Information We Collect
We collect information directly from you, automatically through your use of our platform, and from property management operators managing your residential or commercial unit.
A. Information Provided Directly by Users
- Property Management Operators:Name, business email address, company name, phone number, billing address, account login credentials, and payment metadata (processed securely via our third-party payment processor, Stripe).
- Residents and Tenants:Full name, phone number, email address, physical property address, unit number, lease/occupancy context, maintenance issue descriptions, uploaded images, video recordings, and audio voice memos detailing property repair requests.
- Vendors and Contractors:Contractor or business name, trade specialty, contact person name, mobile telephone number, business email address, physical address, Certificates of Insurance (COI), policy numbers and limits, taxpayer identification numbers (TIN/EIN) via IRS Form W-9, submitted repair bids, invoices, and photo documentation of completed work.
B. Information Collected Automatically
- Device and Usage Data:IP address, browser type, operating system, referring URLs, access timestamps, and interactions with our application interface.
- Communications Metadata:Timestamps, delivery receipts, SMS delivery statuses, and inbound/outbound email routing headers processed via our communications infrastructure.
How We Use Your Information
MainTriage does not sell your personal information. We use the collected data strictly for the following operational, contractual, and legitimate business purposes:
Maintenance Triage & Dispatch
Processing tenant repair requests, classifying trade categories (e.g., plumbing, electrical, HVAC), determining issue urgency, routing work orders to approved vendors, and delivering job dispatch magic links.
AI & Multimodal Processing
Using AI models (such as Google Gemini) to extract structured triage data from photos, voice notes, and text descriptions. Customer data is processed strictly within enterprise-grade, zero-data-retention AI pipelines and is never used to train public foundation models.
Warranty Recall Detection
Vectorizing maintenance records in high-dimensional vector spaces to detect recurring equipment defects and protect property operators from redundant billing within warranty windows.
Compliance & Legal Auditing
Creating immutable cryptographic audit trails (SHA-256 hashes) of contractor insurance validity (COI) and tax credentials (W-9) under Federal Rule of Evidence 803(6) to protect property operators against liability.
Platform Security & Reliability
Monitoring system uptime, debugging application errors, training proprietary internal operational algorithms, and protecting against denial-of-service, SMS toll fraud, and unauthorized platform access.
Transactional Communications
Sending transactional service notifications, maintenance status alerts, dispatch links, and administrative updates.
Mandatory Mobile and SMS Privacy Disclosures
MainTriage utilizes Short Message Service (SMS) to deliver operational alerts, maintenance updates, and vendor dispatch magic links.
“No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates under any circumstances.”
This exclusion applies unconditionally to all mobile numbers, originator opt-in records, and text messaging records across the MainTriage ecosystem.
Terms of SMS Messaging
Program Description
MainTriage SMS notifications provide real-time updates regarding submitted maintenance requests, scheduling confirmations, vendor dispatch alerts, and emergency triage communications.
Opt-In Requirement
Users must provide affirmative, express opt-in consent to receive SMS communications. Opting in to SMS messaging is entirely voluntary and is not a condition of receiving property maintenance or accessing the MainTriage web application.
Message Frequency
Message frequency varies depending on the volume, severity, and status updates of active maintenance requests.
Rates & Carrier Charges
Message and data rates may apply depending on your mobile carrier and rate plan.
Opt-Out Instructions (STOP)
You may revoke consent and cancel SMS notifications at any time by replying STOP to any text message received from MainTriage. After texting STOP, you will receive one final confirmation message confirming cancellation.
Customer Support (HELP)
For assistance, reply HELP to any message or contact our support team directly at support@maintriage.com.
How We Share and Disclose Information
We do not sell, rent, monetize, or trade your personal information. We disclose data solely as necessary to operate our service:
Property Operators and Landlords
Tenant maintenance tickets, vendor invoices, repair photos, and status histories are shared directly with the property manager or landlord responsible for the unit.
Assigned Contractors
When a work order is dispatched, relevant tenant contact details (name, phone number, address) and issue descriptions are provided to the designated contractor solely to facilitate the repair.
Service Providers and Infrastructure Partners
We share data with verified third-party cloud infrastructure providers who assist in operating MainTriage under strict confidentiality agreements:
Legal and Regulatory Disclosures
We may disclose information if required by law, subpoena, or legal process, or to establish or exercise our legal rights and defend against legal claims.
Security and Cryptographic Protection
MainTriage implements defense-in-depth, zero-trust security safeguards:
Envelope Encryption
Sub-account integration credentials and sensitive API tokens are protected via Application-Layer Envelope Encryption using Google Cloud Key Management Service (Cloud KMS) Hardware Security Modules (HSMs). Plaintext keys are encrypted with ephemeral Data Encryption Keys (DEKs) using AES-256-GCM authenticated encryption.
HMAC Signatures
Vendor magic links and inbound webhooks utilize HMAC-SHA256 signatures with constant-time verification (crypto.timingSafeEqual) to eliminate replay and timing side-channel attacks.
In-Transit & At-Rest
All data transmitted across public networks is encrypted using TLS 1.3. Persistent database records and file storage buckets are encrypted at rest with AES-256 standard encryption.
Data Retention and Deletion
Operational Data
We retain maintenance records, invoices, and communication histories for as long as the property management client maintains an active account with MainTriage.
Legal & Tax Records
Pursuant to IRS tax compliance and legal safe-harbor standards (FRE 803(6)), contractor W-9 records, invoices, and insurance liability snapshots are archived for up to seven (7) years following contract termination.
Transient Data
Edge cache records and ephemeral verification tokens stored in Upstash Redis expire automatically within sliding windows of 15 minutes to 90 days.
Your Privacy Rights (CCPA / CPRA & State Laws)
Depending on your state of residence (including California, Virginia, Colorado, and others), you may have the following statutory rights regarding your personal information:
- Right to Know / Access:Request details regarding the categories and specific pieces of personal information collected about you.
- Right to Delete:Request deletion of your personal information, subject to statutory legal and tax record retention exemptions.
- Right to Correct:Request correction of inaccurate personal information.
- Right to Non-Discrimination:MainTriage will never discriminate, deny services, or alter pricing because you exercised your privacy rights.
- Right to Opt-Out of Data Sales / Sharing:Because MainTriage does not sell personal information or share it for cross-context behavioral advertising, we do not require an opt-out mechanism for sales.
“Privacy Rights Request”.Children's Privacy
MainTriage is designed exclusively for commercial and residential adult operators, residents, and licensed contractors. We do not knowingly collect personal data from individuals under 18 years of age. If we learn that personal data of a minor has been collected, we will take immediate steps to delete the information.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our operational workflows, technological infrastructure, or legal obligations. We will notify registered account holders of material updates via email or prominent platform notices. The “Last Updated” date at the top of this policy reflects the date of latest revision.
Contact Us
If you have questions, comments, or concerns regarding this Privacy Policy or our privacy practices, please contact us at:
MainTriage (HiLvlDigital LLC)
Attn: Legal & Privacy Department
Email: legal@maintriage.com / support@maintriage.com
Website: https://maintriage.com