This Privacy Policy describes how Polystorage LLC, a Michigan limited liability company (“Polystorage,” “we,” “us,” or “our”), collects, uses, and shares information when you interact with the polystorage platform at polystorage.io (the “Service”).
The Service is used by two distinct groups of people: storage facility operators and their staff (“Operators”) and the tenants of those facilities who access the Tenant Portal. This policy applies to both groups and distinguishes between them where relevant.
If you are a tenant whose information is managed within polystorage, your primary privacy relationship is with your storage facility, not with Polystorage. Polystorage processes your information as a service provider on behalf of your facility. For questions about how your facility handles your data, contact your facility directly.
What We Collect
From Operators and Authorized Users:
- Account information — name, email address, role, and organization affiliation, collected when an account is created through PropelAuth;
- Usage data — features accessed, actions taken, timestamps, and IP addresses, recorded in audit logs to support security and accountability;
- Billing information — subscription tier, payment method (processed and tokenized by Stripe; we do not store raw card numbers), billing contact details;
- Payout account verification data — when an operator sets up online rent collection, identity-verification details (such as legal business name, EIN, representative name and date of birth, government ID, last four digits of SSN, and bank account information) are collected by and transmitted directly to Stripe through Stripe-hosted or Stripe-embedded interfaces; Polystorage receives only the resulting verification status, never the underlying identifiers or documents; and
- Communications — support requests, messages submitted through the platform, and correspondence with our team.
From Tenants (via the Tenant Portal):
- Identity information — name, email address, phone number, and mailing address;
- Account and lease data — unit number, lease terms, gate PIN, move-in and move-out dates;
- Payment information — payment method references (tokenized by Stripe), invoice history, and transaction records;
- Communications data — email content sent through the platform (lien notices, payment reminders, facility communications); and
- Portal activity — login timestamps, actions taken in the portal, and IP address.
Automatically Collected:
- Browser type, device type, and operating system;
- Pages visited and session duration; and
- Cookies and similar technologies used for session management and security (not for advertising).
How We Use Information
We use the information we collect to:
- Provide and operate the Service — managing accounts, processing payments, delivering notifications, and supporting lien enforcement workflows;
- Communicate — sending transactional messages (invoices, payment receipts, access confirmations), service announcements, and responding to support requests;
- Maintain security — detecting and investigating unauthorized access, fraud, and abuse; maintaining audit logs;
- Improve the Service — analyzing aggregated, anonymized usage patterns to develop new features; and
- Comply with law — retaining records as required by applicable tax, accounting, and self-storage regulations.
We do not sell personal information. We do not use personal information collected through the Service for cross-context behavioral advertising.
How We Share Information
We share information only in the following circumstances:
Service providers (sub-processors). We share information with third parties who help us operate the Service, each bound by data protection obligations consistent with this policy:
| Provider | Purpose | What They Receive |
|---|---|---|
| Amazon Web Services | Cloud hosting, storage, database, and email delivery | All categories of platform data |
| Stripe Inc. | Payment processing | Billing name, address, tokenized payment method; Stripe does not share raw card data with us |
| PropelAuth | Authentication and identity management | Operator email, name, role, session tokens |
Storage facility operators. If you are a tenant, your information is accessible to the Operator whose facility you rent from. Polystorage provides the platform; the Operator is the party responsible for how your data is used within their business.
Legal requirements. We may disclose information if required by law, court order, or governmental authority, and will provide notice where legally permitted.
Business transfers. If Polystorage is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.
Data Retention
We retain personal information for as long as necessary to provide the Service and comply with legal obligations. Where this policy refers to “anonymized,” it means that personal identifiers (name, email address, phone number, mailing address, and gate PIN) have been replaced with non-identifying placeholder values such that the individual cannot reasonably be identified from the remaining data. Our baseline retention schedule:
| Data Type | Retention Period | Basis |
|---|---|---|
| Tenant PII (name, email, phone, address, gate PIN) | Anonymized 90 days after all leases close and balances settle | Operational need during lease lifecycle |
| Financial records (invoices, transactions, fees) | 7 years | IRS and accounting requirements |
| Legal action logs (lien status, auction approvals, SCRA holds) | 7 years from the date of the action | Litigation and regulatory compliance |
| Security and access logs (IP addresses, session events) | 90 days, then anonymized | Security monitoring |
| Operator account data | Duration of the operator’s subscription, plus 90-day export window | Service delivery |
Your Privacy Rights
Depending on where you live, you may have rights regarding your personal information. Polystorage honors these rights to the extent applicable law requires:
- Access — request a copy of the personal information we hold about you;
- Correction — request that we correct inaccurate information;
- Deletion — request that we delete your personal information, subject to our legal retention obligations described above;
- Portability — request your data in a machine-readable format; and
- Opt-out of sale or sharing — we do not sell or share personal information for advertising, so no opt-out is required.
If you are a tenant, most data access and correction requests should be directed to your storage facility, as the Operator controls your lease data within the platform. Polystorage will assist Operators in fulfilling your requests where technically feasible.
California residents have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what categories of personal information we collect, the right to non-discrimination for exercising your rights, and the right to opt out of the sale of personal information (which we do not engage in).
To submit a privacy rights request, contact us at the address below. We will respond within forty-five (45) days, and may extend by an additional forty-five (45) days where reasonably necessary with prior notice.
Security
We implement reasonable technical and organizational measures to protect personal information, including AES-256 encryption at rest, TLS 1.2 or higher in transit, role-based access controls, and audit logging. No system is completely secure. In the event of a security incident affecting your information, we will notify affected parties as required by applicable law.
Cookies and Tracking
Platform (manager portal and tenant portal). We use session cookies strictly necessary for authentication and security. These are set by polystorage.io and are required for the platform to function. We do not use advertising or behavioral tracking cookies within the authenticated platform.
Marketing website. We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors interact with our marketing website. Google Analytics sets persistent cookies (including _ga and _ga_*) that collect information about your visit, such as pages viewed, time on site, and general geographic region. This data is processed by Google subject to Google’s Privacy Policy. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.
We do not use cookies for cross-context behavioral advertising or sell cookie-derived data to third parties. You may configure your browser to block or delete cookies; blocking Google Analytics cookies will not affect your ability to use the platform or marketing site.
Children’s Privacy
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor’s information has been submitted to the platform, please contact us and we will promptly delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy at polystorage.io/legal/privacy-policy with the revised effective date and, for material changes, notify Operators by email and provide at least thirty (30) days before the change takes effect. Your continued use of the Service after the effective date of an update constitutes acceptance of the revised policy.
Contact Us
For privacy questions, requests, or concerns, contact Polystorage at:
Polystorage LLC
Privacy Team
Email: privacy@polystorage.io