Privacy Policy

1. Scope

This Privacy Policy explains how Park Lane Real Estate LLC, a North Carolina limited liability company (“Park Lane Real Estate LLC,” “we,” “us”), collects, uses, shares, and protects information in connection with DealLevel (the “Service”). It covers the website, the free calculators, and the signed-in app. It does not cover third-party sites we link to, which have their own policies. The Service is offered in the United States only, as described in Section 13.

2. What we collect

2.1 Information you give us

• Account information. Your email address and authentication credentials, handled by our authentication provider. We never see or store your password in readable form. If you sign in with Google, we receive the basic profile information Google returns for that sign-in, such as your email address and name. We do not receive your Google password.
• Profile information. When you create an account we ask for your first and last name, the state you invest in, and whether the analysis is for you or for a client. A phone number is optional. If you sign in with Google instead, the same questions are asked inside the app and you can skip them there. Your name and phone number appear on reports you generate, so whoever you send one to knows who prepared it.
• Deal data. Property addresses, purchase prices, financing terms, rehab budgets, income and expense assumptions, deal names and notes, and any listing text or URLs you paste in.
• Communications. Messages you send us, including support requests and legal notices, and the email address you send them from.
• Billing information. When paid plans launch, payments are processed by Stripe. Stripe collects your payment card details directly and we never receive or store your full card number. We receive your billing contact details, the last four digits and card brand, and your subscription and transaction status.

2.2 Information collected automatically

• Log and device data. IP address (the number that identifies your internet connection), browser and device type, pages requested, referring page, and timestamps, generated by our hosting provider in the ordinary course of serving the site.
• Rate-limiting counters. To stop anyone from guessing passwords, misusing the Service, or running up its costs, we count how often some actions are used and pause an action for a while once it reaches its limit. What a count is filed under depends on the action:
  • Signing in with a password, or asking for a password reset: the email address you entered, and your IP address.
  • Using an AI feature, getting a photo from a listing link, or looking up a property’s details: your account ID (the random code our system uses for your account), and your IP address. Property lookups also count toward one total shared by everyone, which says nothing about you.
  • Starting checkout, managing your billing, or deleting your account: your account ID.
  The counters are stored with Upstash, our rate-limiting provider, so Upstash holds the email addresses, account IDs, and IP addresses they are filed under. A counter itself is only a number. Nothing else from a request, such as your password, a question, or a deal’s numbers, goes into one. Counters delete themselves on the schedule in Section 10.
• Product analytics. We use PostHog to record which features are used, which pages are viewed, and where people abandon a flow. Analytics is never used to build advertising profiles, is never sold or shared for advertising, and never receives the contents of your deals.

2.3 Information kept only in your browser

Some data never reaches our servers. Your theme choice, your dashboard view preference, and the inputs you type into the free calculators are stored in your browser’s local storage so a reload does not lose your work. We cannot read it, and clearing your browser data erases it.

2.4 What we do not collect

We do not ask for or knowingly collect government identifiers, bank account numbers, credit reports, health information, biometric data, precise device geolocation, or other sensitive categories of personal information. A property address you enter is data about a property, not a location reading from your device. Please keep sensitive information about yourself or others out of deal notes and pasted listing text.

3. Categories at a glance

Using the categories named in the California Consumer Privacy Act, which several other states follow closely:

We keep each category for the period in Section 10, share it only with the providers in Section 7, and never sell or share any of it as those words are defined by state privacy law.

4. How we use information

• To provide the Service, including storing, retrieving, and analyzing your deals.
• To run AI features when you request them, as described in Section 5.
• To authenticate you and keep your account secure.
• To enforce usage limits and to detect, prevent, and investigate abuse.
• To diagnose bugs, monitor reliability, and improve the Service.
• To set regional defaults from the state in your profile, and to put your name and phone number on reports you generate.
• To answer your support requests and send service, security, and billing notices.
• To process payments and manage subscriptions.
• To comply with law and to enforce our Terms.

We will not use your personal information for a materially different purpose than the ones listed here without telling you first and, where the law requires it, getting your consent.

