DealFlow OS — Real Estate Wholesaling Platform

DealFlow OS ("we", "us", "our") respects your privacy. This policy explains what we collect, how we use it, who we share it with, and the rights you have. By using DealFlow OS you consent to the practices described below.

1. Information We Collect

You give us directly

Account details: name, email, password (stored as a bcrypt hash).
Billing details: Stripe handles payment information; we never store full card numbers.
Lead & buyer data: addresses, phone numbers, emails, and notes you create or import.
Contract & deal metadata: offer prices, closing dates, assignment fees, uploaded documents.
Support messages, feedback, replies to our emails.

Collected automatically

Device & usage: IP address, browser, OS, pages visited, actions taken.
Email engagement: delivery, opens, clicks, bounces (via Resend webhooks).
SMS engagement: delivery, replies (via Twilio).
Cookies & local storage for session, preferences, and anti-abuse rate limiting.

From third parties

Stripe: subscription status.
DocuSign: envelope signing events via webhook.

2. How We Use Information

Provide, operate, secure, and improve the Service.
Score lead motivation and match buyers to deals (AI, via Anthropic Claude).
Send transactional email (receipts, reset links, broadcasts you authorize).
Send SMS you explicitly initiate from within DealFlow (Twilio).
Prevent fraud, abuse, and comply with legal obligations.
With your opt-in, display your performance stats on the public DealFlow Index.

3. Who We Share Data With

We share data only with vetted service providers under confidentiality obligations:

Hosting & database: Emergent / MongoDB
Payments: Stripe (PCI-compliant)
Email: Resend
SMS: Twilio
E-signature: DocuSign
AI: Anthropic (Claude), via Emergent LLM gateway. Prompts contain the minimum data needed and are not used to train models.

We may disclose data if legally required (subpoena, court order) or to protect our rights or users' safety. We do not sell personal data.

4. Data Retention

We retain your data while your account is active. After account deletion, we remove your personal data within 30 days unless law requires longer retention (e.g., tax or AML records). Backups are purged on a rolling 90-day cycle.

5. Security

We use industry-standard safeguards: HTTPS everywhere, bcrypt password hashing, JWT auth with short expiry, rate limiting, and database access controls. No system is 100% secure; please use a strong unique password and enable device-level protection.

6. Your Rights

Depending on your jurisdiction (GDPR, CCPA, etc.), you may have the right to:

Access, correct, or delete your personal data.
Export your data in a portable format (CSV).
Object to or restrict certain processing.
Withdraw consent to marketing emails (unsubscribe link in every email).
Lodge a complaint with your local data-protection authority.

To exercise these rights, use the "Delete Account" button in Settings or email contact@dealflowos.app.

7. Children

DealFlow is intended for business users 18+ and is not directed to children under 13. We do not knowingly collect data from children.

8. International Transfers

We operate from and store data in the United States. If you access the Service from outside the US, your data may be transferred to and processed in the US under appropriate safeguards.

9. Mobile App Permissions

Our iOS and Android apps may request the following permissions, each of which is optional:

Notifications: deal alerts, reservation timers, contract updates.
Camera: capture property photos for leads.
Face/Touch ID: biometric sign-in (processed locally; never transmitted).
Contacts: optional buyer-import; data stays in your DealFlow workspace.

10. Changes

We'll notify you of material changes to this policy by email or in-app notice. The "Last updated" date at the bottom of this page shows the current revision.

11. Contact

Questions or data requests: contact@dealflowos.app.

Privacy Policy.