Privacy Policy

Who we are

Cenaptic LLC (“Cenaptic,” “we,” “us”), a Minnesota limited liability company, makes R.Center, a website and operating system for apartment buildings where every apartment has its own page, and R.Agents, AI agents that run a property’s weekly marketing with a person approving the work. Our customers are apartment owners and property management companies.

Cenaptic LLC
244 97th Street NW, Monticello, Minnesota 55362
Privacy questions, data requests, and help with our services: privacy@cenaptic.center or 763-300-0885

When we handle information for a property, such as data from its connected accounts or inquiries from its website, we do it on behalf of that property’s owner or manager and under our agreement with them.

Information we collect

• This website. cenaptic.center uses Google Analytics, loaded through Google Tag Manager, to count visits and see which pages are read and where visitors came from. Google Analytics sets cookies to do this. We run no advertising tags, and what you type into a form is not sent to Google Analytics. Its only form is the Founding Partner request, below. Our hosting provider keeps standard server logs (such as IP address, browser type, and the page requested) for security and to keep the site running.
• The Founding Partner form. When you ask to become a Founding Partner on our Founding Partner page, we collect your name, work email, company, portfolio size if you choose one, and anything you write in the note. We use it only to reply to you and to consider your company as a Founding Partner. The website does not store it: it is sent to us as an email through our email delivery provider, and kept in our inbox.
• Email you send us. Your name, email address, and whatever you write.
• Customer accounts. For people who use the Portal: name, email address, role, the properties you can access, and a record of the changes you make and approve.
• Property information. Details a property provides or publishes: apartments, availability, pricing, photos, videos, amenities, and website content.
• Connected Google and Meta accounts. When a property connects one of the accounts listed below, we receive the data listed for it, and we store the access tokens needed to act for that property.
• Leasing reports. Reports a property’s management company sends us. We read them for property-level figures such as leads, tours, applications, and apartments rented. We ask that reports leave out resident information. Anything personal is removed before the figures are used. The file as it arrived is kept securely for 90 days, then removed.
• Visits and inquiries on property websites. Counts of what happens on the R.Center websites we run, with no identifier, and a record of each inquiry without the person’s details. See The property websites we run, below.
• How our services are used. What our agents proposed for a property, what people approved, edited, or rejected, the changes that were made, and the results that followed, measured by our own website tracking and the property’s leasing reports.

The property websites we run

Each R.Center website is run for one property, and has its own privacy page for the people who visit it. This is what those websites collect, and what reaches us. We handle it as the property’s service provider.

Visits, counted without knowing who you are

The website counts what happens on it: visits, new and returning; the pages, apartments, floor plans, and Peeks opened; taps on buttons such as Schedule tour or Call; and how long a page or video was watched, in ranges. These are counts per day. They carry no name, no account, and no identifier. To tell a new visit from a returning one, your browser keeps a mark that holds only the day you were last on the website.

Where a visit came from

The campaign tags and ad click identifiers in the link you followed, the site that sent you, and the first page you opened are kept in a cookie on that property’s website for 90 days. They are shared with no one, and attached only to a form you send.

Forms go to the leasing team

When you ask for a tour or send a note, your name, email address, phone number, move-in date, and message are emailed to that property’s leasing team so they can answer you. We do not keep them in our database. For the property’s reporting we keep a record of the inquiry: what kind it was, the page and apartment, where the visit came from, whether it came from a phone or a computer, and when it arrived. So repeat inquiries can be counted, the record holds a one-way code made from the email address and phone number, which cannot be turned back into either.

When you ask for text alerts or join a waitlist, your mobile number goes to the leasing team so it can text you about apartments. Reply STOP to any text to stop them.

Global Privacy Control and Do Not Track

If your browser sends Global Privacy Control or Do Not Track, the website sets no cookie or mark and records nothing about your visit. A form you send still reaches the leasing team, without where your visit came from.

Google tools on a property’s website

A property may also measure its website with Google Analytics and Google Tag Manager, in accounts we set up and manage for it. The website’s own privacy page says when it does.

How we use information

• To provide R.Center websites, the Portal, and R.Agents to the properties that use them.
• To write each property’s weekly plan, carry out what a person approves, and measure what it produced.
• To secure our services, prevent misuse, and fix problems.
• To answer you, and to send information about our services that you asked for.
• To develop, train, and improve our services and models, using de-identified operating data only, as described in How we use data to improve our services, below.

