Privacy Policy
This Privacy Policy explains how CasaCrow Inc. (“CasaCrow,” “we,” “us,” or “our”) collects, uses, discloses, and protects information about you when you use the CasaCrow website and application (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by CasaCrow Inc., located at 120 Marketplace Circle, Ste C, PMB 306, Georgetown, KY 40324. For any privacy question or request, contact us at privacy@casacrow.com.
2. Information we collect
2.1 Information you provide
- Account information: your email address (CasaCrow uses passwordless “magic link” sign-in, so we do not collect or store passwords). Optionally, your name and phone number, which you can add or change anytime in Account settings.
- Mortgage and financial inputs: details you enter such as loan amount, interest rate, term, start date, purchase price, down payment, property taxes, insurance, PMI, HOA dues, current home value, and extra payments.
- Property details: optional information about your home, such as its address, city, state, ZIP, county, property type, occupancy, and your loan servicer. We use these to power local estimates and to complete the PMI-cancellation and property-tax-appeal letters you generate.
- Documents: files you choose to upload to your document vault (e.g., mortgage or insurance documents).
- Communications: messages you send us and any support communications.
- Marketing preferences: whether you opt in to non-essential product and money-saving emails (separate from transactional and alert emails). You can change this anytime.
2.2 Information collected automatically
- Usage and device data: log data, IP address, browser/device type, and pages or features accessed, used to operate, secure, and improve the Service.
- Referral and attribution data: a coarse record of how you found us — an optional “how did you hear about us” response and first-touch marketing attribution (such as campaign parameters in the link you arrived from, and the referring website’s domain). This contains no third-party advertising identifier or cross-site tracking cookie. Nothing is saved to your device while you are only browsing: this record is written to your browser’s local storage at the point you begin creating an account, and if you leave before then it is discarded. We do not collect it at all if your browser sends a Global Privacy Control or Do Not Track signal.
- Cookies and similar technologies: we use strictly necessary cookies to keep you signed in and to secure your session. See Section 6.
2.3 Payment information
Subscription payments are processed by Stripe. We do not collect or store your full card number. We receive limited billing details from Stripe (such as subscription status, plan, billing dates, and the last four digits/brand of your card) to manage your subscription. Stripe’s handling of your payment data is governed by Stripe’s Privacy Policy.
3. How we use information
- To provide, maintain, and secure the Service and your account.
- To perform the mortgage calculations, projections, and alerts you request.
- To process subscriptions, trials, billing, and related notices.
- To send transactional emails (sign-in links, billing notices, alerts you enable).
- To detect, prevent, and respond to fraud, abuse, and security incidents.
- To comply with legal obligations and enforce our Terms of Service.
Where required by law, our legal bases for processing are: performance of a contract (providing the Service), your consent (optional alerts), our legitimate interests (securing and improving the Service), and compliance with legal obligations.
4. How we share information
We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only as follows:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, and file storage hosting | Account, mortgage inputs, documents |
| Stripe | Subscription payments and billing | Email, subscription & billing details |
| Resend | Sending transactional email | Email address, message content |
| Vercel | Application hosting and delivery | Usage/log and device data |
| Anthropic | Powering the AI assistant, when you use it | Your question, a summary of your mortgage figures, and your document names — never the documents themselves |
| FRED (St. Louis Fed) | Public market mortgage-rate data | None of your personal data is sent |
The AI assistant row applies only when you use that feature. It sends your question, a short summary of your mortgage figures, and the names of your documents so the assistant can answer about them. Your uploaded files are never sent — they stay in your vault.
We may also disclose information: (a) to comply with law, legal process, or lawful government requests; (b) to protect the rights, property, or safety of CasaCrow, our users, or the public; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you of any change in control or use of your personal information.
5. Data retention
We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a commercially reasonable period, except where retention is required for legal, accounting, fraud-prevention, or dispute-resolution purposes. Any copy of your information that remains in routine infrastructure backups after deletion is not used to provide the Service and is overwritten on a rolling basis.
Documents uploaded during setup. If you upload a closing disclosure or mortgage statement while setting up your account, we read the loan details from it to fill in your figures and we store the file itself in your document vault. The vault is a Pro feature: if you do not start a paid or trial subscription, the uploaded file is kept for 30 days and then permanently deleted. Subscribing keeps the file available in your vault for the life of your account. You can delete any uploaded document yourself at any time.
6. Cookies and local storage
CasaCrow uses strictly necessary cookies to authenticate you and protect your session. We do not use third-party advertising or cross-site tracking cookies, and we do not use any third-party analytics service. Because these cookies are essential to operate the Service, disabling them may prevent you from signing in.
Browsing CasaCrow while signed out does not store anything on your device for marketing or analytics purposes. Our page-view counters are aggregate: they record that a page was viewed, and never create a visitor identifier, cookie, or fingerprint. The one non-essential item we store — first-touch attribution, described in Section 2.2 — is written only when you begin creating an account, and never if your browser sends a Global Privacy Control or Do Not Track signal.
Fonts and all other page assets are served from CasaCrow’s own servers. Loading a CasaCrow page does not cause your browser to contact any third party.
7. Security
We use technical and organizational safeguards designed to protect your information, including encryption in transit (TLS) and at rest, row-level access controls that isolate each user’s data, scoped access keys, rate limiting, and signed webhooks. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping access to your email account secure, since sign-in links are delivered there.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise several of these directly in the app: editing your data, changing your email address, and deleting your account. To request a copy of your personal information, or to exercise any other right, email privacy@casacrow.com and we will respond within the timeframe required by applicable law. We will not discriminate against you for exercising these rights.
8.1 California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined under California law.
8.2 Users outside the United States
CasaCrow is offered only to residents of the United States, for property located in the United States. We do not offer, market, or sell the Service in the European Economic Area, the United Kingdom, or any other country, and we do not target or monitor individuals outside the United States. Our pricing is in U.S. dollars, our content is in English, and the Service works only with United States mortgages. See our Terms of Service for the full eligibility requirement.
As a matter of policy, we will honor a reasonable request to access or delete personal information from anyone who has an account with us, wherever they are. Email privacy@casacrow.com.
9. Children’s privacy
The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
10. Where your information is processed
We operate the Service in the United States and process your information there. The Service is intended for United States residents only (Section 8.2). The Service may nonetheless be reachable from outside the United States; if you load a page from elsewhere, you do so on your own initiative, and you understand that any information collected is processed in the United States and in other countries where our service providers operate.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date. Where the law requires us to give you additional notice of a change, or to obtain your consent before it takes effect, we will do so. We may also choose to tell you about other changes, though we are not obliged to. Each time you sign in you are asked to agree to the Privacy Policy then in force, and we record which version that was; your continued use of the Service after an update also constitutes acceptance of the revised policy.
12. Contact us
Questions or requests? Email privacy@casacrow.com or write to CasaCrow Inc., 120 Marketplace Circle, Ste C, PMB 306, Georgetown, KY 40324.