Privacy Policy

BMP Property Management LLC, a Maryland limited liability company doing business as EvictPro ("EvictPro," "we," "us," or "our") operates an eviction case management platform serving Maryland landlords, property managers, and eviction agents. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services (collectively, the "Service").

The Service is offered to users in the United States — primarily Maryland landlords, property managers, and rent-court professionals. We are committed to protecting your privacy in compliance with the Maryland Online Data Privacy Act (MODPA, Md. Code Com. Law §14-4601 et seq.), the Maryland Personal Information Protection Act (Md. Code Com. Law §14-3501 et seq.), and other applicable United States data protection laws.

1. Information We Collect

1.1 Personal Information

When you create an account or use our Service, we may collect:

• Full name, email address, phone number, and mailing address
• Business information (company name, role, Maryland rental license details)
• Account credentials (email and hashed password, managed via Supabase)
• Profile photo (if uploaded)

1.2 Case Data

To provide eviction case management services, we collect:

• Tenant names, addresses, and lease information
• Property addresses and rental details within Maryland jurisdictions
• Court filings, case numbers, and legal documents
• Case status updates, notes, and communications

1.3 Financial Data

When you make payments through our platform:

• Payment card details are processed directly by Stripe and are never stored on our servers
• We retain transaction records, invoice history, and subscription status
• Billing name and address associated with your payment method

1.4 Usage Data

We automatically collect certain information when you use our Service:

• IP address, browser type, operating system, and device type
• Pages visited, features used, and session duration
• Referring URLs and search terms
• Error logs and performance data

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Case Management

• Processing and managing eviction cases through all stages of the Maryland eviction process
• Preparing legal documents, court filings, and notices in compliance with Maryland law
• Matching landlords with qualified eviction agents
• Providing real-time case tracking and status updates

2.2 Communication

• Sending transactional emails (case updates, receipts, confirmations)
• Responding to support inquiries and feedback
• Sending service announcements and, with your consent, marketing communications
• Email verification and account security notifications

2.3 Legal Processing

• Processing payments for services rendered via our payment processor
• Complying with Maryland landlord-tenant law and court requirements
• Maintaining records as required by law, including the Maryland Personal Information Protection Act

2.4 Analytics and Improvement

• Analyzing usage patterns to improve platform features and user experience
• Monitoring and improving platform performance and reliability
• Detecting and preventing fraudulent or unauthorized activity

2.5 Marketing Communications

If you opt in to marketing communications, we use the email address you provided to send you product updates, educational content, and Maryland-specific landlord resources. Your opt-in decision, the exact wording shown to you at the time, the source form, the date and time of your decision, and a one-way hashed reference to your network address are stored with your account so we can prove the basis of your consent if asked. You may withdraw consent at any time from your account settings or by clicking the unsubscribe link in any marketing email; withdrawal is honored immediately and does not affect transactional service emails.

3. Legal Basis for Processing

Consistent with MODPA's data-minimization principle, we collect and process personal data only as reasonably necessary and proportionate to provide the Service you request. We process personal data on the following bases:

• Performance of a contract: Processing necessary to fulfill our obligations under your service agreement, including case management, document preparation, and payment processing.
• Legal obligation: Processing required to comply with Maryland law, court orders, and regulatory requirements, including record-keeping obligations under the Maryland Personal Information Protection Act.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving our Service, preventing fraud, and ensuring platform security, provided these interests are not overridden by your rights and freedoms.
• Consent: Where we rely on your consent (for example, marketing communications or optional analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Third-Party Services

We share data with the following third-party service providers who process data on our behalf and under our instructions:

We require all third-party processors to comply with applicable data protection laws and to process your data only as instructed by us.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy or as required by law:

• Account data: Retained for the duration of your account. Upon account deletion, personal data is removed within 30 days, except where retention is required by law.
• Case data: Retained for 7 years after case closure to comply with Maryland record-keeping requirements and statute of limitations periods.
• Financial records: Retained for 7 years to comply with tax and accounting obligations.
• Usage and analytics data: Retained for 26 months in anonymized or aggregated form.
• Email communications: Transactional email logs are retained for 12 months.

6. Your Rights Under Maryland Law (MODPA)

The Maryland Online Data Privacy Act gives consumers the following rights regarding their personal data:

• Right to access: Confirm whether we process your personal data and request a copy of it.
• Right to correction: Request that we correct inaccurate personal data.
• Right to deletion: Request deletion of your personal data, subject to legal retention obligations.
• Right to data portability: Request a machine-readable copy of your personal data (account holders can self-serve this from Settings → Privacy & Data → Export My Data).
• Right to opt out of targeted advertising, sale, and profiling: We do not sell personal data and do not profile consumers in furtherance of decisions producing legal or similarly significant effects. You can turn off targeted-advertising measurement at any time on Your Privacy Choices, and we honor the Global Privacy Control browser signal automatically as a universal opt-out.

To exercise any of these rights, please submit a request through our Contact page. We will respond within 45 days as MODPA requires (and usually much sooner). We will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our decision; if the appeal is denied, you may contact the Maryland Attorney General's Consumer Protection Division.

7. Tenant and Third-Party Data

Our platform enables landlords and agents to submit information about tenants and other third parties in connection with eviction proceedings. We recognize that these individuals ("Data Subjects") may not have a direct relationship with EvictPro. This section explains how we handle tenant data and the rights available to affected individuals.

7.1 What Tenant Data We Process

Landlords and agents may submit the following tenant information through our platform:

• Tenant names, addresses, and contact information
• Lease terms, rent amounts, and payment history
• Amounts owed including rent arrears and late fees
• Court filings and case documents that reference the tenant

7.2 Legal Basis for Processing Tenant Data

Tenant data is processed under the legal basis of legitimate interest and legal obligation. Processing is necessary for the landlord to exercise their legal rights under Maryland landlord-tenant law (Md. Code Real Prop. §8-401 et seq.) and to comply with Maryland District Court filing requirements. EvictPro acts as a data processor on behalf of the landlord (the data controller) with respect to tenant information.

7.3 Tenant Rights

Even though tenants do not have an account with EvictPro, they have the following rights regarding their personal data:

• Right to know: Tenants may request confirmation of whether their personal data is being processed by our platform and, if so, a description of the data held.
• Right to correction: Tenants may request correction of inaccurate personal data. We will coordinate with the landlord (data controller) to process such requests.
• Right to deletion:Tenants may request deletion of their personal data, subject to the landlord's legal obligations and our record retention requirements (7-year retention for case records under Maryland law).
• Right to object:Tenants may object to processing of their data. However, where processing is necessary for the landlord's exercise of legal rights, the objection may not result in cessation of processing.

To exercise any of these rights, tenants may submit a request through our Contact page. We will respond within 30 days and, where appropriate, coordinate with the relevant landlord to fulfill the request.

7.4 Data Minimization and Security

We collect only the tenant information that is necessary for the landlord to pursue their legal remedies under Maryland law. Tenant data is subject to the same security safeguards as all other personal data on our platform, including encryption, access controls, and audit logging. Access to tenant data is strictly limited to the landlord who submitted the case, the assigned agent, and EvictPro administrators for platform support purposes.

8. Maryland Personal Information Protection Act Compliance

In addition to MODPA, EvictPro complies with the Maryland Personal Information Protection Act (Md. Code Com. Law §14-3501 et seq.), which requires businesses to:

• Implement reasonable security procedures and practices to protect personal information from unauthorized access, use, modification, or disclosure.
• Notify affected Maryland residents and the Maryland Attorney General in the event of a data breach involving personal information within 45 days of discovery, as required by Md. Code Com. Law §14-3504.
• Securely dispose of records containing personal information when they are no longer needed for business purposes or required to be retained by law.
• Restrict access to personal information to authorized personnel who need it to perform their job duties.

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information, including encryption in transit and at rest, access controls, and regular security assessments.

9. Data Security

We implement industry-standard security measures to protect your personal data, including TLS encryption for all data in transit, encryption at rest for stored data, role-based access controls, and regular security audits. While no method of transmission or storage is 100% secure, we continuously monitor and improve our security practices. In the event of a data breach affecting your personal information, we will notify affected individuals and the Maryland Attorney General within 45 days of discovery, as required by the Maryland Personal Information Protection Act.

10. International Data Transfers

Our Service is operated in the United States and offered to United States users. Your data is stored and processed in the United States. If you access the Service from outside the United States, you do so on the understanding that your data will be transferred to, stored in, and processed in the United States under the laws described in this policy.

11. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete that information promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we may also send you an email notification. We encourage you to review this policy periodically.

13. Cookies

We use cookies and similar tracking technologies to operate and improve our Service. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal information, please contact us: