Privacy policy

01 Who this covers

This policy applies to FASHTI LLC, a limited liability company registered in California, referred to here as Fashti, we or us. It covers personal information we handle through the website at fashti.co and through the Fashti platform.

It is written for three groups of people: visitors to this website, staff at the property businesses that use our platform, and the residents and applicants whose information passes through the platform while we act on a property business's instructions.

02 Our two roles

The distinction below determines who is responsible for what, so it is set out before anything else.

As a controller. For this website and for our own commercial relationships, we decide why and how personal information is used. That covers enquiries sent through our contact form, correspondence with prospective and current customers, and the administration of our business.

As a processor. When the platform handles information about residents, applicants, contractors and other individuals on behalf of a property business, that business decides why and how. We act on their documented instructions under a written agreement. If you are a resident or an applicant, your relationship is with the property business that manages your home, and they are the first place to go with a request about your information.

03 What we collect

From website visitors

• What you send us. If you use the contact form, your email client sends us the name, work email, company or portfolio name, optional phone number, portfolio size, role, systems in use and the message you write.
• Basic technical information. Standard server records generated when a page is requested, including the request time, the page requested and a truncated network address. We use these to keep the site working and secure.

This website does not use advertising cookies, third party analytics trackers or social media pixels. We do not build visitor profiles and we do not sell or share information for cross context behavioural advertising.

From customer staff

• Name, work contact details, role and the permissions assigned to the account.
• Records of actions taken in the platform, for the audit trail your employer relies on.
• Correspondence with us about the service, including support requests.

Processed on behalf of our customers

• Contact details and enquiry content for prospects and applicants.
• Tenancy information: unit, term, rent, dates, payment status and related correspondence.
• Messages exchanged through connected email, messaging and web channels.
• Maintenance reports, including any photographs a resident chooses to send.
• Where a customer's process requires it, references to identification and income documents held in that customer's own storage.

04 How we use it

As a controller, we use personal information to respond to enquiries, to provide and administer the platform, to maintain security and investigate misuse, to improve the reliability and quality of our service, to keep records required for accounting and legal purposes, and to send operational messages about the service to customer staff.

We do not sell personal information. We do not use it for advertising. We do not use data processed on behalf of one customer for the benefit of another, and we do not combine customers' data into a pooled benchmarking or market intelligence product.

As a processor, we use personal information only to perform the agreed workflows for the customer who instructed us, and for no other purpose.

05 Why we are allowed to

Where a legal basis must be identified, we rely on the performance of a contract with you or your organisation, our legitimate interests in operating and securing our business where those interests are not overridden by your rights, compliance with legal obligations, and consent where consent is the appropriate basis and has been given.

Where we act as a processor, the legal basis for the underlying processing is determined by the property business that instructed us.

06 Who we share it with

We share personal information only in the following circumstances.

• Service providers. A small number of suppliers who help us run the platform, principally cloud infrastructure, language model providers, and email and messaging services. Each is bound by contract to use the information only as instructed and to protect it appropriately.
• Our customer, where we act as a processor. Information processed on behalf of a property business is available to that business, which is the point of the service.
• Legal requirements. Where disclosure is required by law, by a court, or by a valid request from a public authority. Where we are permitted to tell you about such a request, we will.
• Business transfer. If our business or its assets are acquired, information may transfer as part of that transaction, subject to the protections in this policy.

A current list of the suppliers who may process customer data, with what each is used for, is available to customers and to prospective customers under a confidentiality agreement.

07 Automated processing and language models

The platform uses large language models to interpret inbound messages and to draft replies. Three points matter.

• No training on your content. We use commercial providers under terms that exclude training on customer content, and we do not train or fine tune models on customer data.
• Minimum necessary context. A model receives the message being handled and the specific portfolio context required to answer it, not a customer's wider database. Identification documents, bank details and payment credentials are not placed into model context.
• Decisions about people remain human. The platform does not approve or decline a tenancy application, issue a notice, or make any decision producing a legal or similarly significant effect on an individual. It gathers information, checks it against criteria the property business has set, and presents a recommendation to a person who decides.

08 How long we keep it

Enquiries sent through this website are kept for as long as needed to respond and to maintain a record of the conversation, and are then deleted. Records relating to customer relationships are kept for the duration of the relationship and for the period afterwards required for accounting, tax and legal purposes.

Information processed on behalf of a customer is retained for the period set in that customer's agreement, which reflects their own obligations. On termination we provide an export and then delete our copies on the agreed schedule, except where we are required by law to retain something for longer.

09 Your rights

Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy of it, to have inaccurate information corrected, to request deletion, to limit or object to certain processing, and to receive your information in a portable format. You also have the right not to be discriminated against for exercising these rights.

California residents have specific rights under the California Consumer Privacy Act, as amended. We do not sell personal information and we do not share it for cross context behavioural advertising, so there is nothing to opt out of in those respects. You may exercise your other rights using the contact details below. We will verify your identity before acting on a request, which may mean asking for information to confirm who you are.

We respond to rights requests within the period required by applicable law, and without charge unless a request is manifestly unfounded or excessive. You may use an authorised agent, in which case we will ask for proof of authorisation.

10 If you are a resident or an applicant

If you are renting a home, applying for one, or reporting a repair, and you have been in contact with an assistant identifying itself as Fashti, your information is being processed on behalf of the property business that manages that home. That business decides what is collected and why.

Please direct requests about your information to that business in the first instance. If you contact us instead, we will tell you who to approach and pass your request on to them promptly rather than leaving it unanswered.

You can ask to speak with a person at any point in a conversation with the platform, and that request is always honoured.

11 Security

We encrypt personal information in transit and at rest, restrict access on a least privilege basis, hold credentials in a dedicated secret store, and log access to customer data. Our staff do not have standing access to customer operational data, and access granted for support is time limited and recorded.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify the affected parties and any regulator as required by applicable law, and without undue delay. Our wider security practices are described on the security page.

12 Children

Our website and platform are intended for use by businesses and by adults transacting with them. We do not knowingly collect personal information from children under sixteen. If you believe a child has provided us with personal information, contact us and we will delete it.

13 Changes to this policy

We may update this policy as the service or the law changes. The date at the top of this page shows when it was last revised. Where a change materially affects how we handle personal information, we will tell affected customers directly rather than relying on this page alone.

14 Contacting us

For any question about this policy, or to exercise a right described in it, write to hello@fashti.co or to FASHTI LLC, 8601 Glenoaks Boulevard, Apt. 211, Sun Valley, California 91352, United States. You may also call (562) 200-4654.

If you are not satisfied with our response, you may complain to the data protection or consumer protection authority in your jurisdiction. We would appreciate the chance to resolve the matter with you first.