1. SCOPE AND OVERVIEW

Property Matrix respects the privacy of its customers, users, website visitors, and the individuals whose information customers manage through Property Matrix. This Privacy Policy explains how Property Matrix collects, uses, discloses, stores, and protects personal information in connection with PropertyMatrix.com, Property Matrix software and mobile applications, customer support, integrations, and the Property Matrix connector for ChatGPT and Codex, including its remote Model Context Protocol server (collectively, the “Services”).

This Policy applies to information that Property Matrix controls. Property Matrix customers may enter or manage information about tenants, applicants, property owners, vendors, employees, leads, and other individuals. In those circumstances, the customer determines why the information is entered and how it is used. Individuals whose information is controlled by a Property Matrix customer may need to direct a privacy request to that customer. Property Matrix will provide reasonable assistance to customers when required.

The Property Matrix connector allows an authorized Property Matrix user to ask ChatGPT or Codex to retrieve information from, or create or update information in, the user’s Property Matrix account. The connector processes only task-specific information supplied through a tool call and authorized information in the connected Property Matrix account. It does not request or reconstruct a user’s complete ChatGPT or Codex conversation history.

2. INFORMATION PROPERTY MATRIX COLLECTS AND PROCESSES

Account, contact, and customer information

Property Matrix may collect names, business names, job titles, email addresses, telephone numbers, mailing addresses, state or region, usernames, account identifiers, organization or license identifiers, account roles, subscription information, support communications, and other information provided when someone registers, requests a demonstration, contacts support, or uses the Services.

Authentication and authorization information

Property Matrix processes login identifiers, password hashes, sign-in history, current and previous sign-in IP addresses, OAuth applications, OAuth access tokens, authorization grants, OAuth client identifiers, application names, permitted origins, redirect URLs, authorization scopes, and related security information. Property Matrix does not return OAuth client secrets through the connector.

Customer and property-management records

Customers may store or process information including:

• Property, site, and unit identifiers, names, addresses, company display names, status information, and occupancy-related information.

• Names, companies, telephone numbers, email addresses, postal addresses, and identifiers for tenants, applicants, leads, property owners, vendors, employees, payers, and other contacts.

• Lead budgets, referral sources, bedroom preferences, labels, and site preferences.

• Lease identifiers, lease display names, lease relationships, and related dates or terms.

• Maintenance-request numbers, subjects, free-text descriptions, categories, status, dates, site details, vendor information, notes, and attachments.

• Bills, invoices, charges, payment records, accounting entries, dates, amounts, paid and outstanding balances, allocations, memos, descriptions, payer and vendor information, and internal accounting-account identifiers and numbers.

• Payment-method type selections and accounting allocation information. The connector is not designed to collect card numbers, bank credentials, or other payment credentials.

• API-application information, including application identifiers, names, origins, redirect URLs, client identifiers, and creation dates.

• Files, images, PDFs, filenames, content types, file sizes, creation dates, parent-record identifiers, and other metadata.

• Free-text content, custom fields, notes, and other business records submitted by customers.

Users should not submit passwords, API keys, one-time passcodes, full payment-card information, government identification numbers, protected health information, or other restricted information through connector tool fields or free-text descriptions.

Website, cookie, and device information

When someone visits or uses the Services, Property Matrix may automatically receive IP addresses, browser type and user-agent information, operating system information, referring and exit pages, requested URLs, timestamps, clickstream or navigation information, cookie identifiers, and similar technical information. Cookies may remember preferences, support sign-in, help administer the website, and help Property Matrix understand website use. Browser settings may allow users to reject or delete cookies, although doing so may affect functionality.

Google account information

If a user chooses Google authentication, Property Matrix may receive the user’s Google-provided email address and a link to the user’s avatar. Property Matrix uses the email address for sign-in and the avatar link to personalize the interface. This information is stored with the user’s account and is not used for unrelated advertising.

Plaid identity-verification information

For certain ProPay merchant-verification workflows that are separate from the Property Matrix connector, Property Matrix uses Plaid’s identity-verification service. Property Matrix generates a Plaid-hosted URL, and the individual submits identity information, photographs of identity documents, and a selfie directly to Plaid on Plaid’s website. Property Matrix does not receive or store those identity documents or selfie images. Property Matrix receives and stores Plaid’s verification result.

Testimonials and public content

Property Matrix may publish customer names, titles, testimonials, or similar information only with the customer’s consent.

