Effective Date: 9/28/25

1. Introduction

This Privacy Policy describes how IMR Billing Services LLC ("IMR," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with:

The website located at imrbilling.com and any subdomains (the "Website");
The resident bill-pay portal made available through the Website (the "Resident Portal");
The water leak detection and notification service known as the Leak Alert Response System (LARS), operated through our affiliate IMR Agent LLC; and
Other utility billing, submetering, revenue recovery, utility management, field service, and customer support services we provide (collectively with the foregoing, the "Services").

This Policy applies to information about (a) property managers, owners, and their representatives ("Clients"), (b) residents and tenants of properties served by IMR ("Residents"), and (c) visitors to the Website.

If you have questions about this Policy or our privacy practices, contact us at info@imrbilling.com or at the address in Section 14.

2. Information We Collect

We collect information in three ways: information you provide to us directly, information we receive about you from third parties (including your property manager), and information collected automatically when you use the Website or the Resident Portal.

2.1 Information You Provide Directly

Account information: Your name, email address, phone number, mailing address, unit and property identifiers, and any login credentials you create for the Resident Portal.
Payment information: Billing address, payment method (ACH bank account information, debit or credit card details), and transaction history. Full card numbers are processed by our third-party payment processor and are not stored on IMR's own systems.
Communication preferences and consents: The channels (email, SMS, voice) you have consented to, the timestamp of each consent, the disclosure version you saw at the time of consent, and any subsequent revocations.
Customer support information: The content of inquiries you send us by email, phone, web form, or portal, and any information you provide while we resolve a billing dispute or service issue.
Identity verification information: Information you provide to confirm your identity in connection with payment, account access, or fraud prevention.
Meter photos and dispute documentation: If you submit a photo of your water meter or other documentation by SMS or email in connection with a billing inquiry or dispute, we collect the photo, any accompanying message text, and metadata about when and how it was sent.

2.2 Information We Receive From Third Parties

From your property manager or property owner: Your name, contact information, unit number, lease dates, occupancy status, account balance, and any other information needed to bill you accurately and operate the Services. Property managers are responsible for ensuring that the information they share with us is accurate and shared lawfully.
From submetering hardware vendors: Water (or other utility) consumption data from submeters installed at your unit. We work with hardware partners including Next Century, Inovonics, and others to collect this data through automated meter reads.
From payment processors and financial institutions: Confirmation of payment, payment failures, chargebacks, and similar transaction information.
From background and fraud prevention services: Information used to detect fraudulent payments and protect the integrity of the Services.

2.3 Information Collected Automatically

Utility usage data: Volume, timing, and rate of water (or other utility) consumption at the unit associated with your account, collected through submetering hardware. This data is used for billing, leak detection, and reporting.
Device and usage information about your interaction with the Website and Resident Portal: IP address, browser type and version, operating system, device identifiers, pages visited, links clicked, referring URLs, time and date of visits, session duration, and similar information.
Cookies and similar technologies: See Section 7.

2.4 Information We Do Not Collect

We do not collect audio, video, or any data from inside your unit. The leak detection service analyzes only the volume and timing of water flow recorded by your property's existing submeter for your unit.

3. How We Use Information

We use the information we collect for the following purposes:

Provide the Services: Generate bills, process payments, deliver leak alerts, operate the Resident Portal, respond to inquiries

Communicate with you: Send billing statements, payment receipts, payment reminders, leak notifications, account and security notices, and (with separate consent) SMS or voice communications

Detect and respond to leaks: Analyze utility usage patterns to identify possible leaks at your unit and notify the appropriate parties

Maintain account security: Authenticate users, prevent fraud, detect and respond to suspicious activity

Comply with law: Meet our obligations under applicable federal, state, and local law, including tax, billing, consumer protection, and anti-money-laundering law

Operate our business: Internal analytics, troubleshooting, system improvement, training, audit, accounting, and similar business operations

Resolve billing disputes: Receive and review meter photos and dispute documentation submitted by SMS or email; document our findings; communicate resolution by phone or email.

