This Privacy Policy explains what information DealCaddie.ai, operated by DealCaddie LLC (“DealCaddie,” “we,” “us,” “our”) collects, how we use it, and the choices you have. By using the service, you consent to the practices described here.
1. Effective Date
This policy is effective as of June 27, 2026.
2. Who We Are
DealCaddie.ai is an AI-powered real estate investment analysis service operated by DealCaddie LLC. You can reach us at support@dealcaddie.ai.
3. Information We Collect
We collect only what we need to deliver and improve the service:
- Account data: email address, hashed password (bcrypt / PBKDF2), plan tier, account-creation and last-login timestamps.
- Usage data: property addresses you analyze, your assumption templates, saved pipeline deals, notes, and status changes.
- Payment data: handled entirely by Stripe. We do not store your card number, CVC, or bank account. We store your Stripe customer ID and subscription ID to look up billing status.
- Technical data: IP address, user-agent string, cookies (see Section 5), and error logs captured by Sentry. Sentry events may include partial request context, minimized to exclude PII where possible.
- Communications: emails or support messages you send us.
- Saved search data: the markets, price ranges, criteria, map areas you draw, and names you give your saved searches, together with the listings those searches returned and the actions you took on them.
- Client data you provide (Agent plan): if you use client features, the names, email addresses, telephone numbers, notes, shortlists, and messages you enter about your clients. You provide this information about other people; we process it on your behalf. See Section 16.
- Device and browser signals: where we offer a limited trial to visitors who are not signed in, we may record an IP address, a browser fingerprint, and a cookie token to count trial usage and prevent abuse. This is used for that purpose and for security, and is not used to build an advertising profile.
4. How We Use Information
- To provide, operate, and improve the DealCaddie service;
- To process payments through Stripe;
- To send transactional emails (password resets, receipts, billing notices);
- To send product updates and occasional marketing — you can opt out at any time;
- To debug errors and diagnose performance issues through Sentry and server logs;
- To enforce our Terms and prevent fraud or abuse.
5. Cookies
We use a small set of cookies:
dc_guest_id(90 days, Secure, SameSite=Lax) — a random UUID used to enforce the one free analysis per guest limit before signup.- Session cookie (HttpOnly, Secure) — keeps you logged in.
To prevent abuse of the one-free-analysis guest trial before signup, we enforce that limit using a combination of signals: the dc_guest_id cookie above, your IP address, and a basic browser fingerprint (general characteristics of your browser and device). These signals are used only to prevent repeated free-trial use — not for cross-site tracking or advertising.
We do not use third-party advertising or behavioral-tracking cookies.
6. Third-Party Services
To deliver the service we share limited data with the following providers, each governed by its own privacy policy:
- Stripe — payment processing. stripe.com/privacy
- RentCast — rent and sales estimates for property addresses you analyze. rentcast.io/privacy-policy
- Listing data provider — a third-party real estate listing data provider (RapidAPI / Zillow) used to retrieve property and listing information for the addresses you analyze. rapidapi.com/privacy
- Google Places & Street View — address autocomplete and property imagery. policies.google.com/privacy
- AI model provider — property data and analysis inputs are sent to a third-party AI inference provider to generate deal narratives, Caddie's Take, and AI chat responses. Inputs may be processed by the provider under their terms; we do not name the provider here because it may change, but the scope of data is limited to the inputs you submit for analysis.
- Resend — delivery of transactional and notification email, including alerts and digests you enable and, on the Agent plan, messages you send to your clients. resend.com/legal/privacy-policy
- Twilio — delivery of text messages you have opted in to receive, and, on the Agent plan, text messages you send to your clients. twilio.com/en-us/legal/privacy
- Sentry — error tracking and performance monitoring. sentry.io/privacy
- Railway — hosting and database infrastructure. railway.com/legal/privacy
- Reference datasets (no personal data sent): we also use published datasets from the U.S. Department of Housing and Urban Development, the U.S. Census Bureau, and Inside Airbnb. These are bulk files we download and process ourselves; no information about you or the addresses you search is sent to any of them, and they receive nothing from us.
- Plausible Analytics — privacy-friendly, cookieless web analytics used to understand aggregate site usage. Plausible receives aggregate page-view data (such as page URL, referrer, and approximate region) and does not collect personal identifiers or use tracking cookies. plausible.io/privacy
7. Data Sharing
We do not sell your personal data. We share it only with:
- Service providers listed in Section 6, under contracts that restrict use to operating the service;
- Law enforcement or regulators when required by valid legal process;
- A successor entity in the event of a merger, acquisition, or sale of substantially all assets — in which case we will provide notice and your data will continue to be protected under a policy at least as protective as this one.
