Privacy Policy

856 Gramercy Drive LLC · A California Limited Liability Company

Effective Date: April 23, 2026 · Version: 1.0

856 Gramercy Drive LLC (“we,” “us,” or “the Company”) operates this website and the rental application process for The Gramercy at 856 South Gramercy Drive, Los Angeles, California. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the safeguards we have in place to protect it.

We are committed to safeguarding tenant information consistent with industry standards and applicable laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act Safeguards Rule (as applicable), and California consumer privacy and data security laws.

1. Information We Collect

We collect information you provide directly to us when you interact with the website or submit a rental application, including:

Contact information — name, email address, phone number, and housing preferences submitted through contact forms, tour requests, or the apply page.
Application data — information required to process a rental application, including identification, employment, income, residence history, and supporting documents.
Payment information — application fees and other payments are processed by Stripe. We do not see, store, or transmit your full card number, CVC, or bank account credentials. Stripe returns to us only a confirmation token and limited metadata (e.g., last four digits of the card, payment status).
Bank and income verification data — when you choose to verify income or banking information through Plaid, Plaid acts as a service provider that collects your credentials and account data directly. We receive only the verified results required for tenant screening (see Section 4).
Consumer report data — credit, background, and eviction reports obtained through approved screening providers in connection with your application.
Website analytics data — see Section 6.

2. How We Use Your Information

We use the information we collect to:

Respond to inquiries and schedule property tours.
Process and evaluate rental applications.
Verify identity, income, and banking information.
Process application fees and payments.
Communicate with you about availability, your application, or your tenancy.
Comply with legal, regulatory, and recordkeeping obligations.

We do not sell your personal information, and we do not use Plaid, Stripe, or screening data for advertising, profiling, or any purpose beyond tenant screening, payment processing, and lease administration.

3. Payment Processing — Stripe

All application fees and payments collected through this website are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. When you complete a payment:

You are redirected to Stripe’s secure, hosted checkout. Card and bank details are entered directly into Stripe’s environment over TLS-encrypted connections.
We never receive or store your full payment card number, CVC, or bank account credentials.
Stripe’s handling of your payment information is governed by the Stripe Privacy Policy.

4. Tenant Verification — Plaid

We use Plaid Inc. to verify the bank and income information you provide on your rental application. Plaid is a regulated data network used by thousands of financial institutions and applications. When you choose to verify through Plaid:

You connect your financial account through Plaid’s secure interface. Your banking credentials are entered directly into Plaid and are never seen, stored, or transmitted by us.
We request only the data elements needed to verify the information you have provided on your application (e.g., account ownership, deposit history, income).
We treat all data received from Plaid as Confidential under our Information Security Policy. Raw Plaid-sourced data is encrypted at rest and is deleted or anonymized once verification is complete and any FCRA dispute window has closed.
We do not use Plaid data for marketing, profiling, or any purpose beyond tenant screening and lease administration.
Plaid’s handling of the data it collects from you is governed by the Plaid End User Privacy Policy.

5. How We Protect Your Information

We maintain a written Information Security Policy and Data Retention & Deletion Policy describing the administrative, technical, and physical safeguards we use to protect your data. Key safeguards include:

Encryption in transit — all data exchanged with this website and our cloud systems uses TLS 1.2 or higher.
Encryption at rest — all confidential data stored in our cloud services (including data received from Plaid) is encrypted at rest with AES-256.
Access controls — role-based access on a least-privilege, need-to-know basis, with multi-factor authentication required for all employee accounts that access tenant data, and quarterly access reviews.
Vendor due diligence — before engaging any vendor that stores or processes your data, we review their security documentation (e.g., SOC 2) and execute written confidentiality and data protection terms. Primary vendors include Google Workspace, our property management software provider, Plaid, and Stripe.
Endpoint security — full-disk encryption, anti-malware, automatic security updates, and screen-lock enforcement on all devices used to access tenant data.
Personnel training — security awareness training at onboarding and annually thereafter, covering phishing, MFA, safe handling of tenant PII, and incident reporting.
Incident response — a documented response process covering containment, investigation, remediation, breach notification, and lessons learned.

6. Analytics and Tracking

We use analytics services including Google Analytics, Meta Pixel, TikTok Pixel, and PostHog to understand how visitors interact with our website. These services may collect information about your browsing behavior, device, and approximate location. Website logs and analytics data are retained for up to 13 months.

7. Data Retention & Deletion

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Representative retention periods:

Approved tenant application & supporting documents — duration of tenancy plus 7 years.
Denied or withdrawn applications — up to 2 years (Fair Housing / FCRA dispute window).
Consumer reports (credit, background, eviction) — up to 2 years after decision.
Plaid bank/income verification data — retained only as long as necessary to complete verification and resolve disputes, then deleted or anonymized.
Lease agreements & payment records — 7 years from the date of payment or end of tenancy.
Website logs & analytics — up to 13 months.

When a retention period ends, electronic records are securely deleted from primary storage and applicable backups, and paper records are shredded. Retention may be extended where required by a legal hold, dispute, audit, or investigation.

8. Your Rights

Subject to applicable law (including the California Consumer Privacy Act / CPRA), you may have the right to:

Request access to the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your personal information, subject to exceptions for legal retention requirements (e.g., active tenancy, FCRA, tax, or audit recordkeeping).
Opt out of the sale or sharing of personal information — we do not sell your data.

To exercise these rights, contact us using the details in Section 10. We will verify your identity before responding, and we will respond within the timeframe required by applicable law (generally no later than 45 days from verification).

9. Children’s Privacy

The website and rental application are intended for adults age 18 and over. We do not knowingly collect personal information from children under 13.

10. Contact

For questions about this Privacy Policy, to request a copy of our Information Security Policy or Data Retention & Deletion Policy, or to exercise your privacy rights, contact:

The RFC Group, on behalf of 856 Gramercy Drive LLC
Email: aiden@therfcgroup.com
Phone: 310.275.5156

11. Changes to This Policy

We review this Policy at least annually and may update it from time to time. The “Effective Date” above reflects the most recent revision. Material changes will be posted on this page.