Privacy Policy

1. What We Collect

Information you give us.

• Account information: your email address and password (managed by our authentication provider, Supabase; we never see your password in plain text), and an optional display name.
• What you save: saved locations, saved views, watchlists and any notes you add to them, export requests, and default settings such as a preferred state or property type.
• Billing information: if you subscribe, Stripe collects your payment card details directly. We never see or store your full card number. We receive your Stripe customer ID, billing email, and subscription status.
• Messages: if you email us, including through the Feedback button (which opens your own email app), we receive your email address and whatever you write.

Information collected automatically.

• Request and security logs: your IP address, browser type, and the pages and data you request, recorded by our hosting provider and used to keep the service running and secure.
• Data access log: when the site or MCP endpoint fetches a data file, we record which dataset, when, your account (if you’re signed in), whether access was granted, and your IP address.
• Rate limiting: we use your IP address to limit how many requests can be made in a short window. This applies to the MCP endpoint too, which otherwise needs no account.

What we don’t collect. We don’t use analytics or advertising trackers, we don’t collect your precise location, and we don’t ask for sensitive information such as government ID numbers, health data, or financial account numbers.

2. How We Use It

• To provide the service, including your account, saved items, and paid features.
• To process payments and manage your subscription.
• To send service emails, such as sign-up confirmation and password resets, and to reply when you contact us.
• To keep the service secure: preventing abuse, scraping, and fraud, enforcing rate limits and our Terms of Use.
• To fix problems and improve the service.
• To comply with the law and protect our rights.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to train AI models.

3. Who We Share It With

We share personal information only with the service providers that run siftAO for us, each limited to what it needs:

• Supabase: authentication and our database (account, saved items, access log).
• Vercel: website hosting and request logs.
• Cloudflare: storage for our data files. Your browser downloads these files directly from Cloudflare.
• Upstash: rate limiting, which uses your IP address.
• Stripe: payments and billing. Stripe handles your payment details under its own privacy policy.
• OpenStreetMap: map tiles. Your browser loads them directly from OpenStreetMap’s servers, which see your IP address.
• Our email provider: to send and receive email.

We may also disclose information to professional advisors such as lawyers and accountants; to authorities when we believe in good faith the law requires it or it is needed to protect rights, safety, or property; and to a buyer or successor if siftAO is sold, merged, or reorganized.

4. How Long We Keep It

• Account information and saved items: until you delete your account.
• Data access log: 90 days, then automatically deleted. If you delete your account sooner, your account is removed from these entries.
• Rate-limit counters: only for the length of the rate-limit window, typically seconds to minutes.
• Billing records: as long as we need them for tax, accounting, and legal purposes, even after you delete your account.
• Emails: as long as needed to handle your request, and no longer than our normal business records.

5. Cookies and Local Storage

We use only strictly necessary cookies, set by Supabase, to keep you signed in and secure. We also save your light or dark theme choice in your browser’s local storage; it never leaves your device. We don’t use advertising, analytics, or cross-site tracking cookies. Because we don’t sell or share personal information, there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of, but we treat a Global Privacy Control signal as a valid opt-out request anyway.

6. Your Choices

• Delete your account: you can permanently delete your account and everything saved in it at any time from your account page. Cancel any subscription in the billing portal first.
• Get a copy or correct something: email info@siftao.com.
• Use siftAO without an account: most of siftAO, including the MCP endpoint, works without signing in.

7. State Privacy Rights

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with consumer privacy laws, you may have the right to:

• know what personal information we collect, where it comes from, why we collect it, and who we disclose it to;
• get a copy of your personal information, in a portable format;
• correct inaccurate personal information;
• delete your personal information;
• opt out of the sale or sharing of your personal information, targeted advertising, and profiling that has legal or similarly significant effects. We do none of these;
• appeal if we deny your request; and
• not be discriminated against for using any of these rights.

To make a request, email info@siftao.com from the email address on your account, or tell us how to reach you if you don’t have one. We verify requests by confirming you control that email address, and may ask for more information if we can’t. You can use an authorized agent; we may ask for proof that you authorized them. To appeal a decision, reply to our response with “Appeal” in the subject line.

What we collected in the last 12 months, by the categories California law uses:

• Identifiers (email address, account ID, IP address): used to provide, secure, and support the service; disclosed to the service providers in Section 3.
• Commercial information (subscription and payment history): used for billing; disclosed to Stripe.
• Internet activity (request logs, data access log, saved items): used to provide and secure the service; disclosed to Supabase, Vercel, and Upstash.

We have not sold or shared personal information, and we don’t collect sensitive personal information. We don’t knowingly collect personal information from anyone under 16. Under California’s “Shine the Light” law, we don’t disclose personal information to third parties for their direct marketing purposes.

8. Children

siftAO is not intended for anyone under 18, and we don’t knowingly collect personal information from children. If you believe a child has given us personal information, contact us at info@siftao.com and we will delete it.

9. Security and Where Data Is Stored

We protect your information with encryption in transit, access controls, and database rules that limit each account to its own data. No system is perfectly secure, so we can’t guarantee security. siftAO is based in the United States, and your information is stored and processed in the United States and wherever our service providers operate.

10. Changes to This Policy

We may update this policy. We will change the “Last updated” date above, and for material changes we will notify you by email or with a prominent notice on the site.

11. Contact Us

Questions or requests: email SGV Housing LLC, dba siftAO, at info@siftao.com. We will provide our mailing address on request.