Trust
When one of your residents asks to see or delete their data, here's how to relay that to PropSocket — what we'll do, how fast, and the one thing we honestly can't do.
Last reviewed: 2026-07-11
Under privacy laws like GDPR and CCPA, the relationship works like this:
You
Data controller
You decide what resident data is collected and why. Your resident's request comes to you first — you own the relationship with them and the legal duty to respond.
PropSocket
Data processor
We hold a copy of that data because you connected your PMS to us. We act on your instructions — including a verified instruction to delete or produce a resident's records.
In practice: a resident sends their request to you (the rental operator or PropTech company). You verify it's a legitimate request from a real person — that part stays with you, because you're the one who knows the resident. Then you relay it to us so we can act on our copy of the data.
Once we've confirmed a verified deletion request, we hard-delete the affected records from our active systems within 30 days. The same 30-day window applies whether the request is a resident's "right to be forgotten" or part of your account off-boarding.
After a hard delete, the only place a copy can remain is our encrypted backups, which age out within 30 days on their own schedule. We can't surgically remove a single record from a sealed backup — it expires with the rest. SeeData handling & retentionfor the full picture.
For an access request, we provide the resident's records as a machine-readable export rather than deleting them, delivered securely within the same 30-day window.
If PropSocket already delivered a resident's record to your systems through a webhook, that copy now lives in your environment — your data warehouse, your CRM, wherever you routed it. We can delete our copy, butwe cannot reach into your systems to remove data we already handed off. Completing a deletion request fully means deleting it on your side too. As the data controller, that downstream cleanup is your responsibility — and it's worth knowing about before a request lands, not after.
The same goes for any export you've run or any record your own integrations pulled from our API. Our deletion covers what we hold; it can't follow the data wherever you've forwarded it.
Data subject requests and any privacy questions go toprivacy@propsocket.io. It routes to a real person on our team, not a ticket queue that disappears. For our broader data practices, seeData handling & retention; for our audit status and Data Processing Agreement, see theTrust Center.
Email privacy@propsocket.io from an admin on your account and we'll take it from there — with a 30-day deletion commitment and a human who actually reads it.