Privacy policy.

Overview

This Privacy Policy describes how Unlevered Inc. ("Unlevered," "we," "us") collects, uses, discloses, and protects information when you use the Unlevered platform, our website, and related services (collectively, the "Service").

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

Information we collect

We collect three categories of information:

Account information

Name, work email, firm name, role, billing address. Provided directly when you sign up or update your firm profile.

Client property data

Property addresses, closing statements, rent rolls, remodel receipts, photographs, and the public records we link to those properties. Uploaded by your firm or the property owner you invite.

Operational data

Authentication events, IP addresses, audit-log entries, and Stripe payment metadata. Collected automatically as you use the Service.

How we use information

We use information to:

• Provide the Service: run cost segregation engine analyses, generate studies, route engineered review.
• Extract facts from uploaded documents and photographs using AI models. Owner identity (names, tax IDs, contact and account details) is redacted or masked before material is sent for processing; property facts and photographs are processed to identify building components. All classifications and dollar calculations are produced by our deterministic engine, never by an AI model.
• Maintain and improve the engine using de-identified, aggregated operational data with personally identifying information removed.
• Prepare anonymized case studies and samples where the client’s engagement letter grants that consent (fictional owner identity and address by construction; opt-out honored per the letter).
• Process payments via Stripe Connect.
• Communicate operationally about your account, studies, and billing.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations (tax records, audit trails, subpoenas).

We do not sell your data, your clients’ data, or any property records you upload, and we do not permit AI providers to train models on your identifiable information.

Website analytics and advertising measurement

On our public website, Google Analytics runs only after you choose Accept on the cookie banner, and Google Ads measurement uses cookies only after Accept. The OpenAI (ChatGPT Ads) measurement pixel runs only after Accept; it reports page views and that a study request was submitted, and to match that request to an ad it sends OpenAI a one-way SHA-256 hash of the email you entered, computed in your browser. If you arrived from a ChatGPT ad and did not choose Decline, then when your study deposit is paid we report that sale and its amount to OpenAI from our server, with the ad click reference and the same kind of hash of your request email. OpenAI receives the hash, never your email itself, and never your name, property address, portal link, or card details. If you choose Decline, none of them runs. When you submit a study request or a study payment completes, we report to Google Ads that it happened, and for a payment its amount, so we can tell which ads lead to requests and purchases. If you have not made a cookie choice, that report is sent without cookies; a study-request report may include the ad click reference from the link you followed. It never includes your name, email, property information, portal link, or card details.

Emails we send

If you start an estimate request and leave before submitting, we save the email address you entered so we can send you one link to finish, and occasional education emails. You can unsubscribe from any of them with one click.

Sharing and disclosure

We share data only with the subprocessors listed in our Data Processing Addendum: Supabase (database), AWS (storage), Vercel (hosting), Stripe (payments), Anthropic (AI document and photo analysis — owner identity redacted before processing; API data is not used to train models), Fly.io (malware scanning of uploaded files), Smarty (address validation), Google Workspace (email delivery, including client-facing notifications), Slack (operational alerting), Sentry (anonymized error reports), Google Analytics and Google Ads (public-website analytics and advertising conversion measurement; no client property data, names, or emails), and OpenAI Ads (advertising conversion measurement; receives a one-way hash of the request email, never client property data, names, or the email itself). All subprocessors are bound by data processing agreements no less protective than this Policy.

We may disclose data when required by law, valid legal process, or to protect the rights and safety of our users.

Your rights

Depending on jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data. To exercise any of these rights, write to hello@unlevered.io. We respond within 30 days.

Deletion requests are honored by removing your data from active systems. Engagement records within their documented retention window, append-only audit ledgers, and encrypted backups retain limited records for the periods required for audit defense and legal compliance; those records are not used for any other purpose.

Retention

Active accounts: data retained while the account is active. Engagement records — delivered studies, workpapers, source documents, and the audit trail — are retained for at least seven (7) years from delivery, matching IRS audit windows and our engagement letters; delivered studies may be retained beyond that so your clients keep access. Cancelled accounts: access is disabled immediately and account data is soft-deleted from active systems; engagement records within their retention window and append-only audit ledgers are retained as described above. Encrypted backups age out on our backup schedule.

IP addresses captured with website lead and marketing submissions, used to understand where interest originates and to detect abuse, are retained for 90 days and then removed.

Security

Encryption at rest (AES-256) and in transit (TLS 1.3). Row-level access controls, default-deny. Audit logging on every material action. See our Security page for the full picture.

International transfers

Account information, client property data, and operational data are stored in US-East, and we do not transfer them outside the United States. The website analytics and advertising measurement described above is processed by Google and OpenAI, which may process it in other countries. If you access the Service from outside the US, your data is transferred to and processed in the US.

Changes to this policy

We’ll notify firm admins by email at least 14 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

Contact

Privacy questions: hello@unlevered.io. Mailing address: Unlevered Inc., 58 West Portal Ave #619, San Francisco, CA 94127-1304.