Croskey Real Estate (DRE# 01990430) is committed to being transparent about how we collect, use, and protect your personal information. This Privacy Policy covers every surface where Croskey Real Estate collects personal information — the Stewardship owner portal (stewardship.croskeypm.com), the public property management site (croskeypm.com), rental applications, email marketing sign-ups, and SMS communications.
1. Who We Are
Croskey Real EstateDRE License: 01990430
Principal Broker: Wolfgang Croskey (DRE# 01708438)
745 Railroad Ave., Pittsburg, CA 94565
Email: wolf@homesbycroskey.com
Phone: (925) 759-2906
2. Scope of This Policy
This policy applies to personal information collected through:
- stewardship.croskeypm.com — the invitation-only owner portal for property owners under management
- croskeypm.com — the public property management website, including rental applications and newsletter sign-ups
- SMS communications — transactional and marketing text messages sent by Croskey Real Estate
- In-person interactions — paper rental applications, walk-in inquiries, and in-office meetings
- Telephone calls — inquiry calls, maintenance coordination, and leasing calls
This policy does not cover the practices of third-party websites we link to. Where a third party's data practices are material to your decision to share information with us (such as Plaid for bank verification), we describe those practices in the relevant section below.
3. Information We Collect — By Surface
3a. Stewardship Owner Portal (stewardship.croskeypm.com)
The Stewardship portal is a private, invitation-only platform for property owners whose properties are managed by Croskey Real Estate.
Account and identity information:
- Full name and email address
- Phone number (used for authentication and notifications)
- Properties associated with your ownership interest
- Time zone preference
- Authentication credentials (passkeys, TOTP authenticator app settings, and/or SMS OTP registration)
Financial and payment information (when you connect a bank account):
- Bank institution name
- Last 4 digits of the bank account
- Account type (checking or savings)
- Stripe payment method identifier (an opaque token, not an account number)
We do not store your raw bank account number or routing number. These never touch our systems — they remain within Plaid's custody as part of the bank verification flow (see Section 7).
3b. Rental Applications
Prospective tenants submit rental applications through croskeypm.com or in person. We collect the information necessary to evaluate an application and verify your identity and qualifications.
- Full legal name, date of birth, and Social Security Number (SSN)
- Current and prior residential addresses
- Employment status, employer name, and income information
- References (personal and professional)
- Government-issued identification documents
- Rental history and landlord references
- Pet information (if applicable)
SSN and DOB handling: SSNs and full dates of birth are transmitted directly to our consumer reporting agency for screening purposes and are not retained in our systems after the screening decision is made. We store only the last 4 digits of the SSN after that point.
Consumer reporting disclosure: Tenant screening is governed by the federal Fair Credit Reporting Act (FCRA), the California Investigative Consumer Reporting Agencies Act (ICRAA, Civil Code § 1786 et seq.), and the California Consumer Credit Reporting Agencies Act (CCRAA, Civil Code § 1785 et seq.). Before initiating a background check, we provide the required written disclosure and obtain your authorization.
Adverse action: If we take an adverse action based in whole or in part on a consumer report, we will provide a written adverse action notice that includes the name and contact information of the consumer reporting agency and notice of your rights to obtain a free copy of the report and to dispute its accuracy.
Retention: Rental application records are retained for 3 years from the date of the application decision. SSNs and full dates of birth are not retained beyond the date of the screening decision.
3c. Newsletter and Email Marketing
You can subscribe to Croskey Real Estate newsletters and local market updates on croskeypm.com.
Opt-in: Subscription is explicit. You must affirmatively check a subscription checkbox or submit a form specifically for marketing emails. We do not add you to marketing lists as a result of a rental application, owner onboarding, or any other transaction.
CAN-SPAM compliance: Every marketing email includes a clear identification of the sender, a valid physical mailing address, and a clear unsubscribe link. Unsubscribe requests are honored within 10 business days.
CCPA: We do not sell or share your email address with third parties for their marketing purposes. You may request deletion of your email from our marketing list at any time by contacting wolf@homesbycroskey.com.
3d. Website Usage Data
When you visit our websites, we may collect pages visited, browser type and operating system, referring URL, and IP address (anonymized for analytics). This data is used solely to understand how visitors use our sites and is not used to identify individual visitors or build behavioral profiles.
4. SMS Communications and Opt-In
Croskey Real Estate sends text messages (SMS) to people with whom we have an existing relationship. We operate two distinct SMS programs with separate opt-in requirements.
4a. Transactional and Operational SMS
Who receives these messages: Current tenants, Stewardship portal owners, and applicants in an active process.
