Enduring Labs Privacy Policy

Information We Collect

We collect information that you provide directly to us when you create an account, use our Service, or communicate with us. This includes your name, email address, phone number, company information, and any other information you choose to provide. Additionally, we collect property management data that you input into the Service, including resident information, maintenance records, vendor details, and financial data.

We also automatically collect certain information when you use the Service, including your IP address, browser type, operating system, device identifiers, pages viewed, and actions taken within the Service. We may use cookies, web beacons, and similar tracking technologies to collect this information.

How We Use Your Information

We use the information we collect to provide, maintain, and improve the Service; to process transactions and send related information; to send technical notices, updates, security alerts, and administrative messages; to respond to your comments, questions, and requests; to monitor and analyze trends, usage, and activities in connection with the Service; and to detect, investigate, and prevent fraudulent transactions and other illegal activities.

AI Processing

Mason uses artificial intelligence and machine learning to process property management data and automate workflows. He analyzes maintenance requests, resident communications, vendor interactions, and operational patterns to provide intelligent automation and recommendations. AI processing is performed on secure infrastructure with appropriate safeguards to protect data privacy and confidentiality.

We do not operate self-hosted models. AI processing is performed by third-party model providers acting as our sub-processors: Anthropic, OpenAI, Google (Gemini), and Baseten. We access each provider under enterprise or API agreements that prohibit the provider from using our customers’ data to train or improve their models, and that limit the provider to processing data solely to return results to Mason. Data sent to these providers is limited to what is needed to complete the specific task.

We do not use your data, and we do not permit any provider to use your data, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. This applies to all data, including data obtained through Google Workspace APIs. Any AI processing is specifically for providing and improving the Service for your account. You maintain full ownership of your data and may request deletion at any time.

Google User Data (Gmail and Google Calendar)

Some features of the Service connect to your Google account through Google’s OAuth consent screen. You choose whether to connect, and you can disconnect at any time from Mason’s settings or from your Google Account permissions page. This section describes how Mason accesses, uses, stores, and shares data received from Google APIs.

What we access. Gmail: when a property manager connects a shared maintenance mailbox or a personal mailbox, Mason requests the Gmail permission to read, compose, and send email (gmail.modify). Google Calendar: when a technician or vendor connects a calendar, Mason requests permission to create and manage a secondary calendar that he creates for Mason appointments (calendar.app.created). He does not read your other calendars.

How we use, store, and share it. Mason uses Google user data only to deliver the Service effectively: to identify maintenance requests, replies, invoices, and scheduling updates, to associate them with the correct work order, and to communicate and schedule on your behalf. Tokens and stored content are encrypted at rest. Google user data is shared only with the sub-processors that run the Service, including the AI providers listed above, each bound by contract to use it only to provide services to us. It is never used for advertising, never sold, and never used to train AI models.

Limited Use. Mason’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Data Protection

We implement industry-standard security measures to protect your data, including encryption of data in transit (TLS 1.2+) and at rest (AES-256), regular security assessments, access controls based on the principle of least privilege, and comprehensive logging and monitoring. Our infrastructure is hosted on SOC 2 compliant cloud providers and we conduct regular penetration testing and vulnerability assessments.

Data Sharing

We do not sell, rent, or trade your personal information to third parties. We may share your information with third-party service providers who perform services on our behalf, such as hosting, analytics, customer support, and the AI model providers named in the AI Processing section. These providers are contractually obligated to protect your information and may only use it to provide services to us. We may also disclose your information if required to do so by law or in response to valid legal requests.

Your Rights

Depending on your location, you may have certain rights regarding your personal information, including the right to access, correct, delete, or port your data. You may also have the right to opt out of certain data processing activities. To exercise any of these rights, please contact us at hello@thisismason.com. We will respond to your request within thirty (30) days. California residents may have additional rights under the CCPA, and European residents may have additional rights under GDPR.

Governing Law

This Privacy Policy is governed by the laws of the State of California, without regard to its conflict of law principles. Any disputes arising from this Privacy Policy shall be resolved in the state or federal courts located in San Francisco County, California.

Schedule 1: Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of the Privacy Policy and Terms of Service between Enduring Labs, Inc. (“Processor”) and the customer (“Controller”) for the processing of personal data in connection with the Service.

The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country. The Processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality. The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Upon termination of the Service, the Processor shall, at the choice of the Controller, delete or return all personal data to the Controller and delete existing copies unless applicable law requires storage of the personal data. The Processor shall make available to the Controller all information necessary to demonstrate compliance with these obligations.

Contact Information

For questions about this Privacy Policy, please contact us at: