Privacy Policy

Last updated June 8, 2026

This Privacy Policy explains how Digital Growth Partners LLC ("STRATA," "we," "our," or "us") collects, uses, and shares information when you use STRATA Real Estate Intelligence (the "Service"), including the websites strata-rei.com and any related applications. By using the Service, you agree to this Policy.

Quick summary. We collect what we need to provide the Service: your account info, the property addresses and lead data you enter, your subscription details through Stripe, and basic usage logs. We share data only with the vendors that power STRATA's features (listed below). We don't sell your data, and you can request to delete it.

1. Information we collect

Information you provide directly

Account information: name, email address, and password when you sign up or are invited.
Brokerage and team information: company name, agent names, contact details, and team structure you enter into STRATA.
Property and lead data: addresses, owner names, contact details, notes, photos, and any other information you submit when using Lead Discovery, CMA, Pipeline, CRM, Flipper, Predictive Sellers, or any other tool.
Chatbot and AI inputs: messages you or your site visitors send to the Lead Capture Chatbot, prompts you submit to image-generation, drone-video-generation, and report-generation tools.
Payment information: when you subscribe to a paid plan, payment data (card number, billing address) is collected and processed by Stripe. We don't see or store full card numbers — we only retain Stripe customer IDs and subscription metadata.
Support communications: if you contact us, we keep a record of the conversation.

Information collected automatically

Authentication tokens: a secure HttpOnly session cookie set after sign-in (issued by Supabase Auth).
Usage logs: which tools you open, what features you use, and when. Used to deliver the Service and monitor for abuse.
Technical data: IP address, browser type, device type, operating system, and timestamps for each request. Used for security and rate-limiting.
Error reports: if something breaks, we collect a stack trace (no personal data in payloads) through Sentry.

Information from third parties

When you use the property-data tools, STRATA queries third-party data providers (ATTOM, Google Maps, Google Places, GreatSchools, WalkScore, Estated) and receives information about the addresses you searched. This information is associated with your account so you can revisit your searches.

2. How we use information

Operate the Service: sign you in, provision the right tools to your account, render dashboards and reports.
Process payments: create checkout sessions, manage your subscription, and respond to webhook events from Stripe.
Power AI features: send prompts and content you provide to AI providers (Anthropic, Google AI) to generate scoring, narrative reports, images, and chatbot replies.
Improve and secure the Service: debug errors, enforce rate limits, detect abuse, and improve performance.
Communicate with you: respond to support requests, send service announcements, and (with consent) marketing updates.
Comply with legal obligations: respond to lawful requests and enforce our Terms of Service.

We do not use your tenant data (the property addresses, lead lists, CRM entries you store in STRATA) to train our models or any third-party model. Your data is your data.

3. Vendors and service providers we share data with

STRATA is built on top of a stack of specialized services. The categories of data each one receives, and what they do for STRATA, are listed below.

Provider	Purpose	Data shared
Supabase	Authentication and database hosting	Account credentials, all tenant data
Render	Application hosting	Request metadata, logs, environment
Stripe	Subscriptions, billing, payment processing	Email, billing address, payment card (handled directly by Stripe)
Anthropic (Claude)	AI scoring, narrative generation, chatbot replies, contract analysis	Prompts you submit (addresses, contracts, listing descriptions, chatbot messages)
Google AI (Gemini, Veo)	Image and video generation	Prompts and uploaded photos
Google Maps / Places	Street View images, address autocomplete	Addresses you enter
ATTOM Data	Property records, AVM estimates, foreclosure status	Property addresses you research
GreatSchools, WalkScore, Estated	Neighborhood reports and supplementary property data	Property addresses you research
Resend	Transactional email (hot-lead alerts, notifications)	Recipient email, message contents
Sentry	Application error monitoring	Stack traces, request paths (no PII in payloads)

Each vendor processes data under their own privacy policy and is bound to their public commitments around security and data handling. Stripe is PCI-DSS compliant. Anthropic and Google AI have published policies committing not to use customer prompts to train their public models.

4. Sharing in other contexts

With your team: users in the same organization can see shared tenant data (CRM, leads, pipelines, CMAs) by design.
Public visitors: if you enable the Lead Capture Chatbot or share a CMA, the contents you mark public are visible to anyone with the link.
Legal compliance: we may disclose information if required by subpoena, court order, or applicable law.
Business transfers: if STRATA is sold, merged, or acquires another company, your information may transfer as part of that transaction. You'll be notified.
We do not sell personal information.

5. Cookies and tracking

STRATA uses strictly necessary cookies:

sb-access-token (HttpOnly, Secure, SameSite=Strict): your authenticated session token.
sb-refresh-token (HttpOnly, Secure, SameSite=Strict, scoped to /auth): used to refresh expired sessions.

We do not use third-party advertising trackers. We do not run cross-site analytics scripts.

6. Your rights

Depending on where you live (California's CCPA, Europe's GDPR, or similar laws), you may have the right to:

Access the personal information we have about you.
Request correction of inaccurate information.
Request deletion of your account and associated data.
Receive a copy of your data in a portable format.
Object to or restrict certain processing.
Opt out of marketing communications.

To exercise any of these rights, email privacy@strata-rei.com. We'll respond within 30 days. We may need to verify your identity before fulfilling sensitive requests.

7. Data retention

We retain data for as long as your account is active. After you cancel your subscription:

Tenant data (leads, properties, CMAs, CRM entries): kept for 60 days, then permanently deleted unless legally required to retain longer.
Account records (email, name, subscription history): kept for 7 years for tax and audit purposes.
Webhook event records (Stripe events for billing reconciliation): kept for 30 days.
Server logs: typical retention 30-90 days, depending on volume.

You can request immediate deletion of your tenant data by emailing privacy@strata-rei.com.

8. Data security

We take security seriously. STRATA implements:

TLS encryption in transit (Let's Encrypt certificates, HSTS enforced).
Row-Level Security in our Postgres database to keep tenants strictly isolated.
HttpOnly, Secure, SameSite=Strict session cookies.
Rate limiting on sensitive endpoints (login, AI, billing).
Server-side allowlists, body-size caps, and prompt-injection protections on AI inputs.
Webhook signature verification for all Stripe events.

No system is perfectly secure. If you discover a vulnerability, please email security@strata-rei.com. We commit to investigating within 14 days and remediating before public disclosure (90-day responsible-disclosure window).

9. International users

STRATA is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses or equivalent mechanisms with vendors that process data internationally.

10. Children's privacy

STRATA is not intended for users under 18. We do not knowingly collect personal information from minors. If we discover that a minor has provided us with personal information, we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be notified by email or through an in-app banner at least 14 days before they take effect.

12. Contact

Privacy questions, data-subject requests, and complaints:
privacy@strata-rei.com

Security disclosures:
security@strata-rei.com

General legal inquiries:
legal@strata-rei.com

Mailing address: Digital Growth Partners LLC, Colorado, United States.