We do not sell personal information, and we do not use personal information for cross-context behavioral advertising.

4. How We Share Information

We share personal information only as described below.

4.1 With Your Property Manager or Owner

If you are a Resident, we share information about your account, your usage, and your bills with the property manager or owner who engaged us. This sharing is necessary to operate the Services and is the basis on which the property manager makes decisions about your unit.

4.2 With Service Providers

We share information with third-party service providers that perform functions on our behalf, including:

Payment processors (for credit card, debit card, and ACH processing);
Email delivery services (such as Resend or similar providers);
SMS providers (where SMS is enabled with your consent);
Voice call providers (such as SimpleTalk, where voice is enabled with your consent);
Cloud and database hosting providers (such as Supabase and others);
Submetering hardware and platform vendors (such as NextCentury and Inovonics);
Customer support and helpdesk platforms;
Analytics providers; and
Professional advisors (legal, accounting, audit).

These service providers are contractually limited to using your information only for the purposes for which we share it.

4.3 With Affiliated Entities

We share information with IMR Agent LLC, our affiliated technology entity that operates the LARS leak detection system. Information shared with IMR Agent LLC is used only to operate LARS and to provide notifications back to IMR for delivery to you, your property manager, or maintenance.

4.4 For Legal Reasons

We may share information when we believe in good faith that disclosure is necessary to:

Comply with a subpoena, court order, or other legal process;
Comply with applicable law or governmental request;
Enforce our Terms of Use or other agreements;
Detect, prevent, or address fraud, security, or technical issues; or
Protect the rights, property, or safety of IMR, our Users, or others.

4.5 In a Business Transaction

If IMR is involved in a merger, acquisition, financing, asset sale, reorganization, bankruptcy, or similar transaction, your information may be transferred as part of that transaction, subject to standard confidentiality protections and the terms of this Policy.

4.6 With Your Consent

We share information for any other purpose with your consent.

5. Communications

5.1 Operational Email

When you provide an email address — through the Website, the Resident Portal, your property manager, or a service request — we may use it to send transactional and operational communications about your account, your bills, possible leaks at your unit, and related matters. These are informational, not marketing.

5.2 Marketing Email

We may send promotional or marketing emails to Clients (property managers and owners) and to Website visitors who have opted in to receive them. Each such email will include a clear unsubscribe link in compliance with the CAN-SPAM Act. We do not send marketing emails to Residents about their personal accounts.

5.3 SMS and Voice Communications — Separate Consent

We do not send SMS messages or place automated, prerecorded, or AI-generated voice calls to you under this Privacy Policy or our Terms of Use alone. Where SMS or voice is offered at your property, you will be asked to provide a separate, channel-specific consent through the Resident Portal or another documented consent method. Each consent identifies the channel, the sender, the type of content, and the use of automated technology, and is independently revocable.

This structure is designed to comply with the federal Telephone Consumer Protection Act (47 U.S.C. § 227), the FCC's February 2024 declaratory ruling on AI-generated voice, the Florida Telephone Solicitation Act (Fla. Stat. § 501.059), and related law.

5.4 How to Opt Out

Email: Click the unsubscribe link in any commercial email, or email info@imrbilling.com. Note: opting out of commercial email does not stop transactional billing or payment notices necessary to operate your account.
SMS: Reply STOP to any SMS message, or update your preferences in the Resident Portal.
Voice: Tell the AI agent or representative on a call to stop calling you, update your preferences in the Resident Portal, or email info@imrbilling.com.

6. Your Choices and Rights

6.1 Access, Correction, and Deletion

Subject to applicable law, you may request that we:

Confirm whether we are processing your personal information;
Provide you with a copy of the personal information we hold about you;
Correct inaccurate personal information;
Delete your personal information, subject to exceptions for information we are required or permitted to retain (such as billing records, transaction history, and information needed to comply with law or defend legal claims); and
Restrict or object to certain processing.

To make a request, email info@imrbilling.com. We will respond within the timeframes required by applicable law (typically 30–45 days). We may need to verify your identity before fulfilling your request.