3. PROPERTY MATRIX CONNECTOR FOR CHATGPT AND CODEX

Tool inputs

When an authorized user invokes the Property Matrix connector, OpenAI sends Property Matrix the information needed for the selected tool. Depending on the request, inputs may include search text, filters, pagination parameters, dates, record identifiers, vendor or payer identifiers, lease or company identifiers, property or site-selection identifiers, payment-method type information, accounting allocations, amounts, memos, descriptions, lead contact information, maintenance-request content, filenames, temporary file-download URLs, ChatGPT file identifiers, and optional file metadata.

Free-text tool fields and uploaded files may contain personal, confidential, or customer-controlled information beyond the categories expressly listed above. Users and customers are responsible for ensuring they have authority to provide that information.

Tool outputs

Depending on the request, the connector may return the following categories to OpenAI for display to the requesting user in ChatGPT or Codex:

• Vendor identifiers, personal or company names, telephone numbers, billing email addresses, and primary email addresses.

• Lead identifiers, names, companies, telephone numbers, email addresses, budgets, referral sources, bedroom preferences, labels, and site identifiers.

• Property, site, or unit identifiers, names, status information, company display names, and opaque site-selection values.

• Maintenance-request identifiers and numbers, subjects, free-text descriptions, dates, status, categories, site details, and vendor names and email addresses.

• Lease identifiers and display names.

• Maintenance-category identifiers and names.

• Bill and invoice identifiers and numbers, dates, amounts, paid and outstanding balances, and vendor or payer identifiers and names.

• Internal accounting-account identifiers, names, and accounting-account numbers. These numbers are not identified as bank routing numbers.

• Payment-method type identifiers and names.

• API-application identifiers, names, origins, redirect URLs, client identifiers, and creation dates. Client secrets are not returned.

• Created or updated payment-accounting records, maintenance requests, lead records, attachment details, validation errors, and applicable warnings.

• Attachment identifiers, filenames, content types, byte sizes, creation dates, and PDF or image indicators.

Production capabilities

The deployed connector exposes 17 tools: 11 read tools and 6 write tools. Tool availability depends on the user’s authorization. The write tools can create or update accounting payment records, maintenance requests, leads, and attachments. Payment-related connector tools create accounting entries and allocations inside Property Matrix. They do not initiate real payment processing. The connector does not send payment or maintenance messages.

Information returned through the connector is provided to OpenAI so that ChatGPT or Codex can answer the user’s request. OpenAI’s separate handling of information is governed by OpenAI’s terms and privacy documentation.

4. PRODUCTION LOGGING AND DIAGNOSTIC DATA

Property Matrix logs connector requests for internal development, security, diagnostics, and service operation. Production logs may contain:

• MCP request bodies and tool arguments, including free-text supplied in a tool call.

• Attachment filenames, but not attachment file contents.

• IP addresses and browser user-agent strings.

• Timestamps, HTTP methods, and requested URLs or paths.

• HTTP response status codes and response sizes.

• HTTP basic-auth usernames.

• Request and correlation identifiers where generated by the applicable system.

Property Matrix does not intentionally log HTTP basic-auth passwords, OAuth access tokens, authorization headers, tool-response contents, or attachment file contents. When a user invokes the attachment-upload tool, the attachment itself is stored as an ordinary Property Matrix attachment as described below; it is not written into the text production logs.

Diagnostic emails may be generated for certain errors, including rejected attachment sources. Those emails may contain information needed to investigate the error.

5. SOURCES OF INFORMATION

Property Matrix obtains information:

• Directly from customers, users, website visitors, and people who contact Property Matrix.

• From customer-authorized users who enter or manage information about other individuals.

• From an authorized Property Matrix account when a connector tool retrieves or changes a record.

• From OpenAI when ChatGPT or Codex invokes an authorized connector tool.

• Automatically from browsers, devices, servers, cookies, and network activity.

• From authentication providers such as Google.

• From Plaid in the form of an identity-verification result for applicable merchant workflows.

• From service providers and customer-authorized integrations.

6. HOW PROPERTY MATRIX USES INFORMATION

Property Matrix may use information to:

• Create, administer, authenticate, and secure user and customer accounts.

• Provide the Services and perform the specific task requested by a user.

• Retrieve, display, create, update, store, and organize authorized Property Matrix records.

• Return connector results to OpenAI for display to the requesting user.

• Process and maintain accounting records and service-related transactions.

• Store and manage customer-uploaded attachments.

• Provide customer support and respond to privacy requests.

• Diagnose errors, investigate incidents, maintain logs, monitor reliability, prevent abuse, and protect the Services.

