Privacy Policy

1. Information we collect

We collect the following categories of information:

• Information you provide: name, work email, phone number, company name, number of properties, job title, and any details you include in forms or communications.
• Account & usage data: login records, pages viewed, features used, IP address, browser type, device identifiers, and timestamps.
• Property data: data you or your authorized systems push into Innrly from connected PMS, accounting, payroll, time clock, banking, and survey platforms.
• Communications: messages you send us by email, phone, SMS, or in-product chat, including any attachments.
• Cookies & similar tech: see Section 14.

2. How we use information

• Provide, operate, secure, and improve the Services.
• Authenticate users and prevent fraud or abuse.
• Respond to inquiries, schedule demos, and provide customer support.
• Send transactional messages (account, billing, security, service).
• Send marketing communications only where you have opted in, and let you opt out at any time.
• Comply with legal obligations and enforce our terms.

3. Legal bases for processing (GDPR / UK GDPR)

Where the GDPR applies, we rely on the following legal bases under Article 6: (a) performance of a contract; (b) compliance with a legal obligation; (c) your consent (which you may withdraw at any time); and (d) our legitimate interests in operating and securing the Services, balanced against your rights and freedoms.

4. SMS / text messaging (TCPA, A2P 10DLC)

If you provide a mobile phone number and check the consent box, you authorize Innrly to contact you by SMS at that number in response to your inquiry, possibly using automated means. Message and data rates may apply.

• Frequency: we limit messages to no more than 3 per week.
• Opt out: reply STOP at any time to unsubscribe. Reply HELP for help.
• No sharing: we do not share your mobile opt-in or phone number with third parties or affiliates for their marketing or promotional purposes. This information is used solely to communicate with you about Innrly.
• Consent is not a condition of purchase.

5. How we share information & subprocessors

We share information only as needed to deliver the Services and only with vendors who are bound by written confidentiality and data protection obligations. Categories of subprocessors currently include:

• Cloud hosting and infrastructure (e.g. AWS, Cloudflare).
• Email and SMS delivery (e.g. Resend / SendGrid, Twilio).
• Payment processing (e.g. Stripe), where applicable.
• Analytics and product telemetry (e.g. GA4, PostHog), where enabled.
• Customer support and CRM tooling.

A current, itemized subprocessor list is available on request at privacy@innrly.com.

We may also disclose information when required by law, in response to lawful requests, to protect rights and safety, or in connection with a corporate transaction (e.g. merger or acquisition) subject to confidentiality obligations.

6. We do not sell or share your information

Innrly does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the CPRA.

7. International data transfers

We are based in the United States and process information in the US. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses.

8. Data retention

We retain personal information only as long as needed for the purposes described in this policy. Indicative retention windows:

• Account & user records: for the life of your subscription, plus 90 days after termination to allow export.
• Property & transaction data: for the life of your subscription, then deleted within 30 days of contract end unless a longer period is required by law or your written request.
• Billing & tax records: 7 years, to meet US tax and accounting obligations.
• Marketing & lead records: 24 months from last interaction, or until you unsubscribe.
• Security & audit logs: 12 months, longer where needed to investigate an incident.
• Backups: rolling 35-day window; deleted records are purged as backups age out.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and continuous monitoring. No system is 100% secure; you are responsible for keeping your account credentials confidential.

10. Your rights (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland you have the right to access, rectify, erase, restrict, object to, and port your personal data, and to withdraw consent where processing is based on consent. To exercise these rights, contact privacy@innrly.com. You also have the right to lodge a complaint with your local supervisory authority.

11. California rights (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect, use, and disclose.
• Access and obtain a copy of personal information we hold about you.
• Correct inaccurate personal information.
• Delete personal information, subject to certain exceptions.
• Limit use of sensitive personal information.
• Opt out of sale or sharing of personal information. As noted in Section 6, Innrly does not sell or share personal information.
• Non-discrimination for exercising any of these rights.

Categories collected in the past 12 months: identifiers (name, email, phone), commercial information, internet/network activity, geolocation (approximate, IP-based), and professional information. Sources: directly from you, automatically via the Services, and from your connected systems. Purposes: as described in Section 2.

To exercise any right, email privacy@innrly.com. We will verify your request and respond within the timeframes required by law. You may also designate an authorized agent to act on your behalf.

Shine the Light (Cal. Civ. Code § 1798.83): we do not share personal information with third parties for their direct marketing purposes.

12. Other US state rights

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, among others, have rights similar to those described above, including the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling. Contact privacy@innrly.com to exercise these rights or appeal a decision.

13. Children's privacy

The Services are not directed to children under 16 and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

14. Cookies & tracking technologies

We use first-party cookies and similar technologies for essential site function, preference storage, and analytics. You can control cookies through your browser settings and through our cookie banner where required. See our Cookies Policy for details.

15. AI & automated decision-making

Innrly uses automation and machine learning to surface exceptions, summarize daily performance, and assist back-office workflows. These outputs support — but do not replace — human decision-making. We do not make decisions producing legal or similarly significant effects about you solely by automated means.

16. Do Not Track & Global Privacy Control

Our site does not respond to Do Not Track (DNT) signals because no industry standard exists. Where required by applicable law, we honor Global Privacy Control (GPC) signals as an opt-out of "sale" or "sharing" of personal information.

17. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a new "Effective" date and, where appropriate, notified to you by email or in-product notice.

18. Contact us

For privacy questions, requests, or to exercise any rights described above, contact: