Companion Privacy Policy

Last updated: October 29, 2026

How 214 Labs LLC handles information in the Companion (CompanionPMA) software, including data from QuickBooks Online.

This policy explains how 214 Labs LLC (“214 Labs,” “we,” “us”), a Texas limited liability company, handles information in Companion, our property-management automation software that runs alongside AppFolio, Buildium and Rentvine. It applies to the Companion application. Our marketing website and waitlist are covered by the CompanionPMA.com privacy policy, and Our Websites below summarizes what our public websites load. How Companion measures use of the application is described in Analytics and Session Recording in Companion.

Companion is used by property-management organizations (our “Customers”). For records a Customer puts into Companion about its residents, applicants, owners and vendors, we act on the Customer's behalf and under its instructions. Questions about how a Customer uses that information should go to that Customer.

Information We Collect

• Account information. Names, work email addresses, phone numbers, roles and sign-in settings (including two-factor authentication) for the people a Customer authorizes to use Companion.
• Customer Data. Records a Customer and its users enter or upload, such as properties, units, work orders, inspections, photos and videos, vendor details, messages, and contact information for residents, applicants and owners.
• Communications. Depending on the features a Customer uses, Companion handles the Customer's email, text messages, phone calls, voicemail, physical mail and emergency pages with residents, owners, vendors and staff. This can include message content, call and message details such as phone numbers and times, and, where the Customer's settings provide for it, call recordings, voicemail recordings and transcripts, including calls answered by Companion's AI phone agent. This information is Customer Data, and we process it on the Customer's behalf.
• Data from connected services. When a Customer connects a service such as QuickBooks Online, AppFolio, Buildium or Rentvine, the data Companion reads from it with the Customer's authorization. QuickBooks data is described in its own section below.
• Usage and security data. Sign-in events, audit logs of significant actions, IP addresses, browser and device type, performance measurements and error logs, used to operate and secure the service.
• Product analytics and session recordings. How signed-in users move through Companion, such as pages viewed, clicks, scrolling and mouse movement, recorded with the text on screen and everything typed hidden, as described in Analytics and Session Recording.

QuickBooks Online Data

A Customer's administrator can choose to connect a QuickBooks Online company to Companion. The connection uses Intuit's OAuth 2.0 sign-in, so we never see or store the Customer's Intuit password.

• What we access. Companion requests one OAuth scope, com.intuit.quickbooks.accounting. With it, Companion reads the connected company's accounting data needed for reporting, which may include company information, the chart of accounts, customers, vendors, invoices, bills, payments, other transactions and financial reports. The connection is read-only: Companion never creates, edits or deletes anything in QuickBooks and never initiates a payment or movement of money.
• How we use it. Only to provide Companion to the Customer that connected it: producing financial and portfolio reporting inside that Customer's instance, and supporting and securing that feature. We do not use QuickBooks data for advertising or marketing, and we do not combine it with other Customers' data. QuickBooks data is never used to train AI models, whether ours or anyone else's.
• We do not sell or share it. QuickBooks data is never sold, rented or traded, and it is never shared outside 214 Labs. The only exceptions are the service providers that host and operate Companion on our behalf, such as Microsoft Azure, which may process it only to provide their services to us and under confidentiality obligations, and disclosures required by law.
• How we store and secure it. QuickBooks data and OAuth tokens are stored in Companion's hosting environment on Microsoft Azure in the United States. Data is sent over encrypted connections. Access and refresh tokens are stored encrypted, are never displayed, and are used only to read the connected company's data. Access within Companion is limited by the Customer's roles and permissions.
• Disconnecting. An administrator can disconnect QuickBooks at any time in Companion's integration settings, or from the Apps area of QuickBooks Online. When Companion is disconnected, we revoke the token with Intuit, delete the stored tokens and stop all further reads.
• Retention and deletion. We keep QuickBooks data only while the connection is active and needed to provide the service. After a disconnect, or when the Customer's subscription ends, we delete the QuickBooks data we imported within 30 days, or sooner on request. Copies in routine backups are deleted as those backups expire on their normal cycle.

Our Websites

Our public websites are informational. The 214 Labs website and these policy pages do not load analytics, advertising or other third-party scripts and do not set cookies. The CompanionPMA.com website does not load analytics or advertising tags unless a visitor accepts them in its cookie banner; it is covered by its own privacy policy. Like any website host, our hosting provider, Cloudflare, processes the technical information browsers send, such as IP address and browser type, to deliver and protect the sites on our behalf.

Analytics and Session Recording in Companion

Inside the signed-in Companion application, we use two Microsoft tools to keep the service working and to understand how it is used.

• Azure Application Insights (performance and error monitoring). Companion sends Application Insights technical records about requests, errors and performance, which can include IP address, browser and device details, the page or feature used and an account or session identifier. Microsoft processes this information for us as our service provider under its data protection terms, and may not sell it or use it for its own purposes.
• Microsoft Clarity (usage analytics and session recording). Clarity records how signed-in users interact with Companion's screens, such as clicks, scrolling, mouse movement and pages viewed, together with device and browser details, an approximate location derived from IP address, and a Clarity cookie identifier, so we can see where the software is confusing or broken. We configure Clarity to mask the text on Companion's screens and everything typed into it, so masked content, including Customer Data such as resident, owner and financial records, is never sent to Microsoft. We do not use Clarity's advertising integrations, and we do not load Clarity on pages used by vendors or others who have not accepted our Terms.

Microsoft Clarity is not our service provider. Under Clarity's terms, Microsoft acts as an independent controller of the data it collects and may use it for its own purposes under the Microsoft Privacy Statement, which can include improving its products and providing Microsoft Advertising. Microsoft collects or receives personal data from Companion through Clarity, including to provide Microsoft Advertising. Because of this, providing Clarity data to Microsoft may be considered a “sale” or “sharing” of personal information, or targeted advertising, under some state privacy laws. We treat it that way and let you opt out, as described in Your Privacy Choices. You can also learn how Microsoft uses data at microsoft.com/privacy.

Both tools may use cookies or similar browser storage. Blocking them in your browser does not stop Companion from working. Except as described in this section, we do not use advertising pixels, advertising cookies or other third-party tracking in Companion.

How We Use Information

• To provide, maintain and support Companion for the Customer that the information belongs to.
• To secure the service, including authenticating users, preventing abuse and investigating incidents.
• To find and fix errors and understand how Companion is used so we can improve it, using the analytics described above.
• To communicate with Customers and users about their accounts, the service and support requests.
• To comply with law and enforce our Terms.

Some Companion features use automated and AI-assisted processing to draft text, classify records or summarize information for the Customer. That processing is performed to provide the feature to that Customer, and a person should review the output before relying on it.

Customer Data, including QuickBooks data, is never used to train AI models, whether ours or anyone else's. Customer Data is never sold, and it is never shared outside 214 Labs, except with the service providers that host and operate Companion on our behalf, such as Microsoft Azure, under confidentiality obligations, and where disclosure is required by law.

Service Providers and Disclosure

Companion is hosted on Microsoft Azure in the United States. We use service providers to send email and text messages, carry phone calls and voicemail, process payments, monitor performance and errors, provide AI-assisted features and support other features of the service. They may process information only to provide their services to us. Microsoft Clarity is the exception: it is a third party that receives the usage data described in Analytics and Session Recording, with screen text and typed content masked, and uses it under its own terms. We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, subject to this policy.

Retention and Deletion

We keep Customer Data for as long as the Customer's subscription is active. When a subscription ends, the Customer may ask us to export its data before termination takes effect. We then delete Customer Data, including imported QuickBooks data, within 30 days, unless the law requires us to keep it longer. Copies in routine backups are deleted as those backups expire on their normal cycle.

Security

Our safeguards include encrypted connections, hashed passwords, two-factor authentication, lockout after repeated failed sign-ins, encryption of stored integration credentials, role-based access checks, audit logging and routine backups. No safeguard is perfect, and we do not claim any security certification or audit report. If you believe an account has been compromised, email us immediately.

Your Choices and Rights

Customers can disconnect integrations, remove users and ask us to export or delete their data at any time. Individuals can ask to see, correct or delete their information; where the information belongs to a Customer, we will work with that Customer to respond. Residents of California and some other states have additional rights, described in California Privacy Rights and Other U.S. State Privacy Rights.

California Privacy Rights

This section is for California residents and supplements the rest of this policy. It is written to meet the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). Words such as “personal information,” “sell,” “share” and “service provider” have the meanings the CCPA gives them.

Our Two Roles

For personal information in Customer Data, including records about a Customer's residents, applicants, owners and vendors and data from connected services such as QuickBooks Online, we act as the Customer's service provider. We process it only to provide Companion to that Customer under a written contract, our Terms, that limits how we may use it. If you are a resident, applicant, owner or vendor of a Customer, please send requests about that information to the Customer. If you send one to us, we will tell you which Customer to contact or pass it on and help that Customer respond.

For account information about the people who use Companion, and for the usage and security data we collect to run the service, we decide how the information is used. The rights described below apply to that information.

Personal Information We Collected in the Last 12 Months

We do not collect precise geolocation, biometric or health information for our own purposes, and we do not draw inferences to build profiles about people.

Each Customer decides whether calls are recorded or transcribed, and is responsible for giving any notice and obtaining any consent that call-recording laws require from the people on those calls.

