Privacy Policy
Last updated: August 4, 2026
1. What we collect
Account information (name, work email, firm name), the deal data you enter, and standard operational telemetry (error reports, usage events) needed to run and improve the service.
2. How we use it
To provide the platform, process billing, send transactional email, and fix problems. We do not sell your data, we do not share deal data with other customers, and we do not use your data to train AI models.
3. Where it lives, and who else processes it
Data is stored in Supabase (Postgres) with row-level security isolating each organization, and served via Vercel. Payment details are handled by Stripe and never touch our servers. Error monitoring runs through Sentry with request payloads redacted on sensitive routes. Transactional email is sent through Resend.
Two AI features send deal content to third-party model providers, and you should know which: the deal copilot and document intake send the text of your question and the relevant deal or document content to Anthropic, and reference-library search sends your query to Cohere to compute an embedding. Both are contractually barred from training models on that content. We also send property addresses to the US Census Bureau geocoder to resolve a census tract. Deterministic underwriting math — every figure on a run, a scorecard or a composed report — is computed by our own engine and is never sent to a model provider.
4. How long we keep it
We keep your account and deal data for as long as your organization has an account, and for 30 days after it is closed so that an accidental cancellation can be undone. Text extracted from documents you upload during intake is retained on the same basis; we do not retain the original uploaded file bytes at all — they are discarded once text is extracted. Audit-log and provenance records, which exist so that a past figure can be explained, are retained for the life of the account and are not editable by anyone, including us.
5. Your choices
You can export your deal data and correct your account information at any time. You can request deletion of your account and associated data by emailing us; during the invite-only beta this is a manual process, and we will complete it and confirm in writing within 30 days of the request. Deletion removes your organization's deal data, documents and extracted document text. We will tell you if anything is retained and why.
6. Contact
Privacy questions or data requests: justin@credealvision.com.