• Improve website navigation, remember preferences, and understand general website use.

• Send service announcements and operational communications.

• Send newsletters or promotional communications where permitted, subject to opt-out choices.

• Verify identity for applicable ProPay merchant workflows.

• Comply with legal obligations, enforce agreements, exercise legal rights, and respond to lawful requests.

Connector data is not used for analytics, marketing, advertising, profiling, sale or sharing for targeted advertising, or AI or model training. This connector-specific restriction does not prevent Property Matrix from using information separately collected through its website or ordinary customer relationship for the other purposes disclosed in this Policy.

7. HOW PROPERTY MATRIX DISCLOSES INFORMATION

OpenAI

Property Matrix transmits tool results to OpenAI so ChatGPT or Codex can present the requested information and complete the user-authorized workflow. The result may contain personal information about the user or other people represented in the customer’s account.

Infrastructure and service providers

Property Matrix uses service providers that support cloud hosting, databases, file storage, authentication, security, logging, email, customer support, backup, and disaster recovery. Property Matrix’s configured infrastructure includes Google Cloud for application, database, logging, and attachment storage, and Amazon Web Services for database backups and attachment mirrors. Property Matrix also uses internal or managed network-attached storage for backups.

Payment and verification providers

Property Matrix may disclose information to payment processors and identity-verification providers when needed for ordinary Property Matrix services. Plaid directly receives identity documents and selfie images in applicable merchant-verification workflows. Real payment processing is not enabled through the Property Matrix connector.

Customer-authorized recipients and integrations

Property Matrix may disclose information at a customer’s or user’s direction, to people authorized by the customer, or to integrations the customer has enabled.

Legal, safety, and corporate events

Property Matrix may disclose information when required by law or legal process; to protect rights, safety, systems, customers, or users; to investigate fraud or security incidents; or as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable confidentiality and legal requirements.

Property Matrix does not sell connector data or share connector data for targeted advertising.

8. DATA RETENTION

Business records

Property Matrix business records, including records created or updated through the connector, are generally retained indefinitely while the customer license remains active. They remain until the customer deletes the applicable record or the associated license is deleted, subject to logs, backups, legal requirements, and the exceptions described below.

Attachments

Uploaded attachments are retained until the customer deletes the attachment or the associated license is deleted. Attachments are stored in Google Cloud Storage and may be mirrored to Amazon S3. Deletion is propagated to the mirror, but soft-delete, object-versioning, and storage-lifecycle features may cause a deleted attachment to remain in protected storage for up to 30 days.

OAuth and authorization information

OAuth applications, access-token records, and authorization grants are retained indefinitely until a relevant deletion event occurs, such as deletion of the OAuth application, the associated login, or the entire customer license. Revocation can make an access token invalid before the stored token record is deleted.

Tool responses

Property Matrix does not maintain a separate archive of raw connector responses sent to the user. The underlying business records from which a response was generated remain subject to the applicable business-record retention period.

Logs, security records, and diagnostic emails

Exported production logs, security records, and diagnostic emails are currently retained indefinitely for restricted internal development, security, diagnostic, and operational purposes. Because connector request bodies are contained in production logs, tool arguments may remain in those archived logs indefinitely even after the corresponding active record or license is deleted. These archives are not available through the ordinary customer interface and may not be capable of selective record-by-record deletion.

Audit records

Audit records are generally retained while the customer license is active and until the license is deleted, subject to copies that remain in logs or backups.

Automated and manual backups

Property Matrix maintains approximately the last seven days of the production database in active automated backups across its backup systems. Property Matrix may also retain manually created disaster-recovery database backups for longer periods, including indefinitely. Deleting information from active production systems does not delete information already contained in historical backups. Backup information is access-restricted and used for disaster recovery, security, legal compliance, and related internal purposes.

Plaid verification results

Property Matrix retains the Plaid verification result until the relevant ProPay merchant record or the entire associated customer license is deleted. Plaid separately retains information submitted directly to Plaid according to Plaid’s own policies.

Support and legal retention

Property Matrix may retain support records, suppression records, and information needed to comply with law, resolve disputes, prevent fraud, enforce agreements, or establish, exercise, or defend legal claims for as long as reasonably necessary for those purposes.

9. SECURITY

Property Matrix uses administrative, technical, and organizational safeguards designed to protect information. Measures may include access controls, encryption in transit, encryption of selected stored values, account authentication, restricted developer access, monitoring, backups, and incident-response procedures. Some stored values, including passwords and designated confidential custom fields, are encrypted or cryptographically protected as applicable.

