Privacy Policy

Long Haus ("we," "us," or "our") is a residential rental community operated by Nue Craft Homes. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights under applicable law — including the Texas Data Privacy and Security Act (TDPSA).

This notice applies when you use our website, submit a fit check, or communicate with us by SMS or email. Analytics choices are applied according to the regional policy described below, and communication choices are presented where that choice is made.

1. Information We Collect

Information you provide directly

• Contact information: First name, last name, email address, and phone number — collected when you submit the fit check form.
• Fit check responses: Move-in timeline, income threshold confirmation (yes/no — we do not ask for a dollar amount on the form), screening consent preference, preferred contact method, language preference, adult applicant count, income type, move-in savings range, pets, and vehicles.
• Referral information: Referral codes, if you arrive via a referral link or submit a referral signup.
• Application data: If you proceed to a full application through our tenant portal (DoorLoop), you may provide additional information including date of birth, Social Security number, employment details, and rental history. That data is collected and governed by DoorLoop's privacy policy.

Information collected automatically

• Campaign and referral context: Source, medium, campaign, and referral values from the URL may be used as first-party lead information to understand how visitors reach the site and to attribute a referral. Sanitized values are stored under lh_attribution_session in first-party session storage for the current tab/browser visit, including when GA4 is off, so they remain available if you move between public pages. This visit storage ends with the browser page session. When analytics is on, the same bounded attribution may be retained under lh_attribution for no more than 90 days from first capture to support cross-session lead attribution; turning analytics off deletes that persistent record. Raw values are not added to our custom GA4 event payloads.
• Device and browser data: Our hosting and security services may process standard request data such as IP address, browser type, referring URL, and request timing to deliver, secure, and monitor the website.

Regional analytics and cookie-free performance measurement

• Google Analytics 4 (GA4): On approved public marketing and informational pages, GA4 measures visits and selected interactions by default for visitors in the United States and other regions where our configured policy does not require prior consent. In configured consent-required regions, and when the region cannot be resolved, GA4 remains off until you choose to allow it. Everyone can turn analytics off or back on through the site's Analytics preferences control. Turning it off stops future GA4 measurement and the site attempts to remove GA measurement cookies that it can access.
• Regional and preference cookies: Our hosting edge uses request geolocation to place a first-party session cookie containing only default on or consent required; the country or subdivision is not exposed to the app or sent in our GA4 events. A separate first-party preference cookie stores your explicit analytics choice across the Long Haus apex and www domains for up to one year. The same choice and its save time may be retained in same-origin browser storage for up to one year as a synchronization fallback; expired or malformed grants are discarded. After the preference expires, the regional default or consent prompt applies again. Missing or invalid regional information is treated as consent required. The configured jurisdiction list is an operational policy input that is reviewed as applicable requirements change.
• Referral cookie: If a public URL contains a valid referral code, Long Haus may store that code in the first-party lh_ref cookie for up to 90 days so a later Fit Check can be attributed to the referring participant. This functional referral record is separate from GA4 and the code is never sent in our GA4 events.
• Automatic and advertising controls: Google advertising storage, advertising user data, advertising personalization, Google signals, and ad-personalization signals remain disabled. On measured public routes where GA4 is enabled, the current GA4 web stream also collects automatic page-view and scroll events through Enhanced Measurement. The regional choice and route boundary still determine whether the Google tag loads. Long Haus is disabling those automatic events so its reviewed manual event contract becomes the sole measurement owner; Google URL redaction is enabled as defence in depth while that Admin change is completed.
• Campaign measurement: Raw UTM values and referral codes remain in the first-party lead-attribution workflow. GA4 may receive only approved bounded source and medium categories, an allowlisted campaign name or an other campaign bucket, and presence flags for campaign content or terms.
• Analytics data limits: Our GA4 event contract excludes names, email addresses, phone numbers, application or lead IDs, referral codes, raw search terms, free-text form entries, tokenized URLs, and sensitive Fit Check responses such as screening, income, savings, consent, household, pet, or vehicle information. Staff pages and public offer, upload, co-applicant consent, referral status, and unsubscribe workflows are outside the GA4 measurement boundary.
• Governance: The privacy owner must review the regional policy list and the lawful/functional basis for visit-scoped lead attribution, the 90-day cross-session lead-attribution record, and the 90-day referral cookie in consent-required regions. This engineering behavior is not a declaration that every jurisdiction has the same requirements.
• Netlify Real User Monitoring: Netlify, our website host, provides separate performance measurement for page speed and Web Vitals. Netlify documents this service as not requiring client-side cookies. It is separate from GA4 and its regional preference control.

Information collected by third parties on our behalf

• Plaid: If you are invited to verify financial information as part of our screening process, you may connect your bank account through Plaid. Plaid helps us securely verify certain financial information. Long Haus receives a verification result — we do not receive your bank login credentials or full transaction history. Completing verification does not guarantee approval.
• Background screening: If you proceed to a full application, a third-party screening provider runs a background check and credit inquiry. This occurs only after you provide explicit consent on the application.
• DoorLoop: Our tenant portal and application system is operated by DoorLoop. Data you submit through DoorLoop is governed by DoorLoop's Privacy Policy.

2. How We Use Your Information

• Process your fit check — determine whether the home is a good fit and route you to the appropriate next step.
• Communicate with you — send your Plaid verification link, tour booking information, application status updates, and Total Cost to Move In details via SMS and email.
• Track referrals — attribute referral credits to the correct referring resident.
• Measure advertising effectiveness — understand which channels generate qualified enquiries.
• Comply with legal obligations — respond to lawful requests and comply with fair housing, consumer protection, and tenant screening laws.

We do not sell your personal information. We do not share your information with third parties for their own marketing purposes.

3. SMS and Email Communications

When you submit the fit check form, you consent to receive SMS messages and emails from Long Haus related to your inquiry, including:

• Secure financial verification link (if invited to continue)
• Application status updates and next steps
• Internal review outcomes and proposed terms
• Scheduling and follow-up communication

Message frequency varies. Message and data rates may apply. You can opt out of SMS at any time by replying STOP. You can opt out of email by clicking the unsubscribe link in any email or by emailing leasing@longhauscompany.com.

4. Data Retention

• Fit check data: Retained for up to 12 months after submission, or longer if you become a resident.
• Application and lease data: Retained for the duration of your tenancy plus the period required by Texas landlord-tenant law (currently 3 years after lease termination).
• Declined applications: Retained for 12 months, then deleted unless retention is required by law.

You may request deletion of your data at any time (see Section 6).

5. Data Security

We use reasonable administrative, technical, and physical safeguards to protect your personal information. Fit check submissions are protected with bank-grade encryption in transit. Bank-based income verification is handled entirely by Plaid's trusted secure systems — we never see your bank credentials.

6. Your Rights

Under the Texas Data Privacy and Security Act (TDPSA) and other applicable laws, you have the right to:

• Access — Request a copy of the personal information we hold about you.
• Correction — Request that we correct inaccurate personal information.
• Deletion — Request that we delete your personal information, subject to legal retention requirements.
• Opt out of sale — We do not sell personal data, so this right is satisfied by default.

To exercise any of these rights, email leasing@longhauscompany.com with the subject line "Privacy Request." We will respond within 45 days.

7. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. If we make material changes, we will notify you via email or a prominent notice on our website.

9. Contact Us

If you have questions about this Privacy Policy or how your information is handled, contact us: