Privacy Policy
This Privacy Policy explains how CasaCrow Inc. (“CasaCrow,” “we,” “us,” or “our”) collects, uses, discloses, and protects information about you when you use the CasaCrow website and application (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by CasaCrow Inc., located at 120 Marketplace Circle, Ste C, PMB 306, Georgetown, KY 40324. For any privacy question or request, contact us at privacy@casacrow.com.
2. Information we collect
2.1 Information you provide
- Account information: your email address (CasaCrow uses passwordless “magic link” sign-in, so we do not collect or store passwords). Optionally, your name and phone number, which you can add or change anytime in Account settings.
- Mortgage and financial inputs: details you enter such as loan amount, interest rate, term, start date, purchase price, down payment, property taxes, insurance, PMI, HOA dues, current home value, and extra payments.
- Property details: optional information about your home, such as its address, city, state, ZIP, county, property type, occupancy, and your loan servicer. We use these to power local estimates and to complete the PMI-cancellation and property-tax-appeal letters you generate.
- Documents: files you choose to upload to your document vault (e.g., mortgage or insurance documents).
- Communications: messages you send us and any support communications.
- Marketing preferences: whether you opt in to non-essential product and money-saving emails (separate from transactional and alert emails). You can change this anytime.
- Notifications: if you turn on push notifications on a device, the address your browser gives us for delivering them to that device.
- A second email for alerts: if you add one, that person’s email address and whether they have confirmed it.
2.2 Information collected automatically
- Usage and device data: log data, IP address, browser/device type, and pages or features accessed, used to operate, secure, and improve the Service.
- Security check: when it is switched on, the forms that send a sign-in code carry a check from our security-check provider. It reads your IP address, details of your browser and device, and which website you are on. It is there to tell a person from an automated script. It runs whether or not your browser sends a Global Privacy Control or Do Not Track signal. See Sections 4 and 6.
- Referral and attribution data: a coarse record of how you found us — an optional “how did you hear about us” response and first-touch marketing attribution (such as campaign parameters in the link you arrived from, and the referring website’s domain). This contains no third-party advertising identifier or cross-site tracking cookie. This record is not saved to your device while you are only browsing: it is written to your browser’s local storage at the point you begin creating an account, and if you leave before then it is discarded. We do not collect it at all if your browser sends a Global Privacy Control or Do Not Track signal.
- Cookies and similar technologies: we use strictly necessary cookies to keep you signed in and to secure your session. The security check may also store its own cookies or similar data. See Section 6.
2.3 Payment information
Subscription payments are processed by Stripe. We do not collect or store your full card number. We receive limited billing details from Stripe (such as subscription status, plan, billing dates, and the last four digits/brand of your card) to manage your subscription. When you pay, Stripe also collects your billing address, which is used to work out sales tax, and we receive it from Stripe with those details. Stripe’s handling of your payment data is governed by Stripe’s Privacy Policy.
3. How we use information
- To provide, maintain, and secure the Service and your account.
- To perform the mortgage calculations, projections, and alerts you request.
- To process subscriptions, trials, billing, and related notices.
- To send transactional emails (sign-in links, billing notices, alerts you enable).
- To detect, prevent, and respond to fraud, abuse, and security incidents.
- To comply with legal obligations and enforce our Terms of Service.
Where required by law, our legal bases for processing are: performance of a contract (providing the Service), your consent (optional alerts), our legitimate interests (securing and improving the Service), and compliance with legal obligations.
4. How we share information
We do not sell your personal information and do not share it for cross-context behavioral advertising. We share it with the kinds of companies below, which work for us to run CasaCrow, and give each one only what it needs:
| Who | What they do for us | Information involved |
|---|---|---|
| Hosting and infrastructure providers | Run the CasaCrow website and app, our database, sign-in, and storage for files you upload | Everything you give us or the Service generates: account details, mortgage and property information, documents you upload, and usage, log and device data such as IP address |
| Our payment processor, Stripe | Takes payments and manages subscriptions and Kit purchases | Your email address, billing address, card details (which go to Stripe, not to us), and your plan and billing history |
| Email providers | Send the emails you get from us, and receive and forward the emails you send us | Your email address and the content of the messages |
| Push notification services run by your browser or device maker (for example Apple, Google or Mozilla) | Deliver notifications to a device where you turned them on | An address for that device, and the notification, which is encrypted so the service cannot read it |
| Security-check providers | Check whether a request for a sign-in code comes from a person or an automated script | Your IP address; details of your browser and device, such as the browser’s type and how it behaves during the check; how you answer the check if it asks you to tick a box; and the website it runs on. The check reads them when a form that sends a sign-in code is shown. The provider also uses them to get better at spotting automated scripts. |
| Providers of AI tools our team uses | Help us build, maintain and support CasaCrow | Account, mortgage and document information, when we work on the service or look into a problem |
People you choose. If you add a second email address for alerts (for example, a spouse or co-borrower), then while you have Pro we email that person the alerts and reminders about your loan and your home that are switched on in your settings: PMI, payoff milestones, refinancing, property taxes, home insurance, signing up for your county’s property fraud alerts, and home upkeep. They still get them if you unsubscribe your own address from our emails. Those emails can include figures from your account, such as your loan balance, your interest rate or your insurance premium. You can remove it at any time.