Sale and Sharing

We do not sell personal information for money, and we do not use advertising pixels or advertising cookies in Companion or on our websites. However, because Microsoft receives Clarity usage data as an independent third party and may use it for its own purposes, including advertising, providing that data may be considered a “sale” or “sharing” under the CCPA. In the last 12 months, the categories that may have been sold or shared in this way are identifiers (cookie identifiers and IP address), internet or other electronic network activity (usage data and masked session recordings) and approximate geolocation, and the category of third party that received them is analytics providers (Microsoft). Customer Data, including QuickBooks data, is masked and is not sold or shared. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

We use sensitive personal information only for purposes the CCPA permits, such as signing you in and keeping accounts secure, so we do not offer a “Limit the Use of My Sensitive Personal Information” link.

Your Privacy Choices: Opting Out

You can opt out of the sale or sharing of your personal information, and of targeted advertising, in either of these ways:

• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out for that browser and, if you are signed in, for your account. Companion does not load Microsoft Clarity in a browser that sends the signal. You do not need to do anything else.
• Email. Email Office@CompanionPMA.com with the subject “Do Not Sell or Share” from the email address on your Companion account. You do not need to verify your identity to opt out. We will stop loading Clarity for your account as soon as we can, and no later than 15 business days after we receive your request.

Opting out does not affect your use of Companion. It does not change the performance and error monitoring we use to run and secure the service, because that information is handled by our service provider.

Your California Rights

• Right to know and access. You can ask what personal information we have collected about you, the categories of sources, our purposes, the categories of recipients, and for a copy of the specific pieces of information.
• Right to delete. You can ask us to delete personal information we collected from you, subject to exceptions the law allows, such as completing a transaction, security, or a legal obligation.
• Right to correct. You can ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing. You can opt out at any time, as described in Your Privacy Choices.
• Right to limit use of sensitive personal information. You have this right, although we use sensitive personal information only for permitted purposes.
• Right to non-discrimination. We will not deny you service, charge a different price, provide a different level of quality, or retaliate against you or an employee, applicant or contractor for exercising any of these rights.

How to Make a Request

Email Office@CompanionPMA.com with the subject “Privacy Request,” and tell us which right you want to use. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we may extend that once by up to another 45 days, and we will tell you why within the first 45.

Verification. To protect your information, we verify requests before acting on them. We usually do this by matching the email address you write from to an account, and we may ask for one or two more details we already hold, or ask you to confirm the request from your signed-in account. We use the information you give us only to verify and respond to the request. Requests for specific pieces of information or to delete sensitive information need a higher degree of certainty.

Authorized agents. You may use an authorized agent. The agent must give us your signed permission, and we may ask you to verify your identity with us directly or to confirm that you gave the agent permission. We do not require this if the agent holds a valid power of attorney under California Probate Code sections 4121 to 4130.

How Long We Keep Information

• Account information and sign-in credentials: while the user's account is active, then deleted with the Customer's data after the subscription ends.
• Customer Data and data from connected services: while the Customer's subscription or connection is active, then deleted within 30 days after it ends, as described above.
• Usage, audit and security logs: for as long as needed to secure the service and investigate incidents, then deleted with the Customer's data after the subscription ends unless needed for an open investigation.
• Billing and order records: for as long as tax, accounting and other laws require us to keep them.
• Backups: until the backup expires on its normal cycle.

Other U.S. State Privacy Rights

Residents of other states with comprehensive privacy laws, including Virginia, Colorado and Texas, may have similar rights. Depending on where you live, these include the right to confirm whether we process your personal data and to access it, to correct it, to delete it, to get a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do not sell personal data for money or use it for profiling that produces legal or similarly significant effects. Our use of Microsoft Clarity, described in Analytics and Session Recording, may be considered a sale of personal data or targeted advertising under some of these laws, and you can opt out of it as described in Your Privacy Choices, including with Global Privacy Control or a similar browser signal. We process the categories of personal data, for the purposes, and with the categories of recipients and third parties described in the California table above. We do not sell sensitive personal data or biometric data.

To make a request, email Office@CompanionPMA.com as described above. We will respond within 45 days, and may extend that once by another 45 days when reasonably necessary, telling you why. Requests are free up to twice a year. Where we act as a Customer's processor, we will direct you to the Customer and help it respond.

Appeals. If we decline to act on your request, we will explain why. You can appeal by replying to our decision, or by emailing Office@CompanionPMA.com with the subject “Privacy Appeal,” within a reasonable time. We will tell you in writing what we did or did not do, and why, within 45 days of receiving the appeal. If we deny your appeal, you may contact your state attorney general. Texas residents may file a complaint with the Texas Attorney General.

Changes to This Policy

We may update this policy. We will post the updated version here with a new “last updated” date, and give Customers notice of material changes.

Contact

214 Labs LLC, College Station, Texas. Email Office@CompanionPMA.com with any privacy question or request.