Privacy Policy

Privacy Policy

Last Updated: June 18, 2026 — Effective Date: June 18, 2026

Rainier Headwaters LLC, a Washington limited liability company doing business as Marula (“we”, “us”, or “our”), operates Marula Landlord OS, a property management platform that enables landlords to manage rental properties, tenants, leases, payments, maintenance, and related records. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our website and services (the “Service”).

Before you have an account: the only information we collect is what you choose to give us when joining a waitlist — see §1.0. The sections below describe the Service as it operates once you hold an account, and apply from the point you create one.

1. Information We Collect

1.0 Waitlists

You may join a waitlist before you have an account, or — once you do have one — for a plan, feature, or account type that is not yet open to you.

In either case we collect the email address you enter and, optionally, anything you volunteer about your portfolio. We use it for one purpose: to contact you about that waitlist. We do not sell it, share it for advertising, or add you to unrelated marketing.

To be removed from a waitlist, use the unsubscribe page. It takes an email address and nothing else — no account, no explanation, and no need to say which waitlist, because it removes you from all of them. It takes effect immediately.

If you would rather not use a form, email privacy@marulaos.com with the subject line “Unsubscribe” and we will do it for you. That route is handled by a person rather than automatically, so the page is faster and more reliable — please prefer it.

Either way, you may still receive a message that was already in flight.

Removal from a waitlist is separate from deleting an account. If you hold an account and want it closed or your data deleted, see §7 (How to Exercise Your Rights).

1.1 Information You Provide Directly

Account information — When you register as a landlord, we collect your full name and email address (via Firebase Authentication). You may optionally add to your profile:

• Phone number
• Business address (street, city, state, ZIP code)

Certain features, if and when you use them, may require additional information. For example, payment-related features may require identity or business details for verification by our payment processor. We will tell you what is required when you enable such a feature, and this policy will be updated to reflect any new categories of information we collect.

Property and tenant data — You enter information about your rental business:

• Property addresses and unit details
• Tenant names, email addresses, and phone numbers
• Lease terms (start date, end date, rent amount, deposits)
• Payment and charge records
• Maintenance request details
• Messages and communications with tenants

Communications — When you contact support:

• Support ticket content (subject, messages, attachments)
• Contact form submissions

1.2 Information Collected Automatically

When you use the Service, we collect:

• Authentication records (login times, session tokens)
• Activity logs (actions taken within the platform, for audit purposes)
• Standard server logs (IP address, browser type, timestamps)

We do not currently use third-party analytics, tracking pixels, or advertising cookies. If we add analytics in the future, we will update this policy before doing so. For the cookies this site sets (and which it deliberately does not), see our Cookie Disclosure.

Do Not Track: We do not track your activity across third-party websites. Because we do not engage in cross-site tracking, we do not respond to Do Not Track (DNT) browser signals — there is no tracking behavior to change.

1.3 Information Collected from Third Parties

We receive authentication data from Google Firebase (your Firebase user ID and email) when you sign in. We do not purchase data from data brokers.

2. CCPA Categories of Personal Information

Under the California Consumer Privacy Act (CCPA), we collect the following categories of personal information in the preceding 12 months:

We do not collect: Social Security numbers, driver’s license numbers, biometric data, precise geolocation, or genetic data. We do not store card or bank account numbers — subscription billing is processed by Stripe, and we store only subscription identifiers and billing status. Tenant screening (credit/criminal/eviction reports) is not offered at launch. If we add this feature in the future, we will update this policy.

3. How We Use Your Information

We use your personal information to:

• Provide the Service — manage properties, tenants, leases, payments, and communications
• Process transactions — handle subscription billing and payment records
• Communicate with you — send service notifications, support responses, and account updates
• Maintain security — authenticate users, detect fraud, maintain audit logs
• Comply with legal obligations — retain financial records, respond to legal requests
• Improve the Service — understand usage patterns and fix issues

4. How We Share Your Information

We share personal information with the following categories of third parties:

Uploaded documents (such as leases) are processed within this infrastructure. We do not send document content to third-party AI providers. If that changes, this policy will be updated before it takes effect.

We do not:

• Sell your personal information to anyone
• Share your personal information for cross-context behavioral advertising
• Rent or lease your personal information

5. Data Retention

We retain your personal information as follows:

• Active accounts — Data is retained while your account is active
• Closed accounts — Data is deleted or anonymized 90 days after account closure
• Financial records — Transaction records and related financial data are retained for 7 years as required by IRS recordkeeping requirements
• Legal hold — Data subject to a legal hold or litigation hold is retained until the hold is released

If you delete your account, your personal information (name, email, phone, address) will be anonymized. Property, tenant, and financial data associated with your account will be retained per the schedule above.

6. Your Rights Under CCPA

If you are a California resident, you have the following rights:

Right to Know

You may request a copy of the personal information we have collected about you, including the categories of information, the sources, the purposes for collection, and the third parties with whom we have shared it.

Right to Delete

You may request that we delete the personal information we have collected from you, subject to certain exceptions (e.g., completing transactions, detecting fraud, complying with legal obligations, maintaining financial records).

Right to Correct

You may request that we correct inaccurate personal information we maintain about you.

Right to Opt-Out of Sale

We do not sell your personal information and will not sell it in the future. You do not need to submit an opt-out request.

Right to Limit Use of Sensitive Personal Information

We minimize our collection of sensitive personal information. If we collect any in the future, we will use it only for the limited purposes permitted by CPRA.

Right to Non-Discrimination

We will not discriminate against you for exercising any of these rights. We will not deny service, charge different prices, or provide a different level of service because you exercised a CCPA right.

7. How to Exercise Your Rights

To submit a request, contact us at:

Email: support@marulaos.com

Verification: We verify your identity by matching the email address in your request to the email address on file.

Response time: We will respond to your request within 45 days of receipt. If we need more time, we will notify you within the 45-day period and may take up to an additional 45 days.

Authorized agents: You may designate an authorized agent to submit a request on your behalf. We will require written permission from you and may verify your identity directly.

8. Your Responsibility for Tenant Data

As a landlord using our Service, you enter personal information about your tenants (names, contact details, lease terms, etc.). You are responsible for:

• Having a lawful basis to collect and process your tenants’ personal information
• Providing any required notices to your tenants about your data practices
• Responding to tenant data requests that are directed to you as the data controller

Tenants may also submit CCPA requests directly to us. If we receive a request from one of your tenants, we will process it and notify you if any action on your part is required.

9. Security

We protect your personal information using industry-standard security measures, including:

• Encryption in transit — All connections use HTTPS/TLS
• Encryption at rest — Database and file storage are encrypted
• Access controls — Multi-tenant data isolation with per-landlord filtering
• Authentication — Firebase Auth with JWT token verification
• Audit logging — Activity logs track changes for accountability
• Rate limiting — Multi-layer rate limiting at edge and backend

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but we are committed to protecting your data.

10. Children’s Privacy

Our Service is intended for adults 18 years and older. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a child under 18, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the “Last Updated” date at the top of this page
• Material changes will be communicated via email or in-app notification
• Continued use of the Service after the effective date constitutes acceptance of the updated policy

12. Contact

For questions about this Privacy Policy, to submit a privacy request, or to be removed from the waitlist:

Rainier Headwaters LLC (d/b/a Marula) 522 W Riverside Ave Ste N Spokane, WA 99201 United States

Privacy requests: privacy@marulaos.com General support: support@marulaos.com

We respond to privacy requests within 45 days, as required by the California Consumer Privacy Act, and apply the same timeline regardless of where you live.