Privacy Policy

TurnkeyDoor LLC (“TurnkeyDoor,” “we,” “us,” or “our”) is a for-sale-by-owner (FSBO) real estate technology platform based in Bergen County, New Jersey. We provide tools that enable homeowners to list and sell their properties without a listing agent, while offering buyer agents transparent commission information.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our website at turnkeydoor.com (the “Platform”). This policy applies to all users, including sellers, buyers, real estate agents, and visitors.

Contact us about privacy:
Email: privacy@turnkeydoor.com
Mail: TurnkeyDoor LLC, Bergen County, NJ

Information you provide directly:

Account registration data (name, email address, password), property listing information (street address, city, ZIP code, county, property type, bedrooms, bathrooms, square footage, lot size, year built, features, description, listing price), property photographs, property condition disclosure responses (198 fields covering structural, environmental, and system conditions), buyer agent commission preferences, contact information (phone number, email), inquiry messages, showing request details, and payment information for platform fees.

Information collected automatically:

IP address, browser type and version, device type and identifiers, operating system, pages visited and time spent, referring website, click patterns, listing views, search queries and filter selections. We use cookies and similar tracking technologies as described in Section 10.

Information from third-party sources:

Property flood zone designations from the Federal Emergency Management Agency (FEMA) National Flood Hazard Layer, property tax assessment data from New Jersey public records (NJ Office of GIS Parcels and MOD-IV Composite database), address verification and geocoding data from Google Places API. This data is derived from public government records and is used to enrich property listings with verified information.

Under the New Jersey Data Privacy Act (NJDPA), certain categories of personal information are classified as “sensitive” and require your affirmative opt-in consent before processing. We may collect the following sensitive data:

Financial information:Payment card details (processed by Stripe — we do not store card numbers on our servers), transaction amounts, and billing information. New Jersey uniquely classifies financial data as sensitive, requiring opt-in consent.

Precise geolocation: Property latitude and longitude coordinates captured during address entry via Google Places API, used for flood zone determination, property tax lookup, and map display. Under NJDPA, geolocation data within 1,750 feet is considered sensitive.

We obtain your consent for processing sensitive data at the point of collection — specifically, when you submit a property listing or initiate a payment. You may withdraw consent at any time by contacting privacy@turnkeydoor.com. Consent withdrawal will be processed within 15 days.

We use personal information for the following purposes:

Platform operations: Creating and managing your account, publishing property listings, displaying listings on search results and detail pages, processing payments for platform fees, facilitating communication between sellers, buyers, and agents, scheduling property showings, generating AI-assisted property descriptions.

Property data enrichment: Querying FEMA flood zone data and NJ property tax records using property coordinates to display risk indicators and tax information on listing pages.

Communications: Sending transactional emails (listing confirmations, inquiry notifications, showing requests, payment receipts), platform updates, and, with your consent, marketing communications about new features or services.

Platform improvement: Analyzing usage patterns, diagnosing technical issues, improving search functionality and user experience, and developing new features.

Legal compliance: Complying with applicable laws, regulations, legal processes, or governmental requests, including the NJ Real Estate Seller Disclosure Law, Fair Housing Act, and tax reporting obligations.

We share personal information with the following third-party service providers, each acting as a data processor on our behalf. We maintain Data Processing Agreements with each provider.

Stripe(stripe.com) — Payment processing. Receives: name, email, billing address, payment card details, transaction amounts, IP address, device fingerprint, behavioral fraud signals (typing patterns, mouse movements via Stripe Radar). Stripe collects data entered into payment forms even if the transaction is not completed. See: stripe.com/privacy

Resend(resend.com) — Email delivery. Receives: recipient email addresses, email subject and body content. Resend embeds tracking pixels (web beacons) in emails that record when you open an email and click links. You can disable this by turning off image loading in your email client. See: resend.com/legal/privacy-policy

Google (Maps, Places, Analytics)(google.com) — Address autocomplete, geocoding, map display, and website analytics. Receives: property addresses, search queries, IP address, browser information, page views. Google logs all API requests. By using our Platform, you are also subject to Google's Privacy Policy.

Cloudinary(cloudinary.com) — Property photo storage and delivery. Receives: uploaded property photographs. We strip all EXIF metadata (including GPS coordinates, camera information, and timestamps) from photos at the time of upload before storage. Photos are stored on AWS infrastructure. See: cloudinary.com/privacy

Supabase(supabase.com) — Database hosting and authentication. All user data, listing data, and platform data is stored in a PostgreSQL database hosted by Supabase on Amazon Web Services (AWS) in the United States (East region). Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). See: supabase.com/privacy

Vercel(vercel.com) — Website hosting and content delivery. Receives: IP addresses, request headers, and page requests from all visitors. See: vercel.com/legal/privacy-policy

FEMA(fema.gov) — Flood zone data. Receives: property latitude and longitude coordinates. Returns publicly available flood zone designations. This is a federal government service with no commercial data use.

