Privacy Policy

1. Who We Are

G Legacy Foundation (“GLF,” “we,” “us,” or “our”) is a California nonprofit public benefit corporation providing affordable rental housing in Sacramento, California. This Privacy Policy explains how we collect, use, store, and share information through glegacyfoundation.com (the “Site”).

If you have questions about this Privacy Policy, contact us at glegacyfoundation@gmail.com.

2. Information We Collect

2.1 Information You Provide

When you submit a rental application, we collect:

• Full legal name
• Date of birth
• Email address and phone number
• Current address
• Requested move-in date
• Employer name, position, monthly income, and years employed
• Number of household occupants
• Personal reference name, relationship, and phone number
• Government-issued photo ID
• Two most recent paystubs
• Any additional supporting documents you choose to upload
• Your digital signature and the date of submission

When you check your application status, we use the full legal name you enter to look up your application.

When you sign a lease through this Site (where applicable), we collect:

• Your typed digital signature
• The signed lease file you upload
• Timestamps and IP address associated with the signing event

2.2 Information Collected Automatically

• Server logs. Our hosting providers automatically log standard web request data, including IP address, browser type, pages visited, and dates and times of access.
• Authentication cookies. We use cookies to keep our administrator signed in. We do not use third-party analytics, advertising, or tracking cookies on this Site.

We do not use Google Analytics, Meta Pixel, or any similar third-party tracking technology.

3. How We Use Your Information

We use the information you provide to:

• Process and evaluate your rental application
• Communicate with you about your application status
• Generate, deliver, and execute lease agreements when applicable
• Comply with legal obligations including fair-housing record-keeping and tax requirements
• Maintain the security and reliability of the Site

We do not sell your personal information. We do not use your information for marketing, advertising, or profiling.

4. How We Share Your Information

We share your information only with:

• GLF’s authorized administrator(s), who are designated by the foundation’s leadership and bound by confidentiality obligations.
• Service providers that help us operate the Site. We require each to handle your information in accordance with applicable law and only for purposes consistent with this Policy:
  • Supabase, Inc.(US-East region) — hosts the encrypted database where your application records and signed lease records are stored, and provides the private, encrypted file storage where your uploaded supporting documents (photo ID, paystubs, and any additional documents you choose to upload) are kept. Access to these files is restricted to authorized administrators and is granted only through short-lived, individually generated links — the files are never publicly accessible.
  • Vercel, Inc.— provides website hosting and edge infrastructure.
  • Resend— delivers email notifications about your application and lease. To protect your privacy, these notification emails contain only your name, the property you applied for, and your contact information — never your income, identity documents, or other sensitive details.
  • Google LLC (Gmail)— receives emails sent to glegacyfoundation@gmail.com.

We may also disclose information if required by law, valid legal process, or to protect our rights and the rights of others.

5. How Long We Keep Your Information

• Application records— including your name, contact information, date of birth, current address, requested move-in date, employment and income details, household and reference information, digital signature, and uploaded supporting documents (photo ID, paystubs, and any additional documents you provided): retained for two (2) years from the date a decision is made on your application, then deleted.
• Approved tenant records, including the executed lease: retained for the duration of your tenancy plus four (4) years after your tenancy ends. This retention period is consistent with the typical statute of limitations on housing and fair-housing claims under California law.
• Email communications. Emails sent through Resend may be retained in our Gmail inbox for record-keeping purposes consistent with the retention periods above. You may request deletion of specific emails subject to our legitimate record-keeping needs.
• Server logs.Typically retained by our infrastructure providers for 30–90 days and then automatically deleted.

6. How We Protect Your Information

We use the following measures to protect your information:

• All data is transmitted over encrypted HTTPS connections.
• The database enforces row-level security policies that restrict access to authorized personnel only.
• Uploaded supporting documents are kept in a private, non-public storage bucket. Authorized staff access individual files only through short-lived, signed links that expire after a short period.
• Administrator access requires authenticated sign-in.
• Industry-standard security headers and access controls are applied site-wide.

No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you as required by California Civil Code §1798.82 and applicable federal law.

7. Your Rights as a California Resident

As a California resident, you have the right to:

• Know what personal information we have collected about you, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
• Access a copy of the personal information we hold about you.
• Delete your personal information, subject to limited exceptions (for example, active tenancy records or records we are required to retain by law).
• Correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of your personal information. We do not sell or share personal information for advertising purposes, so this right is automatic.
• Non-discrimination. We will not deny you services, charge different prices, or provide a lesser quality of service because you exercised any of these rights.

To exercise any of these rights, contact us at glegacyfoundation@gmail.com. We will respond within 45 days. We may need to verify your identity before fulfilling certain requests.

8. Children's Information

This Site is intended for adults aged 18 and older. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, please contact us immediately and we will delete it.

9. Cookies and Tracking Technologies

We use only the cookies essential to operate the Site — specifically, an authentication cookie that maintains an administrator sign-in session. We do not use cookies for advertising, marketing, profiling, or analytics. We do not allow third parties to set cookies on the Site.

10. International Users

This Site is operated from the United States. If you access the Site from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may be different from those in your country.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or applicable law. When we make material changes, we will update the Effective Date at the top of this Policy and may provide additional notice on the Site.

12. Contact Us

For any privacy-related question, request, or concern:

G Legacy Foundation
Email: glegacyfoundation@gmail.com
Website: glegacyfoundation.com