These are the only kinds of companies we share your personal information with, apart from the people you choose above and the disclosures described below.
Reading your documents. When you upload a closing disclosure or mortgage statement while setting up your account, we read the loan figures from it with open-source software that runs inside the CasaCrow app, on our hosting provider’s servers. Reading it does not involve sending it to any outside artificial-intelligence or text-recognition service. (Our team’s AI tools, above, may see it if we are looking into a problem with it.) Documents you add to your vault later are stored for you; we do not extract anything from them.
We also read public data from outside — national mortgage-rate averages published by the Federal Reserve’s FRED service, which is what the refinance tracker compares your rate against. That is information coming in, not information about you going out: nothing identifying you is sent when we fetch it, which is why it is not in the table above.
We may also disclose information: (a) to comply with law, legal process, or lawful government requests; (b) to protect the rights, property, or safety of CasaCrow, our users, or the public; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you of any change in control or use of your personal information.
5. Data retention
We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a commercially reasonable period, except where retention is required for legal, accounting, fraud-prevention, or dispute-resolution purposes. Any copy of your information that remains in routine infrastructure backups after deletion is not used to provide the Service and is overwritten on a rolling basis.
If we close your account. If we close your account, as our Terms of Service allow, we keep your information for 30 days after it closes so that you can ask us for a copy, and longer if you have asked and we have not yet sent it. You can ask us to delete it sooner. We then delete or de-identify it as described above, with the same exceptions.
If you used a free trial or the founding rate. When you delete your account, we keep a coded form of your email address (a one-way hash, not the address itself), with a note of whether it had a free trial or the founding rate. It is how we limit each address to one trial and one founding rate. That record holds nothing else about the account except the date it was deleted.
Documents uploaded during setup. If you upload a closing disclosure or mortgage statement while setting up your account, we read the loan details from it to fill in your figures and we store the file itself in your document vault. The vault is a Pro feature: if you do not start a paid or trial subscription, the uploaded file is kept for 30 days and then permanently deleted. Subscribing keeps the file available in your vault for the life of your account. You can delete any uploaded document yourself at any time.
6. Cookies and local storage
CasaCrow uses strictly necessary cookies to authenticate you and protect your session. We do not use third-party advertising cookies, and we do not use any third-party analytics service. Because these cookies are essential to operate the Service, disabling them may prevent you from signing in. The security check’s own cookies are described below.
Browsing CasaCrow while signed out does not store anything on your device for marketing or analytics purposes. Our page-view counters are aggregate: they record that a page was viewed, and never create a visitor identifier, cookie, or fingerprint. The security check below is different. It reads details of your browser and device to tell a person from a script. The one non-essential item we store — first-touch attribution, described in Section 2.2 — is written only when you begin creating an account, and never if your browser sends a Global Privacy Control or Do Not Track signal.
Fonts and other page assets are served by CasaCrow through our hosting provider; we do not load them from font services, ad networks or other outside sites, except for the security check below. When you are signed in, your browser also connects directly to our database and file-storage provider to load your information and upload files. If you turn on push notifications, your browser registers with its own push service (for example Apple’s or Google’s).
The security check. When the security check is switched on, it appears on the forms that send a sign-in code: the sign-in page, the “Log in” window in the site header, the first step of creating an account, and “Send a new code”. Your browser loads the check straight from our security-check provider when one of those forms is shown, even if you never send the form. The check reads your IP address, details of your browser and device, and which website you are on, to tell a person from an automated script. When you pass the check, it gives the form a one-time pass, which is sent with your request for a code. To confirm the pass, we, or the company that runs our sign-in, send it back to the security-check provider. When we send it, your IP address goes with it. We do not give the check your email address or anything else you type. To run the check, the provider may store cookies or similar data in your browser. The provider runs the same check on many other websites, so it may also get these details from your browser when you use those sites. The provider shows us statistics about the checks, including the countries, browsers and IP addresses they came from. We use them only to keep the check and sign-in working. When we have the check switched off, your browser does not load it and nothing goes to the provider.