NJ Office of GIS(nj.gov) — Property tax records. Receives: property latitude and longitude coordinates. Returns publicly available assessed values and prior-year property taxes from the NJ MOD-IV database.

When you create a property listing on TurnkeyDoor, your listing data (property address, price, description, photographs, and property details) may be shared with the following services to maximize exposure for your property:

MLS systems: New Jersey Multiple Listing Service (NJMLS) and/or Garden State MLS (GSMLS), through our partner broker of record. MLS data is governed by MLS rules and may be displayed on participating broker websites.

Listing portals:Zillow, Redfin, Realtor.com, and other real estate search websites that receive listings from MLS feeds. Once syndicated, your listing data is subject to each portal's own privacy policy and data retention practices. Portals may retain listing photographs and property data even after your listing is removed from TurnkeyDoor.

Your consent is required before syndication.During the listing creation process, you will be asked to consent to MLS submission and portal syndication. You may opt out of syndication to specific portals. Seller personal contact information (phone, email) is not publicly displayed on syndicated listings — inquiries are routed through the Platform.

Under both the NJ Data Privacy Act and the California Consumer Privacy Act, sharing listing data with MLS systems and portals in exchange for marketing exposure may constitute a “sale” of personal information. See Section 8 for your opt-out rights.

If you are a New Jersey resident, the NJ Data Privacy Act (P.L. 2023, c.266, effective January 15, 2025) grants you the following rights:

Right to confirm and access: You may confirm whether we process your personal data and request access to it.

Right to correct: You may request correction of inaccurate personal data.

Right to delete: You may request deletion of your personal data, subject to legal retention requirements.

Right to data portability: You may request a copy of your personal data in a portable, commonly used format.

Right to opt out of: (a) the sale of personal data, (b) targeted advertising based on personal data, and (c) profiling that produces legal or similarly significant effects, including housing-related decisions.

Right to withdraw consent: You may withdraw consent for the processing of sensitive personal data at any time. We will process withdrawal requests within 15 days.

Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

Right to appeal: If we deny your request, you may appeal. We will respond to appeals within 60 days. If the appeal is denied, you may file a complaint with the NJ Division of Consumer Affairs.

To exercise any of these rights, email privacy@turnkeydoor.comwith the subject line “Privacy Rights Request.” We will verify your identity before processing requests and respond within 45 days (extendable by 45 days with notice).

If you are a California resident and the CCPA applies to our processing of your data, you have additional rights including the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information.

We do not sell personal information for monetary consideration. However, sharing listing data with MLS systems and real estate portals as described in Section 6 may constitute “sharing” under the CCPA. You may opt out by contacting us at privacy@turnkeydoor.com or by clicking the “Do Not Sell or Share My Personal Information” link in our website footer.

We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we treat it as a valid opt-out of the sale and sharing of personal information.

Categories of personal information collected in the preceding 12 months: Identifiers (name, email, phone, address), financial information (payment card data via Stripe), internet activity (browsing, search, clicks), geolocation (property coordinates), professional information (agent license number), and inferences (property valuations, recommended pricing).

You have the right to opt out of the sale or sharing of your personal information. To exercise this right:

Email privacy@turnkeydoor.comwith the subject line “Do Not Sell or Share.” We will process your request within 15 business days.

You may also submit opt-out requests through your browser's Global Privacy Control (GPC) setting. We detect and honor GPC signals automatically.

We use the following categories of cookies and tracking technologies:

Essential cookies: Required for the Platform to function (authentication, session management, security). These cannot be disabled without losing Platform functionality.

Analytics cookies: We use Google Analytics to understand how visitors interact with the Platform, including pages visited, time on site, and navigation patterns. Google Analytics uses cookies to collect anonymized usage data. You can opt out via the Google Analytics opt-out browser extension.

Email tracking: Emails sent via Resend may contain tracking pixels (1x1 transparent images) that record email opens and link clicks. You can prevent this by disabling image loading in your email client.

We do not use advertising cookies or cross-site tracking cookies. We do not engage in retargeting advertising.

We retain personal information for the following periods:

Account data: For the duration of your active account plus 2 years after account closure, unless you request earlier deletion.

Listing data: For the duration of the active listing plus 3 years after listing removal, to support transaction records and legal compliance.

Payment records: 7 years after the transaction date, as required by IRS record-keeping requirements and NJ tax law.

Property disclosure forms: 6 years after listing closure, consistent with NJ statute of limitations for contract and fraud claims.

