Privacy policy
Privacy policy
A plain-language draft for Colorado counsel to reconcile with the Colorado Privacy Act and the breach-notification statute before launch. It describes what the product actually collects and who can see it. Bracketed items are blanks counsel fills in.
This is a plain-language draft for Colorado counsel. It describes what the product actually does so the reviewed version cannot contradict it; bracketed items are blanks counsel fills in. Nothing on this page is in force until counsel has reviewed it.
1 · Who is responsible for your data
De/commission is operated by [LEGAL ENTITY NAME], [MAILING ADDRESS], reachable at [CONTACT EMAIL]. We are the controller of the personal data described here. This policy covers the website, the application and any email or text message we send. It does not cover the partner brokerage, a title company, a lender, an agent you book, or any other party you deal with in your sale; each has its own policy.
2 · What we collect, and where it comes from
From you, when you create an account: your email address and, if you set one, a password, which is held by our authentication provider in hashed form and never visible to us. A seller pays before they have an account, so the address is the one they give the payment processor at checkout; we receive it from the processor, send the sign-in link to it, and it becomes the account. We receive no card details with it. From a seller, as they work: the address, county and kind of home; the names of the people they say own it, marked as seller-stated until the deed confirms them; every answer in the disclosure interview, with the time it was given; the list price; the public remarks they write for the listing; the details they state about the home — the number of bedrooms and bathrooms, the year it was built, the lot size, parking, heating, cooling and the basement; the photographs they upload for the listing and any caption they give one, which are stored and shown to anyone holding their private link; each acknowledgement they make — the fair-housing rules, their disclosure duty, and what the service is and is not at the start of the sale, the attestation to their disclosure answers, and the wire-verification confirmation — with the version of the text they saw and the date; what stays with the house and what goes; whether they say they want the listing sent to the partner brokerage for the MLS or intend to market to buyers themselves, which they may change at any time; the hours they host and the phone number and instructions they give for agents to arrange showings, which go to the partner brokerage; the listing-agreement signature, with who signed and when; each document signed on the service — the listing agreement, the property disclosure, the contract — with who signed it, when, the copy they signed, and, where an e-signature provider is connected, that provider’s reference; the pre-listing inspection report they upload, if they choose to have one done, together with the choice they make about who may open it; and, once under contract, the two figures only the seller knows — the mortgage payoff and any other amount coming off at closing. From a buyer: their name, the names of anyone buying with them, email, phone number, preferred showing time and any note; the phone-check confirmation where one is in use; every term of an offer or counter, including price, earnest money, financing, contingencies, dates, representation and the name of any agent; where an agent joins for a buyer, the agent’s name, brokerage, licence number and phone as the agent stated them; a signed copy of the Contract to Buy and Sell, if the buyer, their agent or the seller uploads one, and the dates the seller copies from it; the pre-approval letter from their lender, or the bank letter behind a cash offer, which they attach to their offer and which the seller can open and download — nobody else on the sale can, and we do not read it, index it or take anything out of it; and the full legal name they attest before submitting an offer. From both: every message sent through the service, every showing request and decision, and every entry on the transaction record, each stamped by the database with who acted and when. From public records and a property-data vendor: once you have paid, we ask HouseCanary — a property-data company — whether it can locate your address, and if it can we read the recorded transfers of the property from it (the grantor and grantee names on each deed, the recording reference and date, and the last recorded sale price) and, once you reach the pricing or details screen, one valuation report for the address. From that report we keep only what the screens show: the facts about the home as the vendor has them (bedrooms, bathrooms, year built, lot size, living area above and below grade, garage, basement, the association fee and the current tax bill), the vendor’s estimate with its band and confidence, and a set of recent closed sales nearby with the vendor’s adjustments to each, together with the vendor’s rating of how similar each sale is and how far away it is. In the same request we ask for two more things: how long homes in your ZIP code have been taking to sell, which is about other homes and not about yours; and your county assessor’s own record of the property as the vendor holds it — its square footage, parcel number, year built, lot size and assessed value — which we offer to you for the square-footage disclosure and never enter for you. We keep nothing else from the report — not other agents’ details, not other listings’ descriptions or photographs, not any forecast, and nothing about the neighbourhood — and we discard the rest at the moment it arrives. Every fact from the report is offered to you to confirm and is written to your listing only when you save it as your own statement. Where no vendor is connected, one of our operators reads the deed by hand and records the owner names, the date and a note. From your device: the technical logs any hosted service keeps — IP address, browser type, the pages requested and when. We run no third-party analytics or advertising trackers; our own usage log is described next. From your use of the site: a first-party log of which pages are opened and which steps of intake are reached, under a random identifier your browser keeps and, once you sign in, your account — so we can see where people arrive and where they get stuck. It holds no page content, nothing you typed, no IP address and no browser details, and it is never shared or used for advertising. From anyone who asks about a home we cannot serve yet: the address they gave and the reason we could not serve it, kept so we know where to expand next. Nothing else from those questions is kept, and the address is not linked to a person.