How we use data to improve our services

Our services get better by learning from how they are used. We sort the data we handle into three kinds, and each has its own rule.

1. Renter personal data: never used for training

Names, email addresses, phone numbers, and any other details that identify a renter, prospect, or resident belong to the property. We handle them as the property’s service provider, only to provide our services to that property. We never use them to train AI models, we never sell them, and we delete them when the property asks us to.

2. Your data: used only for you, and deleted when you ask

Your Portal accounts, your property content and settings, your access tokens, all data we receive from your Google and Meta accounts, and your property’s memory (its plans, history, and notes) are used to provide our services to you. We delete them from our live systems within 30 days and from backups within 90 days of your request or the end of your service.

3. De-identified operating data: kept, and used to improve our services

As our services run, they produce a record of the work: what our agents proposed, what people approved or changed, the change logs, and the results, measured by our own website tracking and by the property’s leasing reports. We de-identify this record and use it to develop, train, and improve our services and models. Because it no longer identifies you, your properties, or anyone else, it is not deleted when your data is, and it stays with us after your service ends. Unless your agreement with us says otherwise, this applies to every customer.

The content of renter inquiries, such as the questions a prospect asks about an apartment, may be used the same way, but only after every contact detail and identifier has been removed. Once de-identified, it is operating data, not renter personal data.

What never goes into training

• Renter personal data: names, contact details, and identifiers.
• Data from Google or Meta, and anything derived from it. Any record that contains Google or Meta data, or figures taken from it, is excluded. We train only on data our own product generates, with results measured through our own tracking and the property’s leasing reports.

What de-identified means here

De-identified data cannot reasonably be used to identify, or be linked to, any person, household, property, or company. We meet that standard in three ways:

• We take reasonable technical measures: we remove names, contact details, addresses, property names, brands, web addresses, and people, and we generalize figures and locations so they cannot be traced back.
• We publicly commit, here, to keep and use it only in de-identified form and never to try to re-identify it.
• We bind anyone who receives it, by contract, to the same commitments.

Google user data

Cenaptic’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

R.Agents by Cenaptic asks for access to these Google services only when a property’s owner or manager connects them. For each one, this is the data we access, what we do with it, and why:

How we use, store, and share Google user data

• We use Google user data, and anything derived from it, only to provide and improve the features of the property that connected it. We never use one property’s Google user data for another.
• We store it in our database, encrypted in transit and at rest, and store access tokens encrypted. Access is limited to the property it belongs to and to the people that property authorizes.
• We share it only with the service providers that run those features for us (hosting, database, and the AI model providers that draft the property’s plan, reached through our hosting provider’s AI gateway), under contracts that limit their use to providing the service, and with that property’s own owner and managers.
• We do not sell Google user data, and do not use or transfer it for advertising, retargeting, or interest-based ads.
• We do not use Google user data to decide credit or lending, or for any purpose unrelated to the connected features.
• We do not use Google user data, or anything derived from it, to develop, improve, or train generalized artificial intelligence or machine learning models, or any model shared across customers. Records that contain Google user data, or figures taken from it, are excluded from our training data.
• We keep content from Google Business Profile no longer than 30 days, and we do not aggregate it.
• People at Cenaptic do not read Google user data unless the property asks us to for a specific reason, it is needed for security or to comply with the law, or it has been aggregated and de-identified for internal operations.

Meta platform data

Our customers connect their own Facebook Pages, Instagram professional accounts, ad accounts, and business portfolio to R.Agents by Cenaptic. We act for those client businesses. For each Meta service, this is the data we access, what we do with it, and why:

How we use and protect Meta platform data

“Meta platform data” means everything we receive from Meta, including ads data and Page and Instagram insights, and anything derived from it.

