Privacy Policy

1. Scope and privacy roles

TenantReach (formerly MercuryReach) is a communications platform operated by Mercurion Labs, LLC. This Privacy Policy applies when you visit tenantreach.app or mercuryreach.net, request or use a TenantReach workspace, contact support, submit beta feedback, or receive a communication sent through TenantReach.

A property owner, property manager, or other customer organization decides which contacts are placed in its workspace and which notices it sends. That organization is responsible for its recipient relationships, notice content, and lawful consent. Mercurion Labs, LLC operates TenantReach and processes that workspace information to provide the service.

2. Information we collect

Depending on how you interact with TenantReach, we may collect:

• Account and organization information: names, work email addresses, phone numbers, roles, property assignments, billing contacts, account settings, and authentication records.
• Recipient and consent information: names, mobile or landline numbers, property or group assignments, language and channel preferences, opt-in records, opt-out records, and suppression status.
• Communication information: message and call content, templates, replies, attachments, sender and recipient numbers, delivery status, timestamps, and provider identifiers.
• Operational information: audit history, support tickets, beta feedback, screenshots and files you choose to submit, billing status, and workspace configuration.
• Technical information: IP address, browser and device details, screen and viewport size, cookie or session identifiers, request logs, and security or rate-limit events.

3. How we use information

We use personal information to:

• Provide, secure, maintain, and troubleshoot TenantReach.
• Deliver SMS, voice, email, and in-product communications requested by a customer organization.
• Route replies, honor communication preferences, process opt-outs, and record delivery outcomes.
• Authenticate users, enforce permissions, prevent abuse, and maintain tenant boundaries.
• Provide support, investigate beta feedback, improve the product, and preserve required audit records.
• Administer billing, comply with law, and protect the rights and safety of users, recipients, and others.

4. Mobile information and SMS consent

We may disclose mobile information to telecommunications carriers and service providers that help deliver, secure, or support the messaging service, including Telnyx or Twilio. Those providers may use the information only to perform services for us or as required by law. We may also disclose information when legally required or when necessary to protect rights, safety, and service integrity.

5. SMS and voice notices

TenantReach customers may send property-related alerts, maintenance notices, safety updates, account or payment reminders, event information, and other operational communications. Marketing messages require any separate consent required by law and carrier rules.

• Message frequency varies based on the property, events, and the communications selected by the sender.
• Message and data rates may apply.
• Reply STOP to unsubscribe from text messages sent from that number.
• Reply HELP for help, or email help@support.mercuryreach.net.

Opting out of text messages does not automatically stop communications through other channels. Contact the organization identified in the notice if you need to change voice, email, postal, or other communication preferences. Carriers are not liable for delayed or undelivered messages.

6. How we share information

We may share information only as needed for the following purposes:

• Customer organizations: workspace owners and authorized users can access information within their permitted organization and property scope.
• Service providers: hosting, communications, email, translation, billing, storage, monitoring, security, and support vendors process information for us under service restrictions.
• Notice email: when an organization sends a notice by email, we send it through Resend, our email delivery provider. Resend receives the recipient's email address and the notice subject and wording, and reports back whether the email was delivered, bounced, or marked as spam. Every notice email includes a one-click unsubscribe link.
• Legal and safety: we may respond to lawful requests or protect users, recipients, the public, and the service from harm, fraud, or misuse.
• Business transactions: information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

Calendar connections

Google Calendar and Microsoft Outlook connections, including TenantReach Calendar, are optional. When enabled, you authorize your own provider account. We receive account identifiers, the permissions you grant, and access and refresh credentials, which we store encrypted to maintain the connection. Calendar connections do not give you access to another workspace or expand your existing permissions.

With your separate calendar-sync consent, we share eligible scheduled-notice text and recipient display names with your provider in a dedicated private calendar. We read calendar ownership and sharing information to check privacy, and event identifiers, versions, dates, times and recurrence to synchronize supported schedule changes. Calendar edits cannot create a notice or change its message, recipients or delivery channels. Deleting a provider event does not cancel the notice in TenantReach.