Inquiry and communication records: 2 years after the last interaction.

Server logs and analytics: 12 months from the date of collection.

Cookies: Session cookies expire when you close your browser. Persistent cookies expire within 12 months.

We implement industry-standard security measures to protect your personal information:

All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption via our database provider (Supabase/AWS). Payment card data is processed by Stripe, which is PCI-DSS Level 1 certified — we never store, process, or transmit raw card numbers on our servers. Property photographs are stripped of all EXIF metadata (including GPS coordinates) at the time of upload. Access to production systems is restricted to authorized personnel with multi-factor authentication.

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and the NJ Attorney General as required by the NJ Identity Theft Prevention Act (N.J. Stat. § 56:8-163).

TurnkeyDoor is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. Under the NJDPA, we do not process personal data of consumers known to be between 13 and 16 years old for purposes of targeted advertising, data sale, or profiling without consent.

If you are a parent or guardian and believe your child has provided personal information to us, contact privacy@turnkeydoor.com.

New Jersey's Daniel's Law (P.L. 2021, c.371) protects the home addresses and personal information of covered persons, including judges, prosecutors, and law enforcement officers, from public disclosure. Bergen County properties are directly subject to these protections.

If you are a covered person under Daniel's Law and your information appears on our Platform, you may request removal by emailing privacy@turnkeydoor.comwith the subject line “Daniel's Law Removal Request” and documentation of your covered status. We will process removal requests within 72 hours.

TurnkeyDoor is committed to compliance with the Federal Fair Housing Act and the New Jersey Law Against Discrimination. We do not collect, use, or share personal information in a manner that discriminates on the basis of race, color, religion, sex, national origin, disability, familial status, sexual orientation, gender identity, marital status, or any other protected class.

We do not use algorithmic profiling or automated decision-making to steer buyers toward or away from specific neighborhoods or listings based on protected characteristics.

CAN-SPAM compliance: Every marketing email we send includes our physical mailing address, accurate sender identification, and a functioning unsubscribe link. We honor unsubscribe requests within 10 business days. Transactional emails (listing confirmations, inquiry notifications, payment receipts) are not marketing communications and may be sent without opt-in consent.

TCPA compliance:We will only send text messages or make automated calls with your prior express written consent. All SMS messages include “STOP” opt-out instructions. We do not contact users outside of 8:00 AM to 9:00 PM local time.

We maintain a Records of Processing Activities (RoPA) per GDPR Art. 30 and a Data Protection Impact Assessment (DPIA) per GDPR Art. 35, even though TurnkeyDoor is geo-fenced to NJ at consumer launch and GDPR is not actively triggered. The framework gives us a defensible posture if EU/UK data reaches the platform incidentally and a structured way to evaluate processing risk before launching new features.

The RoPA inventories five data categories — tenant data, landlord data, exchange data, visitor data, and AI-route data — and documents purposes, sub-processors, retention windows, and Art. 32 technical & organizational measures for each. A public-safe summary lives at /admt-pack/data-protection. The full canonical doc is held internally; compliance officers may request access via compliance@turnkeydoor.com.

As required by the NJDPA (N.J.S.A. 56:8-166.4 et seq.), we conduct data protection assessments before processing personal data for targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of harm, processing sensitive data, or any processing that presents a heightened risk of harm to consumers. TurnkeyDoor does not engage in any of those opt-out-triggering activities by design; the assessments document the architectural commitments that keep that posture true.

The DPIA also covers our AI-route data flows (composer templates via Anthropic Claude, photo moderation via Google Gemini, text utility via Groq). Our architectural rule excludes personally identifying tenant and landlord information from any AI provider; AI-route data is enforced as synthetic-only at the middleware layer.

TurnkeyDoor operates exclusively in the United States. All personal data is stored on servers located in the United States (AWS East region). We do not transfer personal data outside the United States. If you access the Platform from outside the United States, you do so at your own risk and are responsible for compliance with local data protection laws.

We may update this Privacy Policy periodically. If we make material changes, we will notify you by email (at the address associated with your account) and by posting a prominent notice on the Platform at least 30 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the changes. If you do not agree with a revised policy, you may close your account and request deletion of your personal data.

For questions, concerns, or requests related to this Privacy Policy or your personal data:

Email: privacy@turnkeydoor.com
Subject line: “Privacy Inquiry”
Mail: TurnkeyDoor LLC, Bergen County, NJ

If you are unsatisfied with our response to a privacy request, you may file a complaint with:

New Jersey Division of Consumer Affairs
124 Halsey Street, Newark, NJ 07102
Phone: (973) 504-6200
njconsumeraffairs.gov