Privacy Policy
Version draft-1-2026-10-17 · Draft updated
1. Who we are and what this covers
This policy explains what personal information REIalpha collects, why, who we share it with, how long we keep it, and the choices you have. REIalpha (reialpha.io) is run by [COMPANY LEGAL NAME], [POSTAL ADDRESS] ("we", "us"). For any privacy question or request, write to [PRIVACY EMAIL].
It covers the REIalpha website and app, the emails we send, and support. Section 10 is for people who appear in our property data without being our users.
In short:
- We collect what we need to run your account, take payment, keep REIalpha secure, and see which parts get used.
- We do not sell your personal information, and we do not show ads or use advertising trackers.
- Your card details go to Stripe, never to us.
- You can download your data and delete your account yourself, from the Account page.
2. What we collect and why
| What | Details | Why |
|---|---|---|
| Account | Your email address, name and password. We store the password only as a one-way scrambled form that cannot be turned back into it. Also when you signed up, confirmed your email and last signed in, your role, and your account's plan. | To run your account and sign you in. |
| Team | Invitations you send (the person's email address and a link that expires after 48 hours) and who belongs to which account. | To let several people share one account's plan. |
| Sign-in sessions | A random sign-in cookie. We keep only a scrambled copy of it, with when it was created, last used and expires. | To keep you signed in for up to 14 days. |
| Saved homes and searches | Homes you save, with a copy of what the home's card showed when you saved it, and searches you save once that feature is available. | To show your saved lists. |
| Billing | Your Stripe customer and subscription IDs, plan, billing period, payment status and whether you have cancelled. Stripe collects your card details and billing address. | To charge for paid plans and give your account the plan it paid for. |
| Messages to us | What you write in feedback, bug reports, reports of wrong data, help questions and notes, and any screenshots you attach. With them we record your account, name, email, plan, the page you were on, your browser type and your window width. If you are not signed in, we ask for your email. We also record your votes on public requests. | To answer you, fix problems and decide what to build. |
| Analyst chat (Pro plan) | Each question, the page you asked from, whether it was answered, which sources the answer cited, which AI model answered, and who asked. | To answer, to apply the daily question limit, and to learn what people need. |
| Usage | Fixed labels for which screens and features are used, such as "page view: explore". If you are signed in, they are linked to your account, not to your name or email. If you are not, they are linked to a random cookie that changes every day. Usage records never contain search text, full web addresses, home IDs, street addresses, names, email addresses or IP addresses. | To see which features are used, in totals, and improve them. |
| Security | Your IP address and email address in short-lived counters that limit repeated sign-ins, sign-ups, password resets and very heavy data use; a scrambled label of your IP address and network on your sign-up record; and an activity log of sign-ins, sign-outs, failed sign-ins, password and email changes (with the old and new address), plan and team changes, and data downloads. | To prevent abuse and fraud, and to investigate problems. |
| A record of each email we send you (address, type of email, message ID and outcome), delivery reports from our email provider (delivered, bounced, marked as spam), and a list of addresses that unsubscribed, bounced or complained. We do not keep the text or the links of the emails we send. | To deliver email and respect unsubscribes. | |
| Errors | When something breaks, a report with the place in our code, the type of error and the app version. Before it is sent, we remove cookies, addresses, search filters, the error's text, details of the request and of the user, and the IP address. | To fix bugs. |
| Network and server logs | Our hosting and network providers process IP addresses, the pages requested, browser type and time, to deliver and protect the Service. | To deliver the Service and keep it secure. |
We do not ask for sensitive information such as Social Security numbers or financial account details. Please do not send it to us.
3. Cookies and similar technology
We use a few cookies, and none for advertising.
| Cookie | What it does | How long it lasts |
|---|---|---|
reialpha_session | Keeps you signed in. Necessary for the Service to work. | 14 days, or until you sign out |
reialpha_usage | Counts visits by people who are not signed in, using a random ID. It is not set if your browser sends a Do Not Track or Global Privacy Control signal, and an existing one is then deleted. | Until the end of the day (UTC) |
| Cloudflare cookies | Set by Cloudflare, our network provider, to protect the site from attacks and bots, including an optional check on the sign-up form. | Set by Cloudflare |
| Stripe cookies | Set by Stripe on its own checkout and billing pages, for payment and fraud prevention. | Set by Stripe |
Your browser also remembers whether you folded the side menu. That setting stays on your device.
When the app loads, your browser also fetches the text font from Google Fonts and map images from Esri, and may load home photos directly from the websites they come from. Those companies receive your IP address and basic browser details as part of those requests. We do not send them anything else about you.
4. How we use information
We use personal information to:
- provide the Service: accounts, sign-in, teams, saved items, and each plan's features and limits;
- take payment and manage subscriptions;
- send the emails you need (confirming your email, password resets, invitations, notices about your account, and changes to our terms or this policy), and the emails you ask for, such as alerts, which you can turn off at any time;
- answer feedback and support requests, and fix wrong data;
- keep the Service secure, prevent abuse and enforce our Terms;
- understand, in totals, how the Service is used, and decide what to build; and
- comply with the law and protect our rights.
We do not sell your personal information or share it for targeted advertising. We do not use your messages, notes or chat questions to train AI models.
Our staff can see account information when they need to support you, fix a problem or protect the Service. To reproduce a problem, staff can also view the app exactly as your account sees it. Every such view is recorded in our activity log with the staff member's name, and while viewing, staff cannot change your password, your email or your billing.
5. Who we share it with
We share personal information only with companies that help us run REIalpha, under terms that limit them to providing their service to us, and when the law requires it.
| Company | What for | Where |
|---|---|---|
| Hetzner | Hosts our servers and database | Ashburn, Virginia, USA |
| Cloudflare | Delivers and protects the website, runs the optional sign-up bot check, routes email sent to us | Worldwide network |
| Stripe | Payments, invoices, sales tax, billing emails | USA |
| Amazon Web Services | Sends our email (Amazon SES); stores database backups (Amazon S3) | Eastern USA |
| GlitchTip, run by us | Error reports, cleaned as described in section 2 | [Germany] |
| Chatwoot, run by us | Our support email inbox | [Germany] |
| Google Fonts and Esri | The text font and map images your browser loads | Worldwide |
| [AI MODEL PROVIDERS] | Answering an analyst chat question when the model on our own server cannot | [WHERE] |
Others who may see your information:
- People on your account. Everyone on an account can see who else is on it. Account admins can also see invitations and manage billing.
- The public, only if you choose to post "A public request". Its text is shown without your name or email.
- Legal reasons. If the law, a court order or valid legal process requires it, or to protect the rights, safety or property of our users, the public or us.
- A new owner. If REIalpha is sold, merged or reorganized, your information may pass to the new owner, who must keep honoring this policy.
6. How long we keep it
| Information | How long |
|---|---|
| Account, team and saved items | Until you delete your account |
| Sign-in sessions | 14 days; expired sessions are deleted every hour |
| Email confirmation and password-reset links | Confirmation links expire after 48 hours, reset links after 2 hours; used or expired links are deleted every hour |
| Security counters with your IP address or email | Deleted within a day |
| Usage records | 13 months |
| Activity log | [3 years] |
| Billing records | As long as tax and accounting law requires; Stripe keeps its own records under its own policy |
| Messages to us | [2 years] after the matter is closed, or until you delete your account |
| Email records | [2 years]; we keep unsubscribes, bounces and complaints for as long as we send email, so we never email an address against its owner's wishes |
| Error reports | [90 days] |
| Backups | [35 days] |
7. Your choices and rights
- Download your data. On the Account page, "Download my data" gives you a file with your profile, your accounts and memberships, your saved homes and searches, the feedback and notes you wrote (with your images), and the list of activity-log events about you.
- Correct it. Change your name, email address and password on the Account page. A new email address must be confirmed before it is used.
- Delete your account. On the Account page, "Delete my account" asks for your password. A paid subscription must have fully ended first, and if you are the only admin of an account with other people on it, make someone else an admin first. Deleting removes your name, email address, password, sessions, saved items, account memberships, invitations sent by or to you, the text of your feedback and replies, your screenshots and your votes, and turns off your login for good. We keep billing and activity records that we need for accounting, security and legal reasons, with your email address replaced by a scrambled value; data that belongs to an account other people still use; support conversations, with your identity removed; and suppression entries, so that we never email you after a bounce, complaint or unsubscribe. Copies in backups disappear as the backups expire.
- Unsubscribe. Optional emails, such as alerts, have a one-click unsubscribe link. Unsubscribing does not stop emails needed to run your account, such as password resets and billing notices.
- Do Not Track and Global Privacy Control. We honor these signals as described in section 3.
- Ask us. You can ask us at [PRIVACY EMAIL] to tell you what information we hold about you, or to correct or delete it. We will confirm your request through your account's email address, and answer within [45] days. You may ask someone to make a request for you. If you live in a state whose law gives you more privacy rights, we will honor them, and if we turn down your request you can appeal by replying to our answer. We will not treat you differently for using any of these rights.
8. How we protect it
- Passwords are stored only as Argon2 hashes, a slow one-way scrambling designed for passwords.
- Sign-in cookies cannot be read by page scripts, are sent only over secure connections, and we store only scrambled copies of them.
- Every change made while signed in must carry a per-session security token.
- All traffic is encrypted, and our servers accept web traffic only through Cloudflare.
- Repeated failed sign-ins and sign-ups are limited.
- Staff access depends on each person's role, and staff actions are recorded in an activity log.
- Error reports are cleaned before they leave our app.
No system is perfectly secure, and we cannot guarantee that information will never be accessed without permission. If a breach affects your personal information, we will tell you as the law requires.
9. Children
REIalpha is not for anyone under [18], and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to [PRIVACY EMAIL] and we will delete it.
10. People who appear in our property data
REIalpha brings together information about properties from public records and other published sources. Some of it relates to people who are not our users, for example owners' names in county property records, names of deceased people in probate court filings, and addresses with city code-enforcement cases. We use it to show investors which properties may be for sale, in distress or priced below their value.
- In customer views, probate names are shown as initials only, and probate matches are labelled with how sure the match is ("name match only" means it may be a relative).
- If you believe information about you or a relative is wrong, or you want it removed, write to [PRIVACY EMAIL] with the property address. We will review your request, and correct or remove the information where that is appropriate or the law requires it.
11. Where your information is processed
REIalpha is run from the United States, and your information is stored mainly in the United States. Some service providers, and the error tracker and support inbox we run ourselves, process information in other countries, as shown in section 5.
12. Changes and contact
We may update this policy. We will post the new version on this page with a new date, and if a change is material, we will email account holders before it takes effect.
Questions or requests: [COMPANY LEGAL NAME], [POSTAL ADDRESS], [PRIVACY EMAIL].