Privacy Policy

1. Information We Collect

Information You Provide

• Account information: name, email address, and password when you register.
• Payment information: billing address and payment card details processed by Stripe; we do not store raw card numbers.
• Property data: addresses, purchase prices, income assumptions, and other deal details you enter into the analyzer or portfolio tracker.
• PriceLabs API key: stored using AES-256-GCM encryption; we cannot read the plaintext value.
• Communications: messages you send to our support team.

Information Collected Automatically

• Usage data: pages visited, features used, clicks, and session duration.
• Device and browser information: browser type, operating system, screen resolution, and language.
• Cookies and similar technologies: session tokens, preference cookies, and analytics identifiers.
• Server logs: IP address, referring URL, and request timestamps.

Information from Third Parties

• Plaid: bank account metadata and transaction history when you connect a bank account to the Portfolio feature.
• RentCast: property valuation, tax, and assessed-value data.
• AirDNA: STR revenue estimates, occupancy rates, and average daily rates.
• PriceLabs: dynamic pricing calendar data for your monitored listings.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Process payments and manage subscriptions.
• Generate deal analyses, portfolio performance reports, and pricing monitor alerts.
• Send transactional emails and SMS notifications you have requested.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with applicable legal obligations.
• Respond to your support requests.

We do not sell your personal information to third parties.

3. Information Sharing

We share your information only in the following circumstances:

Service Providers

We engage the following third-party processors, each bound by a Data Processing Agreement:

• Stripe — payment processing
• Plaid — bank account connectivity
• Clerk — authentication and user management
• Vercel — hosting and edge network
• Neon — serverless Postgres database
• Resend — transactional email delivery
• Twilio — SMS notifications
• RentCast — property data
• AirDNA (via RapidAPI) — STR market data
• PriceLabs — dynamic pricing data
• Anthropic — AI analysis (Claude API)

Legal Requirements

We may disclose information when required by law, court order, or to protect the rights, property, or safety of STRvest, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

With Your Consent

We may share information for any other purpose with your explicit consent.

SMS / Mobile Information Sharing

No mobile information collected for STRvest's SMS program — including phone numbers, opt-in status, and consent records — will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with third-party subcontractors is limited strictly to those supporting the SMS program itself (e.g., Twilio, our messaging infrastructure provider) and excludes any sale, rental, or sharing for marketing purposes. All other categories of personal information exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. Data Retention

• Account and deal data: retained until you delete your account.
• Plaid transaction data: retained for up to 24 months.
• Payment records: retained for 7 years as required by law.
• Server logs: retained for 90 days.
• Deletion requests: processed within 30 days of a verified request.

5. Security

• Third-party API keys (PriceLabs, Plaid) are encrypted at rest using AES-256-GCM.
• All data in transit is protected by TLS 1.2 or higher.
• Authentication is managed by Clerk with enterprise-grade security and multi-factor authentication support.
• We conduct regular security reviews of our infrastructure and dependencies.
• In the event of a data breach, we will notify affected users as required by applicable law.

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Your Privacy Rights

All Users

• Access: request a copy of your personal data.
• Correction: update inaccurate information via your account settings.
• Deletion: request deletion of your account and associated data.
• Opt-out: unsubscribe from marketing emails at any time.
• Export: request a portable copy of your data.

California Residents (CCPA)

• Right to know what personal information we collect and how it is used.
• Right to delete personal information we have collected from you.
• Right to opt-out of the sale of personal information (we do not sell your data).
• Right to non-discrimination for exercising your privacy rights.
• We will respond to verified requests within 45 days.

EU/UK Residents (GDPR)

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to data portability.
• Right to object to processing based on legitimate interests.

To exercise any of these rights, email legal@strvest.com.

7. Cookies

We use cookies and similar technologies for:

• Session maintenance: keeping you logged in across pages.
• Preferences: remembering your settings and display choices.
• Analytics: understanding how users interact with the Service (via Vercel Analytics).

You can control cookies through your browser settings. Disabling certain cookies may affect your ability to log in or use core features of the Service.

8. Children's Privacy

STRvest is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us at legal@strvest.com and we will promptly delete it.

9. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any personal information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: legal@strvest.com
• Website: strvest.com