3 · What we do not collect or keep
We do not store the photographs you send for ✦ review — those are sent for one answer and kept by no one, and they are a different thing from the photographs you upload to your listing, which are stored and are described in section 2. We do not store the facts you type for a ✦ listing-copy draft. We do not store the property-data vendor’s full report — only the dozen or so fields described in section 2 — and we never store its forecasts, its scoring of the neighbourhood, or anything about other people’s homes beyond the sale price and the facts of the comparable sales it shows you. We do not store the questions you ask the thinking partner or its answers; the transaction record notes that you asked and which screen you were on, and nothing more. We do not hold your card number; the payment processor does. We have no field for wire instructions or bank account details and we never ask for them. We do not pass buyer letters to the seller and do not keep them. There is no channel for communications with your attorney and no place to store one.
4 · How we use it
To run your sale: to show a buyer what a seller has chosen to share, to bring a showing request to the seller, to carry an offer and its answer between the two sides, to calculate the deadlines an accepted offer sets, and to keep the transaction record. To answer a seller’s question through the thinking partner, which sends the question and the relevant facts of the sale to the model provider for that answer only. To send you the email and, with your consent, the text messages your sale needs. To enforce the rules of the service, including the fair-housing rules, and to keep it secure. To meet our legal obligations. We do not use your data to build a profile of you, to advertise to you, or to train any model.
5 · Who sees what
A seller sees everything on their own property: every buyer who has joined, every request, every thread, every offer, and the record. A buyer who has joined sees the address, the kind of home, the list price and the seller’s disclosure, together with their own requests, messages and offers — never another buyer’s, and never the seller’s payoff or net figures. The valuation report — the estimate, the comparable sales and their adjustments — is shown to the seller alone, on their own screens; it is never placed in a document, never shown to a buyer or the brokerage, and never offered as a download, because it is licensed to us for display to our own customer and not for passing on. Anyone with the private link, signed in or not, sees what the seller has put on the listing itself: the address, the kind of home, the list price, the public remarks, the details the seller states about the home and the photographs they uploaded. They see nothing else — not the disclosure, not the owner names, and nothing about any other buyer. The partner brokerage receives what it needs to enter and hold the listing: the property details, the disclosure, the list price, the public remarks and the signed listing agreement. Our operators, who confirm owners against the deed, see the property address and the owner names. An agent you book sees what you choose to show them. A pre-listing inspection report a seller uploads is visible to that seller alone unless they choose otherwise: they may leave it private, share it with the buyers who have joined their listing, or share it only with the buyer whose terms they have agreed. They can change that at any time, and taking the sharing away removes access immediately. It never goes to the partner brokerage, is never added to the disclosure packet and is never shown to anyone holding the listing link who has not joined. A title company, a lender or an inspector receives nothing from us; you hand them what they need. Thinking-partner conversations are visible to the seller who has them and to no one else on the service, and are not stored by us. Every access to the database is enforced per account at the database level: an account can read only the rows its role entitles it to, and there is no master key in the application that bypasses that.
6 · Service providers we rely on
We use a small number of providers to run the service, each under contract to process data only on our instructions: a database and authentication provider (Supabase), which holds the data described above and sends sign-in emails; a hosting provider (Vercel), which serves the application and keeps its technical logs; a model provider (Anthropic), which receives a thinking-partner question or a photograph for the duration of one answer and, under our agreement with it, does not train on it; and, where connected, a transactional email provider, a text-messaging provider, an identity-verification provider and a payment processor. [COUNSEL: confirm the list at launch against INTEGRATIONS.md and name each provider connected.] Data is stored in the United States.
7 · What we never do
We do not sell your personal data and we never have. We do not share it with lenders, title companies, inspectors, attorneys or anyone else for a fee or a referral payment; where we point you at a professional, we hand over nothing and nothing comes back to us. We do not use it for targeted advertising and we do not profile you. We do not show one buyer another buyer’s offer, and we do not tell a buyer what a seller would net.
8 · Automated features
The ✦ thinking partner, the ✦ photo reviewer and the ✦ listing-copy drafter are generated automatically. Their outputs are information for a seller to weigh; no decision about you is made or applied by them, and nothing on the service is applied to you without your say-so. Colorado’s automated decision-making law (SB 26-189) gives you the right to know when an automated system is in use, to ask how an output was reached, to have the data behind it corrected, to have a person review it, and to an explanation if an automated outcome goes against you. You can exercise each of these through [CONTACT EMAIL]. We keep a record of what the automated systems did and when, separate from your transaction record and for a shorter, statutory period. [COUNSEL: confirm the retention period for those records and the deadline for an explanation; the figures in the prototype were unverified and must not be reused.]
9 · Your rights under Colorado law
The Colorado Privacy Act gives Colorado residents the right to confirm whether we hold personal data about them and to access it; to correct it; to delete it; to obtain a portable copy; and to opt out of the sale of personal data, of targeted advertising and of profiling in furtherance of decisions with legal or similarly significant effects. We do none of those three things, so there is nothing to opt out of, and we honour the other rights whether or not the Act’s thresholds apply to a company of our size. [COUNSEL: confirm whether the Act’s thresholds apply at launch and whether a universal opt-out signal must be honoured.] You can also ask us to explain any automated output, as set out in section 8.
10 · How to exercise them
Email [CONTACT EMAIL] from the address on your account, or write to [MAILING ADDRESS]. We will confirm your identity by sending a link to the email on your account, respond within 45 days, and tell you if we need up to 45 more and why. If we refuse a request we will say why, and you can appeal by replying to that answer; we will respond to an appeal within 45 days, and if we still refuse you can contact the Colorado Attorney General. We do not charge for a first request in any twelve-month period.
11 · How long we keep it
There are two clocks and they are not in conflict. Your transaction record — the disclosure answers, signatures, offers, messages and every stamped entry — has to outlive the period in which someone could bring a claim against you. Colorado claims over undisclosed defects, misrepresentation and boundary or title disputes can surface years after closing, and construction-defect exposure runs longer still. We keep the record on a clock measured from your closing date, never from your last sign-in or the closing of your account. The period is [RETENTION PERIOD — counsel to confirm the outer limitation tail on each of those claims; retention exceeds the longest], and until it is confirmed we keep the record indefinitely rather than guess at a shorter number. Compliance records — what our automated systems did and when, and your consent to text messages and when you withdrew it — are kept for the period each statute requires and no longer. [COUNSEL: insert the ADMT record period and the TCPA consent record period.] The valuation report and the deed reading are kept with the property for as long as the transaction record is, because the price you set and the facts you confirmed were made against them and a later claim about either would need them. Everything else — account details, technical logs, contact preferences — is kept only as long as we need it to run the service or as the law requires, and technical logs are deleted on a rolling schedule of [LOG RETENTION]. Holding less for less time is the cheapest security control we have.
12 · Deleting your account
You can close your account at any time. When you do, we delete what we hold only for convenience: your contact preferences, any saved drafts and your login. We keep the transaction record of any sale your account took part in — including any signed contract attached to it, which the other party may still need, the photographs of the home as it was listed, and any pre-listing inspection report you uploaded — for the reasons and the period in section 11, because it is the evidence you or the other side may need if a claim is made; a request to delete it is refused on that ground and we will say so. We keep what the law requires us to keep, including compliance records. A buyer who closes their account is removed from the listing they joined, but the offers and messages they sent stay on the seller’s record as they were.
13 · How we protect it
Data is encrypted in transit. Every read and write is checked against the signed-in account by the database itself, row by row, so a seller cannot see another seller’s sale and a buyer cannot see another buyer’s offer; no part of the application carries a key that bypasses those checks. Anything that changes the record goes through a small number of database functions that stamp who acted and when, and nothing rewrites history. The model key and every provider secret live on the server and never in the browser. We keep no wire or bank details, so there are none to lose.
14 · If we are breached
If we determine that a security breach has exposed your personal information, Colorado law (C.R.S. § 6-1-716) requires us to notify you within 30 days of that determination, and it applies from our first customer with no size threshold. If more than 500 Colorado residents are affected we must also notify the Colorado Attorney General. We will tell you what was taken, not just that something happened, and what you can do about it.
15 · Cookies and browser storage
We use a session cookie to keep you signed in and a marker cookie, with a matching browser-storage key, when you are viewing the demo. The application also keeps a few things in your browser for convenience — an unsent offer draft, a buyer’s form while their email is being confirmed, whether you have seen a screen’s explanation — none of which leaves your browser — and a random identifier for the usage log described in section 2, which is the one stored value sent to us. We set no advertising or analytics cookies and load no third-party trackers.
16 · Children
The service is for adults entering a real-estate transaction. It is not directed at anyone under 18 and we do not knowingly collect data from them. If you believe a minor has given us data, tell us and we will delete it.
17 · Changes to this policy
If we change this policy we will post the new version here, with its date, and tell account holders by email before a material change takes effect. If we ever intend to use your data for a purpose not described here, we will ask first.
18 · Contact
Privacy questions and requests: [CONTACT EMAIL], or [LEGAL ENTITY NAME], [MAILING ADDRESS]. Last updated: [DATE]. Version: [VERSION].