Who is responsible
Isaac Lins, an individual based in Switzerland, runs Oakrule and is responsible for your data. Contact: [email protected]. This policy explains what we collect, why, who helps us, and your choices. It covers the website, the app, the API and our emails.
What we collect
- When you look up an address: the address you type, to find its city and state. For an address outside the addresses we have on file, it is sent to the U.S. Census Bureau's geocoder. We don't link lookups to you.
- When you ask a question (Ask): your question and the answer. The question is sent to Anthropic to word the answer. To review quality and safety, we keep a log of questions and answers with email addresses, phone numbers, street addresses and unit numbers removed. Please don't type names or other personal details into questions. If you share an answer, we keep that answer and its question as they are, so the link keeps working.
- When you sign in: with Google, your email address, your name and Google's account ID for you (no contacts, calendar or photos); with an email link, your email address. A sign-in link works once, for 15 minutes.
- What you save: each property's label and address, its city and state, and the building facts you enter (year built, number of units, whether the owner lives there). If you add them, the current rent and the date of the last increase, to work out the next allowed increase and notice dates. Also your alert settings, a private calendar link, and which alerts we already emailed you.
- Organizations: the organization's name, the people in it (email address and role) and pending invitations (the invited email address). An activity log shows the organization's owners and admins who did what and when (invitations, roles, buildings added, edited or deleted, imports, exports, sign-outs). It stores only internal numbers and roles, never addresses, rents or email addresses.
- When you import a spreadsheet: we read the file, check each address with the U.S. Census geocoder and keep the check for one hour. Only the rows you add are saved.
- When you join the waitlist: your email address, the plan, role and portfolio size you pick, and the link you came from. We count visits without cookies and without storing IP addresses: a visit is a scrambled code of the IP address and browser that changes every day.
- When you pay: Stripe collects your payment details. We keep Stripe's customer ID, your plan and the payment status, and receive your billing location for sales tax. We never see your full card number.
- When you use the API: the requests you make, counted per hour, to bill usage and prevent abuse. We store only a scrambled form of your API key, never the key itself.
- Technical data: like any website, our server and Cloudflare process your IP address, browser type and the pages you request, to deliver the site, limit abuse and fix errors.
What stays on your device. Your language, the date you picked and similar settings are kept in your browser's local storage. What you type into a letter or notice (names, unit, contact details) stays in your browser and is never sent to us.
What we don't collect. We don't ask for tenants' names, income, or anything else about the people who live in a building. We don't use analytics or advertising trackers.
Why we use it
- To give you what you ask for: answers, saved properties, alerts, letters and notices, the API.
- To keep the service secure and working, and to prevent abuse.
- To check and improve the quality of answers, using the log described above.
- To send the emails you turned on, and important messages about your account.
- To bill paid plans and keep the records the law requires.
We don't sell or rent your data, we don't share it for advertising, and we don't use it to train AI models.
Service providers
These companies help us run the service. They may use the data only to provide their service to us, under their data processing terms. Our own server is in Switzerland.
- Cloudflare
- What forDelivers the site securely and protects it against attacks.
- What they getYour IP address and technical data of each request.
- WhereWorldwide network, company in the U.S.
- What forSign-in, only if you sign in.
- What they getThe account details listed above.
- WhereU.S.
- Anthropic
- What forWrites the wording of Ask answers from the quoted law.
- What they getYour question and the rules we quote for it.
- WhereU.S.
- ElevenLabs
- What forReads answers aloud (Listen).
- What they getOnly the answer text we write. Nothing about you.
- WhereU.S.
- Resend
- What forSends sign-in links, invitations and the alerts you turn on.
- What they getYour email address and the message.
- WhereU.S.
- Stripe
- What forPayments, only if you buy a plan.
- What they getYour payment and billing details.
- WhereU.S.
- U.S. Census Bureau
- What forFinds the city and state of an address you type.
- What they getThe address only.
- WhereU.S. (a federal agency)
We will list a new provider here before we start using it.
International transfers
We are in Switzerland, and most providers above are in the United States. When data goes there, we rely on safeguards the law recognizes, such as the Swiss-U.S. Data Privacy Framework where a provider is certified, or standard contractual clauses.
How long we keep it
- Your account and saved properties: until you delete your account. Deletion is immediate.
- The Ask log (with personal details removed): up to 12 months.
- An organization's activity log: 12 months. If you delete your account, organizations you shared keep the entries but show you as a former member.
- The waitlist: until we launch or you leave it. If you ask us never to email you, we keep your address on a do-not-email list so that we never do.
- Server and security logs: a few weeks.
- Payment records: as long as tax and accounting law requires, usually 10 years under Swiss law.
Your choices and rights
- See the data we have about you, and correct it.
- Delete your account: in My properties, open the account menu and choose Delete account. Your account, properties and settings are deleted right away. Signing out does not delete anything.
- Ask us to delete anything else we hold about you, unless the law requires us to keep it.
- Get a copy of your saved properties.
- Turn off alert emails with one click in any alert.
- Object to a use of your data.
For anything not in the app, write to [email protected] from the email address of your account. We answer within 30 days. If you think we handle your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority where you live.
Children
The service is for adults. It is not directed to children under 13, and we don't knowingly collect their data. If you think a child has given us data, write to us and we will delete it.
Security
Connections are encrypted (HTTPS). The sign-in cookie is signed and can't be read by scripts on the page. Keys and passwords are stored apart from the code, with restricted access. We collect little, so there is little to lose. If a breach affects you, we will tell you as the law requires.
Changes
We may update this policy. The date at the top shows the latest version. We tell account holders by email before important changes.