5. AI features and model training

AI features are on paid plans only. When one runs, we send that feature’s inputs to our AI provider, Anthropic, which processes them and returns a result. Most of them run only when you ask. The reading of a saved deal is the exception and is named as such below:

• Reading a deal sends the figures and assumptions for that one deal. On a paid plan this runs on its own, shortly after you open or change a deal, so the reading is waiting for you rather than behind a button. It runs once per set of figures: reopening a deal you have not changed sends nothing.
• DealLevel AI, the chat on a deal’s page, runs only when you send it a question. Each question is sent with the earlier messages in the conversation, up to 20 messages in all, along with that deal’s name, address, strategy, figures, and assumptions, and the verdict the page is showing. We do not save the conversation. It lives only in your open browser tab, and reloading the page or pressing Start over clears it.
• Listing import sends the listing text you pasted, or the text our server extracted from a listing URL you pasted.
• Property lookup sends the address you entered, which is then used to run web searches against public sources.

We do not send your account email, your other deals, or your browsing history with these requests. We do not use your deal data or account information to train AI models, and our agreement with our AI provider does not permit it to train its models on them. Our AI provider may retain inputs for a limited period for abuse monitoring under its own terms.

Do not enter an address, note, or document into an AI feature that you would not be comfortable having processed this way. AI features can be turned off entirely, and while they are off no data leaves the Service for them.

6. Addresses, maps, and listing URLs

Four flows send data outside the Service in ways worth spelling out:

• Address autocomplete. As you type in an address field, our server sends the text you typed to Esri’s ArcGIS geocoding service, which suggests matching addresses. When you pick one, Esri also returns its map location, which we save with the deal. The request comes from our server, so Esri receives the address text but not your IP address or account details. To put addresses near you first, Esri also gets a rough location worked out from your IP address, about as precise as your town or city. We count address searches for each IP address, and picked addresses for each account and IP address, so no one can run up costs with automated requests. Those counters hold numbers, never what you typed, and expire on their own.
• Property details. When you start a new deal and pick an address from the suggestions, our server sends that address to RentCast, a property data company, along with the kind of property and the number of bedrooms if you chose them. We use its answer to fill in figures such as the price and property tax, to show similar homes listed nearby, and to give a rent estimate when you ask for one. RentCast gets the address and those two details, but not your name, email, IP address, or account details. We keep a copy of each answer for 7 days, filed under the address (and the kind of property and bedrooms, if you chose them) and not under your account, so a repeat lookup is answered without asking RentCast again. If RentCast has nothing on the address, a paid plan’s lookup may then try the AI search described in Section 5. If you choose to type the numbers in yourself, no address is sent to RentCast.
• Map pictures. A deal with no photo can show a small map of the area around the property instead. Your browser loads that map straight from OpenStreetMap, so OpenStreetMap receives your IP address and the part of the map your browser asked for, which shows roughly where the property is. It does not receive the address itself, your account details, or the deal’s numbers. OpenStreetMap handles the request under its own privacy policy.
• Listing URLs. If you paste a listing URL into the importer, our server fetches that page, strips it to text, and sends the text to our AI provider for extraction. The site you link to sees a request from our server, not from you. We block requests to private and internal network addresses.

7. Who we share with

We share personal information only with providers that process it on our behalf, under contract, for the purposes below. They may not use it for their own purposes, and they may not sell it. We do not hand your information to anyone for their own marketing.

Providers marked not yet in use are listed here before they are switched on, so nothing in this list is a surprise later. Until then no data reaches them. We will update the effective date above when one goes live.

We may also disclose information when law or valid legal process requires it, to protect the rights, safety, or property of users, the public, or us, or in connection with a merger, acquisition, financing, or sale of assets. In that last case we will require the recipient to honor this Policy or give you notice and a choice before any material change.

8. What we never do

• We do not sell or share your personal information for money or for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act and similar state laws. We have never done so, including in the preceding 12 months, and we do not sell the personal information of anyone under 16.
• We run no advertising in the Service and embed no advertising pixels, ad networks, or social media trackers.
• We do not train AI models on your deal data or account information, and we do not let our providers do so.
• We do not build profiles about you or make automated decisions that produce legal or similarly significant effects. Deal scores are about properties, not people.
• We offer no financial incentive in exchange for your personal information, and we do not charge different prices based on whether you exercise a privacy right.