Text messaging consent is excluded from all of the above. Mobile phone numbers and SMS opt-in data and consent are not shared, sold, rented, or transferred to any third party for marketing purposes, and are not shared with affiliates or partners. They are used only to deliver the messages you asked for, through our messaging carrier.
8. Text Messages (SMS)
DealCaddie can send account notifications by text message — for example, a new lead, a client request, or a new Buy Box match. This is an optional feature, off by default.
- How you opt in: text alerts are turned off for every category until you enable them yourself under Notifications on your Account page. Enabling a Text toggle there is your express consent to receive texts from DealCaddie at the mobile number on your profile. Consent is never a condition of creating an account, subscribing, or using any other part of the service.
- Message frequency: varies — messages are triggered by activity on your own account, not on a schedule.
- How to opt out: reply STOP to any message, or switch the Text toggles off on your Account page. Reply HELP for assistance, or email support@dealcaddie.ai.
- Cost: DealCaddie does not charge for text alerts. Message and data rates may apply from your mobile carrier.
- Carriers: supported carriers are not liable for delayed or undelivered messages.
- Your data: your mobile number and your SMS consent are used solely to send you the notifications you enabled. As stated in Section 7, SMS opt-in data and consent are never shared with or sold to third parties. Messages are delivered through our messaging provider (Twilio), which processes them on our behalf under contract and may not use them for its own purposes.
Clients of DealCaddie agents do not receive text messages from DealCaddie. Client communication is by email only, and every such email carries a one-click unsubscribe link.
9. Data Retention
We retain account and usage data for as long as your account is active plus approximately 30 days after deletion, after which data is removed from our live systems. Encrypted database backups may retain data for up to 90 days. Sentry error events are retained per Sentry's default retention (typically 30–90 days). Deletion requests are processed within 30 days.
10. Your Rights
Depending on where you live, you may have rights under laws like the GDPR (EU/UK) or the California Consumer Privacy Act (CCPA). Regardless of where you live, DealCaddie lets you:
- Access your data — email support@dealcaddie.ai and we will provide a copy.
- Delete your account and associated data — email support or use any in-app delete option.
- Opt out of marketing — every marketing email includes an unsubscribe link, or email support.
- California users (CCPA): you have the right to know what personal information we have about you, to have it deleted, and to opt out of the sale of personal information. We do not sell personal information.
11. Children's Privacy
DealCaddie is not directed to children under 18 and we do not knowingly collect personal information from anyone under 18. If we learn that a minor has provided us personal information, we will delete it as promptly as possible.
12. Security
We use industry-standard safeguards including HTTPS everywhere, bcrypt / PBKDF2 password hashing, encrypted database connections, and least-privilege access controls. No system is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your information, we will notify you as required by applicable law.
13. International Users
DealCaddie is operated from the United States. Your data will be processed in the U.S. and in any country where our service providers operate. If you are accessing the service from outside the U.S., you consent to this transfer by using the service.
14. Changes
We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent on-site notice. The “Effective” date at the top of this page reflects the most recent update.
15. Client Data You Provide (Agent plan)
If you use client features, you enter personal information about other people — your clients. That information is treated differently from your own, and this section governs it.
- Your role and ours. You decide what client information to collect and why. We process it only to operate the features you use: storing client records, sharing analyses you choose to share, and delivering messages you choose to send. In data-protection terms, you are the controller of that information and we act as your processor.
- Your obligation. By entering a client's details you confirm that you have the consents and have given the notices that the law requires, including any consent required before sending that person a text message. This obligation is set out in Section 19.1 of the Terms of Service.
- What we do not do. We do not sell client data. We do not market to your clients. We do not use your client list to contact anyone on our own behalf, and we do not use it to train AI models. Client telephone numbers and messaging consent are never shared or transferred for marketing purposes by anyone.
- Client requests. If one of your clients asks us directly to access or delete their information, we will normally refer them to you, because it is your record and you hold the relationship. We will assist you in responding, and we will act ourselves where the law requires us to.
- Deletion. Deleting a client record removes it and its associated shortlists and messages from your account. Backups are purged on the schedule in Section 9. Anything you already sent to that client — an email, a text, a shared link they opened — is outside our control once delivered.
- Shared links. A shared analysis link is accessible to anyone who has it, without signing in. We record that a link was viewed; we do not identify the viewer. Revoking a link stops future access and cannot recall what was already seen.
16. Contact
Privacy questions? Email support@dealcaddie.ai.
Last updated: June 27, 2026 · support@dealcaddie.ai · Terms of Service