Privacy Policy

This Privacy Policy explains how STRUQO LLC("we," "us," "our") collects, uses, stores, and protects information about you when you use deallensai.io and any related services (collectively, the "Service"). By using the Service, you agree to the practices described here.

Information you provide directly:

• Name and email address (account registration)
• Password (stored as a bcrypt hash — we never store plaintext passwords)
• Investment strategy preference (optional, at sign-up)
• Property addresses, purchase prices, rehab costs, and financial inputs you enter for analysis
• Rehab project photos and data you submit to the community database
• Payment information (processed by Stripe — we do not store card numbers)

Information collected automatically:

• Page views and navigation events via Vercel Analytics (aggregated, no personally identifiable information)
• Usage counts (analyses run, estimates run) to enforce your plan limits
• IP address and browser user agent (collected by our hosting provider, Vercel)
• Timestamps of account activity

Information from third-party APIs:

• Property data (AVM values, rent estimates, sale comps) from RentCast for addresses you look up
• Geocoding data from Nominatim for address normalization

• To operate and deliver the Service — running analyses, generating estimates, displaying your history
• To enforce plan limits and reset them on the daily schedule
• To process payments and manage your subscription via Stripe
• To improve our rehab cost estimation models using aggregated, anonymized submission data
• To send transactional emails (account confirmation, password reset, moderation decisions) via Resend
• To detect and prevent fraud or abuse
• To comply with legal obligations

We do not sell your personal information. We do not use your data for advertising targeting. We do not share your data with data brokers.

Addresses and financial figures you enter into deal analyses and rehab estimates are stored in your account to power your history and saved estimates. This data is associated with your user ID and is not shared with other users.

Community project submissions you choose to submit are moderated and, if approved, may be used in aggregated regional statistics visible to other users. Individual submission details are not publicly attributed to your name or account.

Your data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure with encryption at rest and in transit. Authentication and session management is handled by Supabase Auth. Passwords are hashed and never stored in plaintext.

Uploaded photos are stored via Vercel Blob storage with private access controls. Payment data is handled entirely by Stripe and never touches our servers.

While we implement industry-standard security measures, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

• Active account data is retained for as long as your account exists
• If you delete your account, we will delete your personal data within 30 days, except where retention is required by law
• Anonymized, aggregated rehab submission data may be retained indefinitely as part of our regional dataset
• Payment records are retained for 7 years for tax and legal compliance

We share data with the following third parties only to the extent necessary to operate the Service:

• Stripe — payment processing. Your card data goes directly to Stripe.
• Supabase — database, auth, and file storage.
• Vercel — hosting, edge functions, blob storage, and aggregated analytics.
• PostHog — product analytics. Page views and in-app events are sent to PostHog to help us understand how the product is used. No financial or personal data is included in these events.
• Resend — transactional email delivery. We share your email address to send you emails you requested.
• RentCast — property data API. Addresses you look up are sent to RentCast to retrieve market data.
• Nominatim / OpenStreetMap — address geocoding. Addresses you enter are sent to normalize and geocode them.

We do not share your data with any other third parties without your explicit consent, except as required by law.

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and personal data
• Portability — request your data in a machine-readable format
• Opt-out — opt out of any non-essential communications at any time

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising privacy rights.

To exercise any right, email privacy@deallensai.io with your request.

The Service uses browser cookies solely for authentication session management (Supabase session tokens) and product analytics (PostHog, which uses a first-party cookie to track session activity). We do not use advertising cookies, third-party tracking pixels, or persistent behavioral profiling cookies.

Vercel Analytics collects aggregated, anonymized page view data with no cookies and no personally identifiable information.

The Service is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it promptly.

We may update this policy from time to time. Material changes will be notified via email or a prominent notice in the app at least 14 days before taking effect. Continued use after the effective date constitutes acceptance of the updated policy.

Privacy questions or requests: privacy@deallensai.io