own privacy policy.

RPM Living LLC and the leasing office — property management. Authorised staff can see your account, statements and payment records through the management dashboard in order to run the property. Access is restricted to administrator accounts and every significant action is written to the audit log.

Hosting and infrastructure providers. The portal and its database run on Railway, and the database is operated as a managed service. These providers store the data on our behalf under contract and are not permitted to use it for their own purposes.

The property owner, and professional advisers. Aggregate and, where necessary, individual payment records may be disclosed to the owner of Liveway Lon Apartments and to our accountants and auditors, in connection with the operation and audit of the property.

Legal and safety disclosures. We may disclose information where we are required to by law, subpoena or court order, to establish or defend a legal claim, to collect a debt, or where we reasonably believe disclosure is necessary to prevent fraud or harm.

In a business transfer. If management of the property is transferred to another company, or RPM Living LLC is involved in a merger or sale, resident records may be transferred as part of that transaction. The receiving party remains bound by the commitments in this policy.

Method of disclosure. Disclosures to Stripe and to our infrastructure providers are made programmatically over TLS-encrypted connections. Disclosures to staff are made through authenticated, role-restricted access to the management dashboard. Disclosures to advisers, the owner or legal authorities are made in writing, limited to what the recipient requires.

We maintain the following safeguards:

• Encryption in transit. All traffic to the portal and the API is served over HTTPS/TLS, including every request to Stripe. The portal sends HSTS headers in production.
• Card data isolation. Card numbers are captured by Stripe-hosted fields and never traverse or rest on our systems, which removes the largest category of risk entirely.
• Password protection. Passwords are hashed with bcrypt using a per-user salt and a work factor of 12. Plaintext passwords are never stored or logged. New passwords must meet minimum length and complexity rules.
• Session security. Sessions use short-lived signed tokens held inhttpOnly, secure, SameSite=Lax cookies, so they are not readable by browser scripts. Changing your password immediately invalidates all existing sessions.
• Access control. Residents can reach only their own lease, statements and payments; every request is re-authorised on the server. Management functions require a separate administrator role.
• Brute-force protection. Repeated failed sign-in attempts from the same address are rate-limited, and sign-in responses do not reveal whether an email address has an account.
• Audit logging. Sign-ins, password changes, payments and statement changes are recorded with the actor and IP address, so unauthorised activity can be traced.
• Webhook verification. Payment confirmations from Stripe are accepted only when their cryptographic signature verifies, which prevents forged payment notifications.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by Texas and federal law.

We keep statements, payment records and audit logs for as long as you are a resident and afterwards for as long as required for tax, accounting, audit and limitation periods — generally seven years. Account records are retained while your lease is active and for a reasonable period afterwards. When information is no longer needed we delete it or irreversibly anonymise it.

You can view your statements and payment history at any time in the portal, and you can change your password and your billing details yourself. To request a copy of the information we hold about you, to correct it, or to ask us to delete information we are not required to keep, contact us using the details below and we will respond within the time the law allows.

Texas residents may have additional rights under the Texas Data Privacy and Security Act, including the right to confirm whether we process your personal data, to obtain a copy of it, to correct it, to request deletion, and to appeal a refusal. We do not sell personal data or process it for targeted advertising, so there is nothing to opt out of in those categories.

The strictly necessary cookies described above cannot be turned off without preventing sign-in, because they are what keeps you signed in.

The portal is intended for adult leaseholders. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided information to us, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. If a change materially affects how we use your information, we will tell you through the portal or by email before it takes effect.

Questions about this policy, or about your information, go to the leasing office:

RPM Living LLC — Liveway Lon Apartments
5649 Bois D Arc Rd
McKinney, TX 75071
support@livewaylonapartments.com
(469) 213-8800 · Monday to Friday, 9:00am to 6:00pm Central