Privacy Policy

Effective date: May 29, 2026

1. Overview

Overlocked ("we," "us") provides cloud-based self-storage facility management software to operators ("Operators"), who in turn use the platform to manage relationships with their renters ("Renters"). This Privacy Policy explains what personal information we collect, how we use it, and the rights you have over that information.

2. Information We Collect

Operator account information. When an Operator signs up, we collect the names, email addresses, and phone numbers of the operator's staff users, a hashed password, business and billing address, and payment-method tokens. We never store raw payment-card numbers.

Renter information. When an Operator (or a Renter via the self-service portal) creates a Renter record, we may store name, email, mobile phone number, mailing address, government-ID details and ID images for identity verification, license-plate number, insurance documents, and unit-access credentials (gate code, PIN). The Operator is the data controller for Renter information; we are a data processor acting on the Operator's instructions under our Data Processing Addendum.

Usage information. We collect access logs, IP addresses, browser type, and pages visited to operate and secure the Service.

SMS consent records. When a Renter opts in to SMS, we record the timestamp, IP address, browser identifier, and the exact text version of the consent language they agreed to. This record is retained for the lifetime of the Renter relationship as proof of consent.

3. How We Use Information

  • To provide and improve the Service.
  • To send transactional communications (account alerts, billing notices, lien-process notices, maintenance updates) via email or — if you have opted in — SMS.
  • To process payments (via our payment-processing partners).
  • To detect, prevent, and respond to fraud, security incidents, and abuse.
  • To comply with legal obligations.

We do not sell your personal information. We do not share Renter information with third parties for marketing purposes.

4. SMS / Text Messages

SMS messages from Overlocked are sent only to Renters who have affirmatively opted in. The information you share when you opt in (mobile number, IP, consent timestamp) is used solely to deliver SMS and to demonstrate consent if asked. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. All categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

You may revoke consent at any time by replying STOP to any message we send, or by unchecking the SMS-consent box in your renter portal account settings. See our SMS / Text Message Communications section in the Terms of Service for details.

5. Service Providers (Subprocessors)

We share information with vendors ("subprocessors") who help us operate the Service, including:

  • Cloud hosting (Google Cloud Platform) — to run our infrastructure and store application data, in the United States.
  • Payment processing (Stripe) — to handle card and ACH transactions.
  • Email delivery (SendGrid) — to send transactional email.
  • SMS delivery (Twilio) — to send transactional SMS, only to Renters who have opted in.
  • AI features (Anthropic) — to power in-product AI assistance; prompt content is not used to train its models.

Each of these providers is contractually bound to use information only to provide services to us, and to maintain commercially reasonable security practices. The current, authoritative list of our subprocessors — including each vendor's function, the data category it receives, and its location — is published at overlocked.io/subprocessors. We notify customers at least 30 days before a new subprocessor begins processing customer data.

6. Data Retention

We retain personal information only as long as needed for the purposes described in this Policy. Retention windows follow our internal data classification policy, which sets handling and retention requirements by data sensitivity level. In practice:

  • Account and renter records are retained for the duration of your relationship with us, plus a reasonable period thereafter to comply with legal obligations and resolve disputes.
  • Audit-log records (including SMS-consent capture and revocation) are retained for the lifetime of the account as a tamper-evident record.
  • Verified deletion requests are honored as required by applicable law, subject to our legal and financial-record retention obligations.

7. Your Rights

Overlocked provides the Service to storage Operators, who are the businesses you rent from. For most personal information the Operator, not Overlocked, decides how your information is used (the controller / "business"), and Overlocked acts as their service provider (processor).

Depending on your jurisdiction (including California under the CCPA/CPRA and, where applicable, the EU/EEA and UK under the GDPR), you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing without discrimination.

How to exercise these rights: If your information is held by an Operator through the Service, please contact that Operator directly — they manage your records and are responsible for responding to your request; Overlocked will assist the Operator in locating, exporting, or deleting your information. For information Overlocked holds in its own right (for example, if you are one of our Operator customers), or if you cannot reach your Operator, contact us at privacy@overlocked.io and we will route or respond to your request. Because requests are fulfilled together with the relevant Operator, response times may vary; we work to acknowledge requests promptly and to complete verified requests as required by applicable law.

8. Security

We use commercially reasonable measures to protect personal information, including encrypted transport (HTTPS), encrypted storage, isolated tenant boundaries, audit logs of administrative actions, and least-privilege access for engineers and support staff. No system is perfectly secure, however, and we cannot guarantee that personal information will never be accessed by unauthorized parties.

9. Cookies

We use only strictly-necessary, functional cookies — a session cookie to keep you signed in and, where applicable, a cookie used to route you to the correct operator account (tenant). We do not use advertising cookies, third-party analytics cookies, or cross-site tracking, so no cookie consent banner is required for the Service. Because these cookies are essential to the Service, disabling them in your browser may prevent you from signing in or using the portal.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version here and update the "Effective date" at the top. Material changes affecting how we use Renter information for SMS or email will be communicated to affected users.

11. Contact

Questions about this Privacy Policy can be directed to privacy@overlocked.io.