7. Security
We use technical and organizational safeguards designed to protect your information, including encryption in transit (TLS) and at rest, row-level access controls that isolate each user’s data, scoped access keys, rate limiting, and signed webhooks. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping access to your email account secure, since sign-in links are delivered there.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise several of these directly in the app: editing your data, changing your email address, and deleting your account. To request a copy of your personal information, or to exercise any other right, email privacy@casacrow.com and we will respond within the timeframe required by applicable law. We will not discriminate against you for exercising these rights.
8.1 California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined under California law.
California also defines a category called sensitive personal information — things like a Social Security or government ID number, an account log-in and password, precise geolocation, and biometric, health, or genetic data. We do not collect any of it. Sign-in is passwordless, so there is no password to hold; we never ask for a Social Security number; and the coarse city-level location we derive from an IP address to flag a sign-in from a new device is not precise geolocation. Because we collect none, the right to limit its use and disclosure does not arise. Your mortgage figures are personal and we treat them carefully, but they are not in that statutory category.
8.2 Users outside the United States
CasaCrow is offered only to residents of the United States, for property located in the United States. We do not offer, market, or sell the Service in the European Economic Area, the United Kingdom, or any other country, and we do not target or monitor individuals outside the United States. Our pricing is in U.S. dollars, our content is in English, and the Service works only with United States mortgages. See our Terms of Service for the full eligibility requirement.
As a matter of policy, we will honor a reasonable request to access or delete personal information from anyone who has an account with us, wherever they are. Email privacy@casacrow.com.
8.3 Other U.S. state privacy rights
Several states besides California have comprehensive privacy laws — among them Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, with more taking effect over time. CasaCrow is offered in all fifty states, so if you live in one of them you generally have the right to confirm whether we process your personal information and to get a copy of it, to correct it, to delete it, to receive it in a portable form, and to opt out of targeted advertising, the sale of personal information, and profiling that produces legal or similarly significant effects.
We do none of those last three things. We do not sell personal information, we do not share it for targeted advertising, and we do not profile you in a way that produces legal or similarly significant effects. Those opt-outs are already the state of the world here, so there is nothing for you to switch off.
To exercise any of these rights, email privacy@casacrow.com. You can also do several of them yourself in the app at any time: edit your figures, change your email address, or delete your account. We respond within the time the applicable law allows, and we will not treat you differently for asking.
Authorized agents. You may use an authorized agent to make a request for you. We will ask for proof that you gave them permission, and we may still ask you to verify your own identity with us directly.
If we say no, you can appeal. If we decline a request we will tell you why. You can appeal by replying to that response, or by emailing privacy@casacrow.com with the word “appeal”. Someone other than the person who made the first decision reviews it, and we will write back with the outcome and our reasoning within the time the applicable law allows. If we turn the appeal down, we will tell you how to raise it with your state attorney general.
9. Children’s privacy
The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
10. Where your information is processed
We operate the Service in the United States and process your information there. Our security-check provider is an exception. It may run its check in another country, and keep what it reads there. The Service is intended for United States residents only (Section 8.2). The Service may nonetheless be reachable from outside the United States; if you load a page from elsewhere, you do so on your own initiative, and you understand that any information collected is processed in the United States and in other countries where our service providers operate.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new version number, a version date and an effective date. An update takes effect on its effective date, which is the day we post it or a later date we choose. An update takes effect at 00:00 UTC on its effective date, which is the evening before in U.S. time zones. We keep every earlier version, and we will send you a copy of any of them if you ask at legal@casacrow.com. Each time you sign in you are asked to agree to the Privacy Policy then posted, and we record which version that was; your continued use of the Service on or after an update’s effective date also constitutes acceptance of the revised policy, and we record that too.
Two kinds of change get more than a posting. If a change would let us use information we already hold for a new purpose that is not compatible with the one we collected it for, or would take away a right this policy gives you, we will email you about it no later than the day it takes effect, and we will ask for your agreement where the law requires it. We will not use information we collected before a change in a materially different way from what this policy said when we collected it, unless you agree.
Our service providers can change. Section 4 describes the kinds of companies we share information with rather than each company by name. We may add, replace or stop using a company within one of those kinds — a different email provider, a different hosting region — without changing this policy, because what we collect, why, and what you can ask us to do with it stay the same. If we begin sharing personal information with a new kind of company, we will update Section 4 before we do.
12. Contact us
Questions or requests? Email privacy@casacrow.com or write to CasaCrow Inc., 120 Marketplace Circle, Ste C, PMB 306, Georgetown, KY 40324.