Initial privacy notice
Privacy Policy
Last updated July 29, 2026
Private household workspaces
Each self-service registration creates a separate household workspace. Other households cannot view its searches, notes, comparisons, or future documents.
Account and security data
We process account identity, password hashes, session records, login timestamps, IP addresses, browser information, and security audit events to operate and protect the service.
Deactivated accounts
When an administrator deactivates an account, sessions are revoked and a keyed one-way fingerprint of the normalized email is retained to prevent re-registration. The administrative record includes the reason and actor.
Account verification, password recovery, and security messages use Amazon SES in production. Development uses a non-delivering local outbox.
Property sources and maps
Approved source adapters retain only policy-listed property metadata and direct source links; descriptions, images, private notes, and owner or agent contact details are excluded from the first adapter. When Google location services are enabled, an address or area query is sent to Google for geocoding. We retain the returned Place ID and keep provider-derived coordinates as expiring evidence rather than storing the raw response or Google-formatted address components.
Retention and rights
Final retention periods, export procedures, deletion handling, and Panama Law 81 notices require approval before public production launch.
Production review required
This initial notice documents implemented behavior and must receive qualified privacy and legal review before public production launch.