6.2 Florida Residents

The Florida Digital Bill of Rights (Fla. Stat. § 501.701 et seq.) provides specific rights to certain Florida consumers with respect to their personal information, including the rights to access, correct, delete, and opt out of certain processing. While IMR may not meet the revenue thresholds that trigger the Florida Digital Bill of Rights' direct applicability, we honor these rights as a matter of practice. Florida residents may exercise these rights by emailing info@imrbilling.com.

6.3 California, Colorado, Connecticut, Virginia, and Other State Residents

If you are a resident of California, Colorado, Connecticut, Virginia, or another state with a comprehensive consumer privacy law, you may have additional rights, including the rights to access, correct, delete, and opt out of the sale of personal information or targeted advertising. IMR does not sell personal information and does not use personal information for cross-context behavioral advertising. To exercise other rights, email info@imrbilling.com.

6.4 Authorized Agents

You may designate an authorized agent to make a request on your behalf. We will require verification of the agent's authority and may require you to verify your own identity directly with us.

6.5 No Discrimination

We will not discriminate against you for exercising any privacy right described in this Policy.

7. Cookies and Tracking Technologies

7.1 What We Use

The Website and the Resident Portal use cookies and similar technologies (such as web beacons and local storage) to:

Maintain your authenticated session in the Resident Portal;
Remember your preferences;
Measure and analyze how the Website is used;
Detect fraud and protect security; and
Improve the Services.

7.2 Types of Cookies

Strictly necessary cookies: Required for the Website and Resident Portal to function (for example, authentication and session management). These cannot be disabled without preventing access to the Services.
Functional cookies: Remember your settings and preferences.
Analytics cookies: Help us understand how Users interact with the Website.

7.3 Your Choices

Most browsers allow you to manage or block cookies through browser settings. You can also use browser-level "Do Not Track" signals; however, because there is no industry consensus on how to interpret these signals, we do not currently respond to them. We do honor Global Privacy Control (GPC) signals where applicable law requires.

7.4 Third-Party Analytics

If we use third-party analytics services (such as Google Analytics) on the Website, those services may collect information about your use of the Website subject to their own privacy policies.

8. Data Retention

We retain personal information for as long as necessary to:

Provide the Services to you and to your property manager;
Comply with applicable law (including tax, accounting, and billing record retention requirements, generally at least four (4) to seven (7) years depending on the type of record);
Resolve disputes and enforce our agreements;
Maintain consent records, communication audit logs, and dispatch logs (retained for at least the statute of limitations applicable to TCPA and related claims, generally four (4) years from the date of the communication or longer); and
Operate, troubleshoot, and improve the Services.

When information is no longer needed, we delete it or de-identify it in accordance with our data retention schedule.

9. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, and destruction. These safeguards include encryption in transit (TLS), encryption at rest for sensitive fields, role-based access controls, audit logging, network segmentation, and regular security review.

However, no method of transmission or storage is 100% secure. We cannot guarantee the absolute security of any information you provide. You are responsible for keeping your account credentials confidential and notifying us immediately if you suspect unauthorized access to your account.

In the event of a security incident affecting your personal information, we will notify you and applicable regulators as required by the Florida Information Protection Act (Fla. Stat. § 501.171) and other applicable law.

10. Children's Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it. If you believe we have collected information from a child under 13, please contact us at info@imrbilling.com.

11. International Users

The Services are operated from the United States and are intended for users in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where laws regarding personal information may differ from those in your country. By using the Services, you consent to this transfer.

12. Third-Party Websites and Services

The Services may include links to or integrations with third-party websites and services that we do not control. This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last Updated" date at the top and post the updated Policy on the Website. For material changes, we will provide additional notice (such as an email to your account email address or a prominent notice on the Website) at least 30 days before the changes take effect, where required by applicable law. Your continued use of the Services after the updated Policy becomes effective constitutes your acceptance of it.

14. Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, contact us at:

IMR Billing Services LLC(954) 866-1502 Email: info@imrbilling.com

For privacy-specific requests, please use the subject line "Privacy Request" so we can route your message appropriately.