What these messages cover: Maintenance request updates, lease renewal reminders, owner contribution payment confirmations, portal authentication OTP codes, and time-sensitive property management notifications.
Opt-in: By providing a phone number when submitting a rental application, signing a lease, or enrolling in the Stewardship portal, you consent to receive transactional text messages related to that relationship.
4b. Marketing SMS
What these messages cover: Available rental property announcements, local real estate market updates, and property management educational content.
Opt-in: Explicit written consent is required before any marketing SMS is sent. Consent is never inferred from a business relationship or any other transaction. We will confirm your opt-in with an initial confirmation message.
Consent cannot be purchased, assigned, or traded. We do not acquire marketing SMS consent from third-party data brokers, lead lists, or any other source. Every marketing SMS recipient has consented directly to Croskey Real Estate.
4c. Required SMS Disclosures (All Programs)
- Message and data rates may apply. Standard carrier messaging and data rates apply to all SMS messages sent by or to Croskey Real Estate.
- Message frequency may vary based on your relationship with us and the type of program you are enrolled in.
- To stop receiving SMS messages, reply STOP to any text message from us. You will receive one confirmation message and no further messages from that program.
- For help, reply HELP to any text message from us, or contact us at wolf@homesbycroskey.com or (925) 759-2906.
- We will not share your phone number with third parties for their marketing purposes.
5. How We Use Your Information
| Purpose | Information Used |
|---|---|
| Deliver property management services | Owner, tenant, and property data |
| Evaluate rental applications | Application data, consumer reports |
| Verify identity and secure accounts | Authentication data, identity documents |
| Process payments and owner contributions | Bank account data, payment records |
| Send transactional SMS and email | Contact information, relationship context |
| Send marketing communications (with consent) | Email address, phone number (opted-in only) |
| Comply with legal obligations | Financial records, screening records |
| Maintain a tamper-evident audit trail | All significant portal and agent actions |
| Improve our services | Anonymized usage data |
We do not use your information for advertising networks, behavioral profiling, or any purpose unrelated to your relationship with Croskey Real Estate.
7. Plaid — Bank Account Verification
The Stewardship portal uses Plaid to verify your bank account before initiating ACH transfers.
What Plaid Does
Plaid is a financial technology company that provides a secure, bank-authorized connection between your financial institution and apps you choose to connect. When you add a bank account in the portal, Plaid's Link interface opens in your browser. You log into your bank directly within Plaid's interface — Croskey Real Estate never sees your bank username or password.
What Data Plaid Collects and What We Receive
Through the Plaid Link flow, Plaid collects the financial account information you authorize. Plaid uses this to generate a secure processor token.
Croskey Real Estate receives from Plaid: a processor token, your bank's institution name, account type, and the last 4 digits of your account — nothing more.
We use Plaid data for one purpose only: bank account verification and payment processing. We do not use it for credit decisions, marketing, or screening.
Plaid's Privacy Policy
Plaid is an independent company with its own privacy practices: plaid.com/legal/privacy-policy
Revoking Plaid Access
You can revoke Plaid's access to your bank account at any time through my.plaid.com, where you can view all connected apps and disconnect them individually. You can also contact us at wolf@homesbycroskey.com to request removal of your bank account from the portal, which will invalidate the associated Plaid connection on our end.
8. Financial Data — Storage, Retention, and Security
What We Store
After the Plaid verification flow completes, we store only: bank institution name, last 4 digits, and account type; an encrypted Plaid access token; and a Stripe payment method identifier. All fields are encrypted at the application layer before being written to the database, in addition to AES-256 infrastructure-level encryption.
Retention Periods
| Data | Retention Period | Basis |
|---|---|---|
| Payment method records | 7 years from last activity | California Corporations Code; federal tax requirements |
| Owner contribution transaction records | 7 years from transaction date | Same |
| Payment audit log entries | Permanent | Tamper-evident audit chain; legal defensibility |
| Portal user identity data | Duration of relationship + 7 years | Business continuity; legal claims period |
| Rental application records | 3 years from application decision | FCRA recordkeeping |
| SSN and full date of birth | Not retained after screening decision | Data minimization |
| Marketing email opt-in records | Duration of subscription + 3 years | CAN-SPAM; proof of consent |
| SMS consent records | Duration of opt-in + 4 years | TCPA statute of limitations |
9. Authentication and Security
The Stewardship portal uses multiple layers of authentication:
- Passkeys (WebAuthn): Device-based cryptographic authentication that cannot be phished.
- TOTP: Authenticator app codes (Google Authenticator, Authy, etc.) as a second factor.
- SMS OTP: One-time codes sent to your registered phone number.