Disconnecting in calendar settings removes the local authorization grant and stops new calendar work. It does not erase existing provider copies or guarantee deletion from backups. You can also revoke the app’s access in your Google or Microsoft account. Minimal consent, operation and security audit records remain subject to the retention practices below.

Information received from Google APIs is used only to provide the calendar features you authorize, not for advertising or to train AI models. Its use follows the Google API Services User Data Policy, including the Limited Use requirements.

7. Tenant Assist and AI processing

Tenant Assist is an optional workspace feature. When a workspace uses it, we act as a processor for the customer organization and we use OpenAI as a sub-processor to generate replies, drafts, voice responses, Camera image proposals, and delinquency name-match suggestions. A workspace owner reviews and accepts the disclosure the first time the workspace opens Tenant Assist, and accepts the updated disclosure when its scope changes. Until then these AI features do not run.

The following leaves TenantReach and is processed by OpenAI:

• Requests and conversation: what an operator types into Assist and the recent turns of that conversation.
• Camera images: only after an operator selects Analyze image, the image and their instruction are sent to OpenAI. Images may contain resident or contact details. Temporary review text expires after one hour, and temporary images expire after at most 24 hours; scheduled cleanup removes expired files. An operator can explicitly retain a normalized image as an attachment to a confirmed record; that attachment follows the record’s access rules. Confirmed records and minimal execution receipts remain after the temporary review ends. Local deletion does not delete every copy a processor may retain under its policies.
• Workspace context: the operator’s first name and role, the workspace name, and the contact, property, or notice currently selected.
• Records Assist looks up: matching contact names and phone numbers, message history, groups, templates, and scheduled sends from that workspace, retrieved on request and within the operator’s existing permissions.
• Voice audio: when voice is used, microphone audio is sent from the operator’s browser to OpenAI and transcribed there.
• Message moderation: proposed outbound message wording is checked by OpenAI’s moderation service before Assist offers to send it.
• Delinquency comparisons: with AI enabled and the current disclosure accepted, preparing a preview automatically compares unresolved report names with a bounded set of candidate contact names from the same authorized property. This comparison omits raw files, financial columns, account numbers, units, addresses and phone numbers. AI flags possible name drift; suggestions remain excluded until an operator confirms a specific contact. Comparison failure leaves local matching available.

We instruct OpenAI to process this only to serve the request and not to train models on it. Free-text is screened for Social Security numbers, payment card numbers, and credentials before it is sent as conversation content. Contact details such as names, phone numbers, and email addresses are sent when they are part of a request or of a record Assist retrieves, because Assist needs them to do what was asked. Tenant Assist never sends a message, stores a record, or schedules anything without a person confirming it. See OpenAI’s privacy policy for how OpenAI handles information it processes.

Separately, Spanish translation of message content uses DeepL as a processor. Workspaces that do not use Tenant Assist or translation do not send content to either provider.

8. Retention, cookies, and security

We keep information for as long as reasonably necessary to provide the service, maintain message and consent records, resolve disputes, enforce agreements, satisfy legal obligations, and protect the service. Retention periods vary by information type and customer instructions. Deletion requests may be limited where records must be preserved for security, legal, billing, backup, or audit purposes.

TenantReach uses essential cookies and similar identifiers for authentication, session continuity, public demo limits, feedback protection, and security. We use administrative, technical, and physical safeguards designed to protect information, but no system can guarantee absolute security.

9. Your choices and rights

You may update account information through TenantReach where available. Recipients may reply STOP to opt out of text messages and may contact the sending property organization to request access, correction, deletion, or a change in communication preferences. Depending on your location, privacy law may provide additional rights. We may need to verify a request before acting on it.

TenantReach is intended for property operations and business users, not for children under 13. We do not knowingly collect personal information directly from children under 13 through the public website.

10. Changes and contact

We may update this policy as the service or legal requirements change. The date at the top identifies the current version. Material changes will be communicated through the website, product, or another reasonable channel.

Questions or privacy requests can be sent to help@support.mercuryreach.net. You may also contact the customer organization that sent a notice for questions about its contact list, consent record, or message.