Privacy Policy

01What this covers

This policy covers elysianproperty.co and the Elysian Management client portal. It describes what we actually collect and store, not what we might collect one day.

Information an association gives us under a signed management agreement is handled under that agreement and the association’s own governing documents, not this policy.

02What the inquiry form collects

The inquiry form on the front page asks for the following, and stores exactly these fields along with the date and time you submitted them:

• Whether you are a board member, an owner, or something else
• Your name
• Your email address
• Your phone number, if you give one
• The building address, if you give one
• The number of units, if you give one
• What you tell us is not working

03Why we collect it

To read your inquiry, work out whether we are a sensible fit for your building, and reply to you.

Submitting the form also confirms receipt to you by email and adds your address to our mailing list, which we use to write to people who have asked about management. The form says so beneath the send button. Every message carries an unsubscribe link, and leaving the list does not affect an inquiry already in progress.

We do not use any of it to build a profile, score you, or feed an advertising system.

04What a portal account holds

If we create a portal account for you, it holds your name, email address, role, and phone number if you have given one.

We store a bcrypt hash of your password, never the password itself, so no one at Elysian can read or recover it. Invitation links are stored only as a SHA-256 hash of the token, so a copy of our database yields no usable invite link.

Portal access is role-scoped: what you can see depends on whether you are an administrator, owner, tenant, or vendor.

05What we do not do

This is worth stating plainly, because it is unusual:

• No analytics. There is no Google Analytics, Plausible, PostHog, or equivalent on this site.
• No advertising or social pixels of any kind.
• No tracking cookies, and no cookie banner, because there is nothing to consent to.
• No selling or renting your information, ever, to anyone.
• No sharing it with anyone for their own purposes. The processors named below act on our instructions and for no one else.

06Cookies

The marketing pages set no cookies at all.

Signing in to the portal sets one session cookie, which is what keeps you signed in as you move between pages. It is removed when you sign out. There are no other cookies.

07Third parties that necessarily see something

Three providers receive information as a consequence of the site working at all, and we would rather name them than imply nothing leaves our hands:

• Railway hosts the site and its database on servers in the United States. Their systems process what you submit in order to store it.
• Brevo sends our email and holds our mailing list. When you submit the form, your name, email address, phone number, building address, and unit count are passed to Brevo so it can confirm receipt to you and keep you on the list. Brevo is based in France and acts only on our instructions.
• Google Fonts serves the typefaces. When your browser fetches them it sends Google your IP address and user-agent string. This happens on every page load, before you interact with anything.

08How long we keep it

We should be honest about this rather than quote a policy we do not yet enforce: inquiries are kept until you ask us to delete them. There is no automatic expiry at present.

Defining a retention period, and deleting inquiries from associations we never worked with, is outstanding work rather than a decision we have made against.

09Your choices

Write to privacy@elysianproperty.co to ask what we hold about you, to correct it, or to have it deleted. We will respond within 30 days.

You do not need an account and you do not need to give a reason. If you ask us to delete an inquiry, we delete the record rather than flagging it as hidden — from our database and from Brevo both.

To stop the mail but keep your inquiry, use the unsubscribe link in any message. That is one click and needs no reply from us.

10Security

Traffic is served over TLS. Passwords are bcrypt-hashed, invitations are single-use and stored only as hashes, portal routes are gated by session, and access is scoped by role.

No system is perfectly secure, and we will not claim otherwise. If you believe you have found a vulnerability, report it to us rather than testing how far it goes.

11Children

This site is aimed at property owners and board members. It is not directed at children, and we do not knowingly collect information from anyone under 16.

12Changes to this policy

We may update this policy. The "last updated" date above changes when we do.

If a change affects what we collect or how long we keep it, we will describe the change rather than quietly reissue the page.

13Contact

Questions, requests, or complaints: privacy@elysianproperty.co.