9. Cookies and browser storage

We use session cookies to keep you signed in, and browser local storage for your theme, your dashboard view, and your free-calculator inputs. Blocking essential cookies will stop you from staying signed in.

Our analytics tool sets a first-party identifier so repeat visits are not counted as new people. We use no advertising or cross-site tracking cookies at all. Because we neither sell nor share personal information and run no targeted advertising, an opt-out signal has nothing to opt out of, but we honor Global Privacy Control signals as an opt-out request regardless.

10. How long we keep data

11. Security

We encrypt data in transit, rely on provider-managed encryption at rest, require authentication on every data-bearing endpoint, isolate each account’s data with row-level database security, rate-limit expensive endpoints, keep API credentials server-side only, and validate user-supplied URLs before fetching them. No method of transmission or storage is completely secure and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any regulators within the time state law requires. You can help by using a strong, unique password and telling us promptly at [ADD SUPPORT EMAIL] if you suspect unauthorized access.

12. Your rights and choices

You can review, edit, and delete your deal data in the Service at any time, and you can print or save any deal report as a PDF. To get a machine-readable copy of everything we hold on you (a data file other software can open), email [ADD SUPPORT EMAIL] and we will handle it within the timeframes in Section 12.2.

You can delete your whole account yourself, on your Account page under “Closing your account.” If you pay for a plan, your subscription is cancelled first, so nothing is charged again. Then, at once, we remove your sign-in details, your profile, every deal you saved (including any AI reading), and the photos you uploaded. This cannot be undone. A few records are kept after that:

• Payment records. If you ever opened checkout or billing, Stripe keeps its customer record for you, with your email address, your account ID, and any billing details you entered, along with the receipts for payments already taken. Section 10 explains why and for how long.
• Rate-limiting counters filed under your account ID, until they delete themselves on the schedule in Section 10.
• Server logs and analytics events already recorded (the site’s records of requests and of which features were used), for the periods in Section 10.
• Backup copies of our database, which are encrypted, until our database provider overwrites them on its normal cycle.

Anything kept only in your browser, described in Section 2.3, stays there until you clear your browser data. If you cannot sign in, email [ADD SUPPORT EMAIL] from the address on your account and we will delete the account for you within 30 days.

12.1 Rights under U.S. state privacy laws

Depending on where you live, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and a growing list of other states, you may have the right to:

• know what personal information we collect, use, and disclose, and why;
• access a copy, in a portable machine-readable format;
• correct inaccurate personal information;
• delete your personal information;
• opt out of sale, sharing for targeted advertising, and profiling. We do none of these, so there is nothing to opt out of;
• limit the use of sensitive personal information. We collect none; and
• not be treated differently for exercising any of these rights.

Nevada residents may direct us not to sell their covered information. We do not sell it in any case, and a request to that effect will be honored.

12.2 How to make a request

Email [ADD SUPPORT EMAIL] from the address on your account, or include enough information for us to verify you. An authorized agent may act for you with written permission we can verify. We acknowledge requests within 10 business days and respond within 45 days, extendable once by another 45 days with notice to you. If we deny a request, we will explain why, and you may appeal by replying to our response; we will decide the appeal within 45 days and tell you how to complain to your state attorney general if you disagree.

13. United States only

The Service is offered to, and intended for, users in the United States. We store and process information in the United States. We do not offer the Service to individuals in the European Economic Area, the United Kingdom, or Switzerland, and this Policy does not describe rights under the GDPR or UK GDPR. Please do not use the Service or send us personal information if you are located in one of those regions.

14. Children

The Service is for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect it from anyone under 13 as defined by the Children’s Online Privacy Protection Act. If you believe a minor gave us information, contact [ADD SUPPORT EMAIL] and we will delete it.

15. Changes to this Policy

We may update this Policy as the Service changes. We will update the effective date at the top and, for material changes such as adding a category of data or switching on a new provider, give reasonable notice by email or in the app before the change takes effect. Using the Service after that means you accept the updated Policy.

16. Contact

Park Lane Real Estate LLC
[ADD MAILING ADDRESS]
Privacy questions, data access, and deletion requests: [ADD SUPPORT EMAIL]