Privacy notice

The 21E22 COI Portal is a private tool run by a shareholder of 13-21 East 22nd Street Residence Corp. (the “operator”) to collect the insurance paperwork that the building's managing agent, Wallack Management Company, Inc., requires before an outside vendor may work in a resident's apartment. It is not operated by, or affiliated with, Wallack Management Company, Inc. or the cooperative. Questions and requests about this notice go to funkmesh@gmail.com.

• Residents of 21 East 22nd Street who have been registered by the operator. They sign in with their Google account and create requests for vendor visits.
• Vendors (contractors, delivery and repair companies) invited by a resident. They do not sign in; they use a private link sent by email.
• The managing agent and the building superintendent, who receive the finished packet by email.

• From residents: name, apartment number, email address, an optional saved signature image, and the settings they choose (for example whether packets are sent automatically).
• From vendors: company name, contact name, email address and phone number; the certificate of insurance, workers' compensation certificate and any other documents uploaded; the description of the work and the visit date; and the electronic signature placed on the building's indemnification agreement, together with the date, time, IP address and browser used to sign (kept as the signature audit record).
• From the managing agent: replies to packet emails that are sent to the portal's own reply address (approvals@21e22coi.com), used to record that a visit was approved. The portal never reads any other mailbox.
• From Google, only when a resident chooses to connect their Google account: see section 5.
• Technical data: standard web-server logs (IP address, browser type, pages requested, timestamps) kept for security and troubleshooting, and a session cookie that keeps a resident signed in. The site sets no advertising or analytics cookies.

• To tell the vendor exactly what the building requires and to check uploaded certificates against those requirements.
• To assemble the packet (certificate, workers' compensation certificate, signed and countersigned indemnification agreement) and email it to the managing agent, copying the superintendent and the vendor.
• To record the managing agent's approval and notify the vendor that the visit is cleared.
• To show residents the list of vendors the building has approved, so they can reuse them.
• To keep an audit trail of signatures and approvals in case the building asks for it later.

Nothing is sold, used for advertising, or used for any purpose other than the ones above. We do not build profiles and we do not use the data to train artificial-intelligence models.

A resident may connect their own Google account from the Settings page. The portal then asks Google, through Google's OAuth consent screen, for the following permissions and uses each one only as described:

Storage. The access and refresh tokens Google issues are stored encrypted (AES, keyed by a server secret) in the portal's database and are used only to perform the actions above. The portal keeps no copy of the resident's email messages, contacts, calendar or Drive contents beyond the files it created.

Sharing. Google user data is never sold, never shared with advertisers or data brokers, never used for advertising or credit decisions, and never transferred to anyone except as needed to perform the actions above (the emails the resident asks the portal to send) or to comply with the law. No person reads a resident's Google data except with the resident's explicit permission for support, or for security or legal reasons. Google user data is not sent to the AI service described in section 6.

Revoking access. Clicking Disconnect on the Settings page revokes the portal's access at Google and deletes the stored tokens. A resident can also remove the portal at any time from myaccount.google.com/permissions.

The portal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The portal relies on the following providers, each receiving only what is needed for its role:

• Microsoft Azure (United States) hosts the application and its database, including uploaded documents until they are filed in the resident's Google Drive.
• Google (Gmail and Google Drive, as described in section 5) and Google Maps, which receives a vendor's company name, phone number or website domain to find its public business listing for the building vendor list.
• Anthropic provides the AI model that reads an uploaded certificate of insurance to extract its fields (insurer, limits, dates, additional insureds). Only the certificate document is sent, under API terms that do not allow the provider to train on it. No Google user data is sent.
• Resend receives email sent to the portal's own reply address (approvals@21e22coi.com) and delivers it to the portal so approvals can be recorded.

Requests, documents and signature records are kept so that past approvals can be shown to the building, which may ask for them years later. Vendors can see their own documents through their private link. A vendor or resident may ask for their information to be deleted by writing to funkmesh@gmail.com; we delete it unless the building still needs it as a record of an approved visit, and we say so if that is the case. Google tokens are deleted immediately on disconnect. Server logs are kept only as long as needed for security and troubleshooting.

All traffic uses HTTPS. Google tokens are encrypted at rest. Vendor links are long random tokens that cannot be guessed. Only registered residents can sign in, and each resident sees only their own household's requests. The operator will notify affected people without undue delay if a breach involving their data is discovered.

The portal is intended for adults conducting building business and does not knowingly collect information from children.

Material changes are announced on this page with a new effective date. The current version is always at https://21e22coi.com/privacy.