Privacy Policy.
What we collect, why we have it, which vendors see it, and what you can ask us to do about it.
This policy explains what Verstavo Technologies LLC collects, why, who else sees it, and what you can ask us to do about it. It covers our websites and the Verstavo CRE Intelligence Platform (the “Service”). It forms part of our Terms of Service.
Two things up front, because they are the questions people actually have. We do not sell your personal information for money, and we do not use your loan tape to train anything. The detail is below, including the one place where an advertising tag on our marketing pages may count as “sharing” under California law.
1. What We Collect
Account information — your name, email address, a hash of your password (never the password itself), your role and organization membership, and, if you enable it, multi-factor authentication settings.
Billing information — your plan, subscription status, and the identifiers our payment processor gives us. Card numbers are handled entirely by Stripe and never reach our servers.
Your Content — the loan tapes, portfolios, assumptions and notes you put into the Service. Ownership and our use of these are governed by §9 of the Terms. In privacy terms: we process them only to run the Service for you.
Support correspondence — the subject and content of tickets you open, and our replies.
Technical and usage information — your IP address, browser and device details, pages and features used, and timestamps. We use these to operate the Service, to rate-limit and detect abuse, and to understand what is used.
How you found us — when a visit to our public pages begins, we record that it happened: the page you landed on, the campaign parameters in the link you followed, and the name of the site that sent you. That record carries no cookie, no IP address and nothing that identifies you or your device; it is a count of arrivals. Separately, the first campaign parameters you arrived with are stored in your own browser and attached to your account only if you choose to sign up.
2. Cookies & Similar Technologies
A session cookie, which is strictly necessary — it is what keeps you signed in. It is HttpOnly, SameSite=Lax, sent only over HTTPS, and expires after 12 hours of inactivity. You cannot use the application without it.
Local browser storage for the first-touch campaign value described above, and a marker that lasts until you close the tab so a visit is counted once. Both are first-party, neither is a cookie, and nothing reads them but our own pages.
The LinkedIn Insight Tag, on our public marketing pages only. It is not present inside the application. See §7.
3. Why We Use It
- to provide the Service, authenticate you, and compute the analytics you ask for;
- to take payment and manage your subscription;
- to answer your support requests;
- to remember what you have opened — the loans, trusts, banks, filings and metros — so the Service can show you your recent items and, in time, what has changed in them; this list is yours: it is shown to you, and you can clear it at any time;
- to keep the Service secure — rate limiting, abuse detection, and investigating incidents;
- to send you service messages (billing, security, account and ticket notifications) and, if you have asked for them, market updates you can unsubscribe from;
- to improve the Service, and to measure which marketing works.
Where the GDPR or UK GDPR applies, we rely on contract (providing the Service you signed up for), legitimate interests (security, abuse prevention, understanding usage, marketing measurement), consent where we ask for it, and legal obligation where we must keep records.
4. Who Else Sees It
We use a small number of vendors to run the Service. Each receives only what it needs, and each is bound to protect it.
- Render — application hosting and the database (United States).
- Cloudflare — DNS, edge delivery and protection. Sees request metadata including your IP.
- Stripe — payments. Receives your billing details directly; we receive identifiers and status back.
- SendLayer — transactional email. Receives your address and the content of the message we send you.
- Telegram — alerts our support operator when you open a ticket or reply. It receives only the ticket number, the category, and the subject line you typed. It does not receive your name, your email address, your organization, or the body of your message.
- Anthropic — the language model behind our market commentary and in-app research features. It receives our own published market data and the question you type into those features. It never receives your portfolio, your loan tape, or any part of Your Content, which is why the portfolio read-outs are computed rather than generated.
- LinkedIn — advertising measurement on our public marketing pages only. See §7.
- YouTube (Google) — plays our walkthrough videos on the Tour page. Nothing loads from YouTube until you press play on a video; from then on, YouTube's own privacy policy covers what its player collects.
We may also disclose information if the law requires it, to enforce our Terms, to protect rights and safety, or to a successor in a merger or sale of assets — in which case this policy continues to apply until you are told otherwise.
5. What We Do Not Do
- We do not sell your personal information for money.
- We do not use Your Content to train machine-learning models — ours or anyone else’s.
- We do not send Your Content to a language model.
- We do not show your book to another customer, and no other organization can reach it.
6. Security
Traffic is encrypted in transit; data is encrypted at rest by our hosting provider. Passwords are stored as salted hashes. Multi-factor authentication is available and we recommend it. Access to production data is limited to those who need it to operate and support the Service. What we hold and how it is protected is set out in more detail on our security page. No system is perfectly secure, and we do not claim otherwise; if a breach affects you we will notify you as the law requires.
7. Advertising — and the One Honest Caveat
Our public marketing pages carry the LinkedIn Insight Tag so we can measure whether our advertising works. It is not present inside the application, so it never observes your use of the product itself.
We receive no money for this. But under the California Consumer Privacy Act as amended, this kind of advertising tag may nonetheless count as “sharing” personal information for cross-context behavioral advertising, and we would rather say so than claim a blanket “we never share”. You can prevent it by browsing our marketing pages with tracking protection or an ad blocker enabled, by opting out through LinkedIn’s own opt-out, or by sending a request under §9. Opting out changes nothing about your account or your access.
8. How Long We Keep It
We keep account and content data for as long as your account is open. When you close your account we delete your content and personal information from our live systems. Deletion is not instantaneous: residual copies persist in encrypted backups for a limited period before being overwritten. We keep billing and tax records for as long as the law requires, and support correspondence for a reasonable period afterwards. Usage records — which pages and features an account used, and when — are kept for 13 months and then reduced to monthly counts that identify no one; when you close your account, the records that remain are detached from you at once.
9. Your Rights
Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to delete it, to limit how we use it, to opt out of “sharing” as described in §7, and not to be discriminated against for exercising any of these.
Ask us at support@verstavo.com and we will respond within the time the applicable law allows. We will need to verify who you are before acting on a request — usually by confirming control of the account email. An authorized agent may act for you with proof of authorization.
If you are in the EEA or UK you may also complain to your supervisory authority. We would rather you told us first.
10. Where Data Is Held
The Service is hosted in the United States, and our vendors are mostly US based. If you use the Service from outside the US, you are sending your information to the US, where privacy law differs from your own.
11. Children
The Service is a business product and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.
12. Changes
We will update this policy as the Service changes. The version, effective date and date of the last change are at the top. If a change is material we will tell you — by email, in the application, or by asking you to accept an updated Terms of Service.