Privacy Policy

DealBase (“DealBase,” “we,” “us,” or “our”) operates dealbaseai.com and the DealBase platform (the “Service”). This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the choices you have. By using the Service you agree to the practices described here.

1. Information We Collect

Account & Identity

When you create an account we collect your name, email address, and any profile information you provide. Authentication is handled by Clerk; your credentials are stored and managed by Clerk under their own privacy policy.

CRM & Business Data

The Service lets you store data about your real estate clients and transactions, including contact information (names, email addresses, phone numbers), property addresses and details, deal terms, notes, tasks, and communications you log. This data belongs to you; we process it only to provide the Service.

AI Interactions

When you use the AI assistant or AI-powered features (CMA generator, listing writer, lead qualification, deal coach, etc.), your inputs and the resulting outputs are processed by Anthropic and stored in your account so you can reference them later. We do not use your conversation history to train AI models.

Payment Information

Billing is handled by Stripe. We do not see or store your full card number, CVV, or bank account details. Stripe provides us with a customer identifier and subscription status.

Files & Documents

Property images, contact documents you import, and e-signature documents are stored in private cloud storage. They are not publicly accessible; access requires a short-lived signed URL tied to your authenticated session.

Communications You Send

If you use DealBase to send email to clients (via Resend) or SMS messages (via Twilio), the content and recipient details pass through those providers. Your clients’ email addresses and phone numbers are used solely to deliver the messages you instruct us to send.

E-Signature

Document signing is facilitated by DocuSign. When you initiate a signature request, signer email addresses and the document are transmitted to DocuSign. DocuSign’s privacy policy governs their handling of signing data.

Booking Form

Our public “Book a Call” form collects your name, email, phone number (optional), and any message you include. This information is used to schedule and confirm your call. Bot protection is provided by Cloudflare Turnstile, which may process your IP address and browser signals.

Usage & Technical Data

We collect standard server logs (IP addresses, browser type, pages visited, timestamps) and application-level usage metrics to operate, secure, and improve the Service. We do not currently use third-party analytics or advertising trackers.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Authenticate you and keep your account secure
• Process payments and manage your subscription
• Deliver emails, SMS, and e-signature requests that you initiate
• Generate AI-powered outputs (CMA reports, listing copy, lead scores, etc.) on your behalf
• Send you operational notices (booking confirmations, billing receipts, security alerts)
• Respond to your support requests
• Detect and prevent abuse, fraud, and unauthorized access
• Comply with legal obligations

We do not sell your personal information or your clients’ data to third parties. We do not use your data for cross-context behavioral advertising.

3. How We Share Your Information

We share data only as necessary to operate the Service:

• Clerk — identity and authentication
• Supabase — database and file storage (hosted on AWS; SOC 2 Type II)
• Stripe — payment processing
• Anthropic — AI inference (your prompts and outputs)
• Resend — outbound email delivery
• Twilio — outbound SMS delivery
• DocuSign — electronic signature facilitation
• Rentcast — real estate comp data for CMA reports (property addresses only)
• Cloudflare — bot protection (Turnstile) and CDN
• Vercel — application hosting and edge infrastructure
• OpenStreetMap — map tiles for the property map view. Tiles load directly from OpenStreetMap servers in your browser, so your IP address and the map area you are viewing are visible to them. No account or property data is sent.
• unpkg — a public CDN serving the map component’s stylesheet and marker icons. Like the map tiles above, these load directly in your browser, so your IP address is visible to them. No account or client data is sent.

Integrations you choose to connect. If you connect a CRM — Follow Up Boss, Wise Agent, or BoldTrail/kvCORE — DealBase sends and receives client contact and deal records to keep the two systems in sync. If you configure an outbound webhook or connect Zapier, DealBase sends the events you select to the destination you specify. These transfers happen only for integrations you enable, and you can disconnect them at any time from Settings.

MLS report links. When you paste an MLS report link into the Listing Reader, our servers fetch that page from the MLS provider that issued it (for example GSMLS) in order to read the listings it contains.

