Privacy Policy

This policy applies to two distinct groups:

Applicants

Renters who connect a bank account to generate an affordability report at the request of a property manager, landlord, or leasing agent (“Operators”).

Operators

Property managers, landlords, leasing platforms, and their employees who use our dashboard or API to request and review reports.

From applicants

• Identity: legal name, email address, phone number, and the address you are applying to rent.
• Bank credentials: handled only by our regulated banking-data provider — Pimetric never sees or stores your username or password.
• Bank data: a read-only feed of transactions, balances, and account metadata covering up to 24 months, retrieved through that provider.
• Device & usage: IP address, browser type, pages viewed, and a session identifier to keep your application secure.

From operators

• Account details: name, work email, company, role, and billing information.
• Property metadata: addresses, rent amounts, and applicant identifiers tied to each report you request.
• Audit trail: every report request, decision, and adverse-action notice generated through your account.

We use the information above to:

• Generate an affordability report (the CashScore) for the operator who initiated it.
• Verify the applicant's identity and prevent fraud.
• Operate, maintain, and improve our service — including model accuracy.
• Comply with applicable law, including the Fair Credit Reporting Act (FCRA) and state-level rental screening regulations.
• Communicate with you about your account, security alerts, and material changes to this policy.

We do not use bank data to target advertising, build look-alike audiences, or train any product outside of the affordability score you requested.

When Pimetric is used to make a tenancy decision, we act as a Consumer Reporting Agency (CRA) as defined under the Fair Credit Reporting Act, 15 U.S.C. § 1681. As an applicant you have the right to:

• Receive a free copy of any report generated about you within the last 12 months.
• Dispute information you believe to be inaccurate or incomplete.
• Receive an adverse-action notice from the operator if a denial, increased deposit, or other unfavorable action is based, in whole or in part, on a Pimetric report.
• Know the identity of any party that received a report about you.

To exercise these rights, email fcra@pimetric.com. We respond within 30 days.

We share information only in these situations:

With the operator who requested the report

The CashScore, supporting metrics, and (when the applicant consents) a redacted transaction summary. Raw bank statements are never forwarded.

With service providers

Vendors that help us run the product — banking-data provider, cloud hosting, error monitoring, billing — under contract and only for purposes they need to perform.

For legal reasons

When required by subpoena, court order, or regulator with jurisdiction. We narrowly scope every response and notify you where legally permitted.

In a corporate transaction

If Pimetric is acquired, merged, or restructured, your information may be transferred — bound by terms at least as protective as this policy.

We do not sell personal information. Full stop.

Bank data is retained for 24 months from collection, then automatically purged. Generated reports are retained for 7 years to satisfy FCRA recordkeeping requirements. Account information is retained while your account is active and for 90 days after closure.

You may request deletion at any time by emailing privacy@pimetric.com. We honor verified deletion requests within 30 days, except where retention is required by law.

Depending on where you live, you may have rights under the GDPR, CCPA/CPRA, or similar laws — including the right to access, correct, port, or delete personal information; to opt out of certain disclosures; and to lodge a complaint with a supervisory authority. Submit any request to privacy@pimetric.com. We will not discriminate against you for exercising these rights.

Pimetric is not directed to children under 18 and we do not knowingly collect their information. If you believe a minor has connected an account, contact us and we will delete it.

We may update this policy when our practices change. Material changes will be communicated by email and posted here at least 30 days before they take effect. The “Effective” date at the top always reflects the latest revision.

Pimetric, Inc.
Attn: Privacy Officer
[Mailing address — to be inserted before launch]
privacy@pimetric.com