- Step-up authentication: Payment actions require re-verification within a 15-minute window.
- Encryption at rest: AES-256 infrastructure-level encryption on all data. Sensitive fields receive additional application-layer encryption.
- Encryption in transit: All connections use TLS. Unencrypted HTTP connections are rejected.
- Audit trail: All significant actions are written to a hash-chained, INSERT-ONLY audit log that cannot be modified or deleted after the fact.
- No raw bank credentials stored: Your bank username, password, account number, and routing number are never transmitted to or stored by Croskey Real Estate.
10. CCPA — Categories of Personal Information Collected
| Category | Examples | Sources | Business Purpose | Shared With |
|---|---|---|---|---|
| Identifiers | Name, email, phone, IP address | You, directly | Account management, authentication | Service providers (Supabase, Twilio, email provider) |
| Government identifiers | SSN (applicants only), driver's license | You, directly | Tenant screening; identity verification | Consumer reporting agency (not retained after decision) |
| Financial information | Bank account type and last 4 digits, payment records | You, Plaid, Stripe | Payment processing; contribution management | Plaid, Stripe, AppFolio |
| Protected classification characteristics | Date of birth (applicants only) | You, directly | Age verification for legal contracting | Consumer reporting agency (not retained after screening decision) |
| Commercial information | Property ownership, lease terms, transaction history | You, AppFolio | Property management services | AppFolio, service providers as needed |
| Internet or network activity | Login timestamps, session identifiers, pages visited | Automatically collected | Security auditing; service improvement | Supabase (infrastructure) |
| Geolocation data | IP address (city-level approximation only) | Automatically collected | Security monitoring | None |
| Professional or employment-related info | Employer name, job title, income (applicants) | You, directly | Rental application evaluation | Consumer reporting agency |
| Sensitive personal information | SSN (temporary, applicants only); bank data via Plaid (not stored) | You, directly | Screening; payment verification | Consumer reporting agency; Plaid/Stripe only |
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
11. Your California Privacy Rights (CCPA)
If you are a California resident, the CCPA, as amended by the CPRA, gives you the following rights:
- Right to Know. Request disclosure of specific pieces of personal information we hold about you, categories collected, sources, business purpose, and categories of third parties we disclose to.
- Right to Delete. Request deletion of personal information we have collected, subject to legal exceptions (for example, records we are required to retain under FCRA or California law).
- Right to Correct. Request correction of inaccurate personal information.
- Right to Opt-Out of Sale or Sharing. We do not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of, but you are entitled to this disclosure.
- Right to Non-Discrimination. Exercising your privacy rights will not result in denial of services, different prices, or any other penalty.
How to Submit a Request
Wolfgang Croskey, CEO & Principal BrokerEmail: wolf@homesbycroskey.com
Phone: (925) 759-2906
Mail: 745 Railroad Ave., Pittsburg, CA 94565
Requests are processed within 45 days of receipt. We will verify your identity before processing any request.
12. Federal Privacy Rights for Rental Applicants (FCRA, ICRAA, CCRAA)
- Right to know you were screened. We will inform you in writing before ordering a consumer report and obtain your written authorization.
- Right to an adverse action notice. If we decline or conditionally approve your application based on a consumer report, we will send a written adverse action notice identifying the consumer reporting agency and explaining your rights.
- Right to a free copy of your report. Following an adverse action, you may request a free copy within 60 days from the reporting agency.
- Right to dispute inaccurate information. You may dispute the accuracy of information in your consumer report directly with the reporting agency.
- Right to an investigative consumer report copy (ICRAA). Under California law, if an investigative consumer report was obtained, you have the right to request a copy within 60 days of an adverse action notice.
13. Children's Privacy
Our services are intended for adults in a business or contractual relationship with Croskey Real Estate. We do not knowingly collect personal information from individuals under 18 years of age. Contact us at wolf@homesbycroskey.com if you believe we have received information from a minor.
14. Changes to This Policy
When we make material changes to this policy, we will:
- Update the effective date at the top of this page
- Notify active Stewardship portal users by email
- Post a notice on croskeypm.com for 30 days following a material change
15. Contact Us
Wolfgang Croskey, CEO & Principal BrokerCroskey Real Estate, DRE# 01990430
745 Railroad Ave., Pittsburg, CA 94565
Email: wolf@homesbycroskey.com
Phone: (925) 759-2906
For privacy-specific requests (CCPA rights, opt-out, data correction), include "Privacy Request" in the subject line of your email so it is routed promptly.
This Privacy Policy is effective as of May 16, 2026. | Croskey Real Estate, DRE# 01990430 | Principal Broker: Wolfgang Croskey, DRE# 01708438