• We use it only for that advertiser’s own campaigns, Pages, and accounts: publishing its posts, managing its ads (creating, editing, pausing, and resuming ads, changing budgets, and reading performance and spend), measuring how they did, and listing the assets it has shared with us.
• We keep each advertiser’s Meta platform data separate from every other customer’s. We may show a property’s Meta results alongside its other marketing results so it can see what is working, and we report Meta’s figures separately. We never use Meta platform data to target or optimize ads on other platforms.
• We never sell or license it, and we never use it to build profiles of people.
• We never use it to develop, train, or improve AI models. Records that contain Meta platform data, or figures taken from it, are excluded from our training data.
• We never use it to decide who is eligible for housing. We share it only with the service providers that run these features for us, under contract, or when the law requires.
• We follow the Meta Platform Terms and Developer Policies.
• We delete Meta platform data when it is no longer needed for the connected features, when the client or the person who connected the account asks, when Meta asks, or when we stop offering the app. See the retention periods below and our data deletion instructions.

Artificial intelligence

R.Agents uses AI models from established providers, which we may change, to read a property’s information and write its plans and content. We reach these models through our hosting provider’s AI gateway, so we can move between models and providers without changing how your data is handled. The AI providers we use do not train their models on the data we send them. Nothing an AI model writes is published or changed in an account until a person approves it.

How we share information

We do not sell personal information. We share information only:

• With service providers that run our services for us, under contract: Vercel (hosting), Supabase (database), Cloudinary and Mux (images and video), Resend (email delivery, including the Founding Partner form), Google (Analytics, for visits to this website), and AI model providers, reached through our hosting provider’s AI gateway, as described above.
• With the owner and management team of the property the information belongs to.
• When required by law, or to protect the rights, safety, and security of our users and services.
• With a successor if Cenaptic is involved in a merger or acquisition, under this policy’s protections.

How long we keep information

• Access tokens for Google and Meta accounts: deleted as soon as the property disconnects the account in the Portal. If the account is disconnected from Google’s or Meta’s side, we delete the tokens as soon as we detect it, and within 30 days.
• Data received from Google and Meta (reports, performance, spend, posts, and listing details): kept while the property uses the connected feature, so its history can inform its next plans. Deleted from our live systems within 30 days after the property disconnects that account, leaves our services, or asks us to delete it.
• Google Business Profile content: kept no longer than 30 days.
• Leasing report files as they arrived: kept 90 days, then removed. The figures read from them, with names removed, stay with the property’s history.
• Renter personal data, and property information, plans, results, leasing report figures, and lead records: kept while the property is a customer. Deleted from our live systems within 30 days after the property leaves or its owner or manager asks.
• Portal accounts: kept while the account is active. Deleted within 30 days after the account is removed, except the record of who approved which change, which stays with the property’s history until that history is deleted.
• Backups: everything above is also deleted from our backups within 90 days of the request or the end of service. Backups are encrypted and used only to restore our services.
• De-identified operating data: kept, as described in How we use data to improve our services. It identifies no one.
• Email you send us: kept as long as needed to answer you and keep a record of the conversation, and no longer than 3 years.
• Founding Partner requests: kept for up to 3 years, and deleted sooner if you ask.
• Server logs for this website: kept by our hosting provider for a short period for security, then deleted.
• Google Analytics data for this website: Google keeps visit details for 2 months and data tied to a browser for 14 months after its last visit. Totals in our reports, which identify no one, can stay longer.

When we delete data, we keep a short record that the deletion happened. We keep information longer only where the law requires it, and only for as long as it requires.

How to have your data deleted

Disconnect an account, or ask us to delete your data, as described on our Data deletion page. The short version: email privacy@cenaptic.center with the subject “Data deletion request,” and name the property and the account or email address the request is about. You can also call us at 763-300-0885.

Security

Information is encrypted in transit. Access tokens and secrets are stored encrypted, access is limited by role and property, and changes are logged. No system is perfectly secure. If a breach affects your information, we will notify affected customers as the law requires.

Your choices and rights

• Ask to access, correct, or delete your information by emailing privacy@cenaptic.center. Depending on where you live, you may have further rights under state law, and we will honor them.
• If your information came to us through a property, such as an inquiry on its website, we will pass your request to that property and help it respond.
• Disconnect Google at myaccount.google.com/permissions, and Meta as described on our Data deletion page.
• Turn off Google Analytics on this website: send Global Privacy Control from your browser and it does not load, or use Google’s opt-out browser add-on.

Children

Our services are for businesses and are not directed to children under 16. We do not knowingly collect their information.

Changes to this policy

We will post changes here and update the effective date. If a change is material, we will tell customers before it takes effect.