Privacy Policy

Overview

Sojur ("we", "us", or "our") provides a smart home management platform for short-term rental property managers. This policy explains what data we collect, how we use it, your rights regarding your information, and how we handle data from third-party integrations including Ring.

Information We Collect

We collect the following categories of information:

• Account information: Name and email address used to create your Sojur account.
• Property information: Names and details of properties you manage within the platform.
• Device credentials and OAuth tokens: Access tokens for third-party integrations (including Ring) that you authorize. These are stored encrypted in Supabase Vault and never exposed in plaintext.
• Device state and event data: Lock status, thermostat readings, motion events, doorbell events, and camera snapshots from devices linked to your properties.
• Inspection media: Photos submitted by property managers during AI-assisted property inspections.
• Usage data: Log data and actions taken within the platform to support debugging and service improvements.

Purposes for Which Data Is Processed

We process your data for the following purposes:

• Authenticating you and securing access to your account
• Displaying and controlling smart home devices across your properties
• Delivering real-time alerts and notifications you configure
• Surfacing Ring camera snapshots and live video streams on demand
• Running AI-assisted property inspections using photos you explicitly submit
• Improving and troubleshooting the platform

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Ring Integration

When you connect a Ring account through the Ring Works With program, Sojur receives OAuth access tokens that allow us to access your Ring devices on your behalf. We use this access solely to:

• Display device status and motion/ding alerts in your Sojur dashboard
• Retrieve snapshots and live video streams for linked Ring cameras on demand
• Receive webhook notifications for motion and doorbell events

Ring tokens are stored encrypted and are never shared with third parties. Video footage is never stored by Sojur — snapshots are fetched on demand and displayed but not retained. You can disconnect your Ring account at any time from the Integrations page, which immediately revokes our access.

AI Features and Model Training

Sojur uses Google Gemini to power AI-assisted property inspections. This feature analyzes photos explicitly submitted by property managers during an inspection session.

Ring data is never used to train AI or machine learning models — by Sojur or any third party. Ring device data (motion events, snapshots, live video, tokens) is used only to deliver the core service and is not passed to any AI pipeline. Inspection photos submitted by managers are processed by Google Gemini under Google's API terms and are not used to train Sojur's own models.

Because Ring data is not used for AI training, opting out of AI model training has no effect on Ring-related functionality.

Data Storage and Security

Data is stored in Supabase (PostgreSQL) hosted on AWS, with row-level security enforced on every table. Sensitive credentials and OAuth tokens are stored in Supabase Vault (encrypted at rest). Device state is cached in Redis with a 30-second TTL and is not persisted long-term. We use TLS for all data in transit.

Data Retention

Retention periods by data type:

• Account and property data: Retained for the life of your account.
• OAuth tokens (Ring and others): Retained until you disconnect the integration or delete your account.
• Device event logs: Retained for 90 days, then automatically purged.
• Camera snapshots: Not stored — fetched on demand and never persisted.
• Video streams: Not stored — streamed in real time only.
• Inspection photos: Retained for the life of the inspection record.
• Usage/log data: Retained for 30 days for debugging purposes.
• On account deletion: Your profile, sign-in credentials, notification tokens and personal notifications are deleted immediately. Records your organization keeps — such as a completed inspection of one of its properties — are retained by the organization with your authorship removed. Deleting the organization itself deletes those records too, including inspection photos.

Sub-processors and Third-Party Data Sharing

We share data only with the following sub-processors required to operate the service:

• Supabase — database, authentication, and encrypted credential storage (hosted on AWS)
• Google (Gemini API) — AI analysis of inspection photos submitted by property managers
• Resend — transactional email delivery for platform alerts
• Cloudflare — DNS, tunnel, and email routing

We do not sell or share your data with advertisers, data brokers, or any other third parties outside of the sub-processors listed above.

Human Access to Your Data

Sojur staff may access account and property data only for the purpose of diagnosing support issues, with access limited to authorized personnel. We do not review Ring video footage or snapshots. Inspection photos may be reviewed by authorized staff solely for the purpose of debugging AI inspection features.

Your Privacy Rights and Controls

You have the following rights regarding your data:

• Disconnect integrations: You can disconnect your Ring account at any time from the Integrations page, and any other integration from its property's page. This immediately revokes our OAuth access.
• Access your data: You may request a copy of the personal data we hold about you by emailing [email protected].
• Correct your data: You can update your name and email from your account profile page at any time.
• Delete your account: You can delete your account yourself, at any time, from Profile → Delete Account on the web dashboard or Account → Delete Account in the mobile app. Deletion is immediate and permanent; it cannot be undone, and we cannot restore a deleted account.
  If you are the only member of your organization, deleting your account also deletes the organization and everything in it — properties, connected hubs and devices, guest access codes, reservations, and inspections with their photos. If other members remain, you can instead delete only your own account: the organization and its records stay with your teammates, and your name is removed from the history you created.
  You can also email [email protected] to request deletion, which we process within 30 days. Disconnecting Ring from the Integrations page immediately revokes Ring access independent of either process.

To submit a Data Subject Access Request (DSAR) or any other privacy rights request, email [email protected].

Changes to AI Capabilities

If we materially change how AI features interact with your data — including any change to which data types are processed by AI systems — we will update this policy and notify users via email at least 30 days before the change takes effect.

Changes to This Policy

We may update this policy from time to time. The updated date at the top of this page reflects the most recent revision. For material changes, we will notify users by email. Continued use of the platform after changes constitutes acceptance of the updated policy.

Contact

Privacy questions, DSARs, or deletion requests: [email protected]