We may also disclose information if required by law, court order, or to protect the rights, property, or safety of DealBase, our users, or the public.

4. Data Retention

We retain your account data and CRM data for as long as your subscription is active. If you cancel your subscription, we will retain your data for 90 days so that you can request a copy, after which it will be deleted from production systems. Where backups exist, they may persist for a further 30 days. You may request earlier deletion by emailing info@dealbaseai.com.

Booking inquiries (from prospective users) are retained for 12 months for follow-up purposes, then deleted.

AI assistant history. Your conversations with the AI assistant — the prompts you write and the responses you receive — are stored in your account so you can return to them, and follow the same schedule as your other account data: retained while your subscription is active, deleted from production 90 days after cancellation. You can delete any individual conversation at any time from the chat sidebar, which removes it immediately.

Records we keep after an account is deleted. Three narrow categories of compliance record survive account deletion, because deleting them would destroy evidence that protects the people you contacted:

• Opt-out records — if someone asked to stop receiving your emails or texts, that request is kept. An opt-out the sender can erase is not an opt-out, and closing an account must not become a way to clear one.
• Consent records — when and how a contact agreed to be messaged. This is the evidence of lawful basis for messages already sent.
• AI action logs — when the AI assistant sends an email or SMS or pushes a contact to a connected CRM, we record what was called, when, and the destination. These are deliberately not editable from the app, because an audit trail its subject can rewrite is not an audit trail.

These records hold the destination, channel, timestamp and reason — not your CRM data, which is deleted in full. Both GDPR and CCPA erasure rights carry exemptions for records retained to comply with legal obligations; this is that category, and we document it here in advance rather than deciding after the fact.

5. Security

We apply industry-standard safeguards: all data in transit is encrypted with TLS. Data at rest is encrypted by our storage providers. Database access is controlled by row-level security policies that isolate each agent’s data. OAuth tokens (e.g., DocuSign) are encrypted at rest using AES-256-GCM before storage. We perform rate limiting to defend against credential-stuffing and abuse.

No security measure is perfect. If you discover a vulnerability, please disclose it responsibly to info@dealbaseai.com.

6. Your Rights & Choices

Depending on your jurisdiction, you may have rights to access, correct, export, restrict processing of, or delete your personal data. To exercise any of these rights, email info@dealbaseai.com with “Privacy Request” in the subject line. We will respond within 30 days.

Exporting your data. You can download a complete copy of your account at any time from Settings → Profile. The file is machine-readable JSON and includes not only the records you entered — clients, properties, deals, tasks — but also your AI assistant transcripts, your message history, and the judgements our AI has derived about your contacts, such as preference profiles and lead scores. It excludes stored credentials (integration tokens, portal link tokens, webhook signing secrets), because putting working keys in a downloadable file would create a risk we are not willing to hand you. If you would prefer we send the copy to you instead, email us at the address above and we will respond within 30 days.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority. Our legal basis for processing your data is contract performance (providing the Service you subscribed to) and, where applicable, our legitimate interests in operating and securing the Service.

7. Your Clients’ Data

When you use DealBase to manage information about your real estate clients, you are the data controller for that data and we act as a processor on your behalf. You are responsible for ensuring you have the appropriate basis to store and process your clients’ personal information in DealBase, and for complying with any applicable privacy laws (such as state-level consumer privacy statutes) that apply to your business.

8. Cookies & Tracking

DealBase uses only functional cookies required for authentication (set by Clerk) and session management. We do not currently use advertising cookies or tracking pixels. Cloudflare Turnstile may set a cookie during bot-challenge verification.

9. Children’s Privacy

DealBase is a professional B2B tool intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently done so, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and notify active subscribers by email at least 14 days before the changes take effect. Continued use of the Service after that date constitutes acceptance of the updated policy.

11. Contact

Questions or requests regarding this Privacy Policy should be sent to: