Privacy Policy

1. Who We Are

Reveal Estate ("we," "us," or "our") is a real estate intelligence platform operated by Castor & Pollux LLC, a Florida limited liability company. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our platform at revealestate.xyz and broker.revealestate.xyz (collectively, the "Platform").

By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy. This Policy applies to all users: residential consumers, licensed real estate brokers and agents, and visitors.

2. Information We Collect

2.1 Information You Provide

• Account information: Name (optional), email address, and password (stored as a bcrypt hash — we never store your password in plaintext).
• Broker/agent information: Real estate license number and license state (broker portal users only). This information is required to access the broker portal and may be verified.
• Payment information: When you purchase a report or subscription, payment processing is handled entirely by Stripe. We do not receive or store credit card numbers, CVVs, or full card details. We store Stripe customer IDs and subscription IDs for billing management.

2.2 Information Collected Automatically

• Usage and search data: Property searches you perform, addresses you look up, reports you generate, pages you visit, and features you use.
• Sign-in and security data: Each time you sign in, or someone tries to sign in with your email, we record the date and time, whether it worked, the product used, your IP address, your browser and device type, and an approximate location (city, state, and country) estimated from your IP address. We do not use GPS or your device's location services. This data is used only for security, preventing fraud and account sharing, rate limiting, and helping you with your account.
• Session data: Session tokens stored in HttpOnly cookies to keep you logged in. Session tokens expire after 30 days.
• Password reset tokens: Temporary tokens stored when you request a password reset. These expire after use or within a short time window.
• Behavioral analytics: Subject to your choice (see Section 4.2), we collect page views, click patterns, scroll depth, mouse movements, and session recordings via Microsoft Clarity, Google Analytics, and Vercel Analytics. See Section 4 (Cookies) for details.

2.3 Information We Do NOT Collect

• We do not collect Social Security numbers, government ID numbers, or financial account numbers.
• We do not collect sensitive personal information beyond what is listed above.
• We do not collect information from children under 18.

3. How We Use Your Information

• Provide, operate, and maintain the Platform and its features
• Authenticate your identity and maintain secure sessions
• Process transactions and deliver property reports you purchase
• Prevent unauthorized access, fraud, and abuse (login rate limiting)
• Review sign-in activity to spot suspicious logins and support your account
• Send transactional emails: purchase receipts, password resets
• Analyze usage patterns to improve the Platform (analytics cookies, which you can opt out of; see Section 4.2)
• Comply with legal obligations, including tax and financial record-keeping
• Enforce our Terms of Service

We do not use your information to send marketing emails without your explicit opt-in, and we do not sell, rent, or trade your personal information to any third party for their marketing purposes.

4. Cookies & Tracking Technologies

4.1 Strictly Necessary Cookies

These cookies are required for the Platform to function. You cannot opt out of them while using the Platform. No consent is required to set these.

4.2 Analytics Cookies

How analytics cookies are handled depends on where you are visiting from, based on your approximate location from your IP address:

• United States: analytics cookies are on by default. You can opt out at any time with the "Opt Out" button on our cookie notice or the "Cookie Settings" link. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out automatically.
• Everywhere else (including the EU, UK, and Switzerland), or if we cannot tell where you are: analytics cookies are only placed after you accept them.

Your choice is saved in your browser and applies until you change it. Change your cookie settings.

• Microsoft Clarity sets cookies including_clck,_clsk,MUID to record mouse movements, clicks, and scroll behavior. Sessions are retained for 13 months. Clarity does not capture passwords or sensitive form inputs.
• Google Analytics sets the_ga and_ga_* cookies to count visits and see how people find and use the Platform: pages viewed, the site that referred you, your approximate location and device, and actions such as signing up, signing in, running a report, pulling title records, and completing a purchase (with the purchase amount). We do not send your name, email address, or payment details to Google.
• Vercel Analytics collects anonymized page view and performance data. No personally identifiable information is associated with these events.

If you opt out (or, outside the United States, do not accept), Microsoft Clarity and Google Analytics will not run. Opting out during a visit stops them from sending anything further. You can change your choice at any time with the "Cookie Settings" link at the bottom of our home page or on this page.

5. Third-Party Services & Data Sharing

We share data with the following third parties only to the extent necessary to operate the Platform. We do not sell your information to any of these parties for their own marketing.

6. Data Retention

7. Your Rights & Choices

7.1 Access & Export

You may export your personal data at any time from your Account Settings page. Your export includes your profile information, subscription status, property search history, and report purchase history. It does not include raw parcel data, scoring algorithms, third-party property records, or any proprietary Platform data — those are Castor & Pollux LLC trade secrets and are not exportable under any plan.

7.2 Deletion

You may delete your account from your Account Settings page. Upon deletion, your profile, session tokens, and search history are permanently deleted. Financial records (report purchases) are anonymized but retained for 7 years for legal compliance. See Section 9 for full details on what is deleted vs. anonymized.

7.3 Cookie Preferences

You may update your analytics cookie preference at any time: open cookie settings. Strictly necessary cookies cannot be disabled while using the Platform. We honor Global Privacy Control signals as an opt-out of analytics.

7.4 CCPA Rights (California Residents)

California residents have the right to: (a) know what personal information is collected and how it is used; (b) delete personal information; (c) opt-out of the sale of personal information (we do not sell personal information); (d) non-discrimination for exercising these rights. To exercise your rights, use the Account Settings page or contact us through the Platform. We will respond to verified requests within 45 days.

7.5 Do Not Sell

We do not sell, rent, or trade your personal information to third parties for their own commercial purposes. Period.

8. Proprietary Platform Data

Reveal Estate aggregates data from public records, government databases, and licensed third-party sources. The following constitute proprietary trade secrets and confidential information of Castor & Pollux LLC, regardless of your subscription tier:

• Aggregated parcel records and our curated property database
• Opportunity scoring algorithms, weights, and component calculations
• Component lifespan models and HouseFax grading logic
• Deed classification and title analysis models
• Bulk property records, even those derived from public sources

Users may not export, scrape, reverse-engineer, redistribute, or attempt to reconstruct any proprietary Platform data. The data export feature (Section 7.1) provides only data that you created or that was specifically created about you as a user.

9. Account Deletion & Data Removal

When you delete your account, the following actions are taken immediately:

Hard Deleted (permanent, immediate)

• Your user profile (name, email, password hash)
• All active session tokens
• Your subscription record
• Your property search history (TitleSearchLog records)

Anonymized (retained for legal compliance)

• Report purchase records: your user ID and session identifiers are nulled out. The financial record (amount, date, property) is retained for 7 years for IRS compliance. You cannot be identified from an anonymized record.
• Sign-in records: your email address and account link are removed. The IP address, approximate location, device, and timestamp are kept until they reach 90 days old, for security audit purposes, and then deleted.

Third-Party Data (outside our control)

• Stripe retains payment records per their own data retention policy. You may contact Stripe directly to request deletion of Stripe-held records.
• Microsoft Clarity session recordings that have already been captured are governed by Clarity's 13-month retention policy. We cannot retroactively delete third-party analytics data.
• Vercel Analytics data is anonymized and aggregated; individual records cannot be identified or deleted.

10. Data Security

We take reasonable measures to protect your information, including:

• Passwords hashed with bcrypt (12 salt rounds) — never stored in plaintext
• Session tokens are 32-byte cryptographically random values
• All cookies are HttpOnly and SameSite=Lax; Secure flag in production
• HTTPS enforced across all Platform domains
• Login rate limiting (5 failed attempts per 15 minutes per IP)
• Database encrypted at rest via Railway infrastructure

MVP caveat: We are an early-stage platform. Security practices are continuously being improved. No system is 100% secure, and we cannot guarantee absolute security of data transmitted over the internet. You acknowledge this risk by using the Platform.

11. Children's Privacy

The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us through the Platform and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy at any time. The "Last updated" date at the top of this page will reflect any changes. Your continued use of the Platform after changes are posted constitutes acceptance of the updated Policy. We recommend reviewing this page periodically. For material changes, we will make reasonable efforts to notify active users via the Platform.

13. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Florida, without regard to conflict of law principles. Any disputes arising under this Policy are subject to the exclusive jurisdiction of state and federal courts in Pinellas County, Florida, consistent with our Terms of Service.

13b. Additional Terms for Broker & Agent Users

• License information: Your real estate license number and license state are collected and stored. This information may be verified against state licensing databases. Providing a fraudulent license number is a material breach of the Broker Terms of Service.
• Report activity: All property reports you generate, including the property address and any client delivery details (email, name), are logged and associated with your account and your brokerage company for billing purposes.
• Company data: Brokerage-level data (report counts, billing records, invoices) is associated with your company account and is accessible to your company's admin users.
• Client information: If you enter a client's name or email when sending a report, that information is stored in your report history. You are responsible for ensuring you have appropriate authorization to share client information with us.
• Export & deletion: Broker account deletion removes your personal profile and sessions. Your report history records are anonymized (your user ID is disassociated) but retained for your company's billing records. Company accounts are not deleted when an individual user account is deleted.

14. Contact Us

For privacy-related questions, data export requests, or to exercise your CCPA rights, please contact us through the Platform. We will respond to verified requests within 45 days.