No system is completely secure. Users are responsible for protecting their account credentials, restricting access to authorized personnel, reviewing connector permissions, and avoiding the submission of unnecessary sensitive information.

10. USER CHOICES AND CONTROLS

Connector disconnection and authorization revocation

Users may disconnect the Property Matrix connector through their ChatGPT or Codex connection settings. Disconnecting prevents future connector access but does not delete business records previously created or updated through the connector.

Users may revoke authorization at:

https://app.propertymatrix.com/oauth/revoke

Authorized managers may manage or delete account-owned API applications through Settings > API Access > API Applications. Deleting an account-owned API application is different from disconnecting an individual user from a shared ChatGPT connection.

Marketing communications

Users may opt out of newsletters and promotional communications by using an unsubscribe mechanism where provided or by contacting info@propertymatrix.com or support@propertymatrix.com. Property Matrix may continue to send service, security, billing, or account communications that are necessary to provide the Services.

Cookies

Users may adjust browser settings to reject or delete cookies. Certain Services may not work as intended without necessary cookies.

Access, correction, export, and deletion requests

Users may request access to, correction of, export of, or deletion of personal information by contacting support@propertymatrix.com, calling 800-795-4100, or writing to the address in the Contact section.

Property Matrix may verify a request through an authenticated Property Matrix account, confirmation using the email address associated with the account, and other information reasonably necessary to confirm identity and authority. Information collected for verification will be used only to process the request.

Requests concerning an entire customer license must be submitted or confirmed by an authorized license administrator. An authorized agent may be required to provide evidence of authority.

Property Matrix generally confirms receipt of a privacy request within 10 business days and responds within 45 calendar days. Where permitted by law, Property Matrix may extend the response period by an additional 45 days and will provide notice of the extension.

When Property Matrix approves a deletion request, it deletes applicable information from active production systems, including associated active records, attachments, OAuth tokens, and authorization grants. Deletion may affect the requester’s or customer’s ability to use the Services.

Certain information may remain in archived production logs, security records, diagnostic communications, and backup copies. Those records may not be capable of selective deletion and may be retained for security, troubleshooting, disaster recovery, legal compliance, and the establishment, exercise, or defense of legal claims. They are access-restricted and are not available through the ordinary customer interface.

Property Matrix may deny or limit a request when it cannot reasonably verify the requester, when another customer controls the information, or when retention is permitted or required by law. Where required, Property Matrix will explain the reason for the decision.

Facebook-connected information

A user seeking deletion of information associated with a Facebook integration may email support@propertymatrix.com with the subject “Request to Delete Facebook Data” and identify the relevant Property Matrix account. Property Matrix may request additional information to verify the requester before completing the request.

11. PRIVACY RIGHTS

Depending on location and applicable law, individuals may have rights to know or access personal information, correct inaccurate information, request deletion, obtain a portable copy, opt out of certain sale or sharing, limit certain uses of sensitive information, withdraw consent, or appeal a decision. Property Matrix will not unlawfully discriminate against someone for exercising a privacy right.

Property Matrix does not sell personal information obtained through the connector or share it for cross-context behavioral advertising. Requests may be submitted using the methods described above.

12. CHILDREN

The Services are intended for businesses and authorized users and are not directed to children under 13. Property Matrix does not knowingly collect personal information directly from children under 13 through the connector. If Property Matrix learns that it has collected such information without appropriate authorization, it will take reasonable steps to delete it, subject to applicable law and the retention limitations described in this Policy.

13. INTERNATIONAL PROCESSING

Property Matrix and its service providers may process and store information in the United States and other locations where they operate. Those locations may have data-protection rules that differ from the rules where an individual lives. Property Matrix uses protections appropriate to the information and the applicable legal requirements.

14. CHANGES TO THIS POLICY

Property Matrix may update this Privacy Policy to reflect changes to the Services, connector tools, data practices, technology, or legal requirements. The updated version will be posted at https://www.propertymatrix.com/policy with a revised effective date. Where required, Property Matrix will provide additional notice of material changes.

15. CONTACT

Questions, privacy requests, and concerns may be directed to:

Property Matrix

6041 Bristol Pkwy #200b

Culver City, CA 90230

United States

Email: support@propertymatrix.com

General information and communications opt-out: info@propertymatrix.com

Telephone: 800-795-4100

Privacy policy: https://www.propertymatrix.com/policy

(Last Updated: October 12, 2026)