Privacy Policy

Last updated: September 23, 2026 · Version 1.0 (draft — legal review pending)

Parcel ("we", "us"), operated by [LEGAL ENTITY NAME], processes a small amount of personal data to run the service. This policy explains what, why, and your rights. Questions:[email protected].

1. Data we collect

• Account: email address (login codes), Google account identifier if you use Google login, login timestamps, subscription status.
• Your content: saved properties, shortlists, shared-report links you create.
• Usage (fair use & security): counts of property views and fresh analyses, device/browser basics, IP-derived coarse location for rate limiting and abuse prevention.
• Payments: handled by Paddle, our Merchant of Record. We receive subscription status and invoices — never your card numbers.
• Support: emails you send us.

Property records themselves (ownership, sales, assessments) are public records about properties, not data we collect about you.

2. Why we process it (legal bases, EEA/UK)

• Contract: account, login, reports, billing status, saved data.
• Legitimate interests: security, abuse prevention, fair-use metering, service improvement. We balance these against your rights and keep collection minimal.
• Consent: only where required (e.g., optional cookies beyond strictly necessary ones — we currently set none).
• Legal obligation: invoices and tax records via Paddle, retained as required by law.

3. Cookies and local storage

• Session cookie (strictly necessary): keeps you logged in. HttpOnly, Secure, SameSite=Lax.
• Anonymous view counter (local storage): counts free property views before asking for an account. No tracking, no cross-site use.

We run no third-party advertising or cross-site tracking.

4. Sharing

We do not sell personal data. Processors with limited access:

• Paddle — payments and subscription management.
• Email delivery — transactional login codes and receipts.
• Cloud infrastructure (hosting, CDN) — stores and serves the service.
• AI compute — property facts (no account identifiers beyond what is needed to meter fair use) are sent to our model provider to render Investor Briefs; they are cached and reused.

We disclose data to authorities only when legally required.

5. Retention

• Account + saved data: until you delete your account, then within 30 days.
• Usage/fair-use counters: rolling 13 months.
• Security logs: up to 12 months.
• Billing records: as tax law requires (via Paddle).

6. Your rights

Depending on where you live (including GDPR/UK rights): access, correction, deletion, portability, restriction, objection, and withdrawing consent. Exercise them via [email protected]; we reply within 30 days. You may also complain to your local data protection authority.

7. Security and transfers

TLS in transit, least-privilege access, encrypted backups. Servers are in the EU/US; where data leaves the EEA/UK we rely on adequacy or standard contractual clauses with processors.

8. Children

The Service is not for under-18s. We do not knowingly process children's data.

9. Changes

Material changes get prior notice (email or in-app). Continued use after the effective date means acceptance.

10. Contact

[LEGAL ENTITY NAME, REGISTERED ADDRESS] ·[email protected]