Privacy Policy
This Privacy Policy explains how [LEGAL ENTITY NAME] (“CasaCrow,” “we,” “us,” or “our”) collects, uses, discloses, and protects information about you when you use the CasaCrow website and application (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by [LEGAL ENTITY NAME], located at [BUSINESS ADDRESS]. For any privacy question or request, contact us at privacy@casacrow.com.
2. Information we collect
2.1 Information you provide
- Account information: your email address (CasaCrow uses passwordless “magic link” sign-in, so we do not collect or store passwords). Optionally, your name and phone number, which you can add or change anytime in Account settings.
- Mortgage and financial inputs: details you enter such as loan amount, interest rate, term, start date, purchase price, down payment, property taxes, insurance, PMI, HOA dues, current home value, and extra payments.
- Property details: optional information about your home, such as its address, city, state, ZIP, county, property type, occupancy, and your loan servicer. We use these to power local estimates and to complete the PMI-cancellation and property-tax-appeal letters you generate.
- Documents: files you choose to upload to your document vault (e.g., mortgage or insurance documents).
- Communications: messages you send us and any support communications.
- Marketing preferences: whether you opt in to non-essential product and money-saving emails (separate from transactional and alert emails). You can change this anytime.
2.2 Information collected automatically
- Usage and device data: log data, IP address, browser/device type, and pages or features accessed, used to operate, secure, and improve the Service.
- Referral and attribution data: a coarse record of how you found us — an optional “how did you hear about us” response and first-touch marketing attribution (such as campaign parameters in the link you arrived from, and the referring website’s domain). This contains no third-party advertising identifier or cross-site tracking cookie.
- Cookies and similar technologies: we use strictly necessary cookies to keep you signed in and to secure your session. See Section 6.
2.3 Payment information
Subscription payments are processed by Stripe. We do not collect or store your full card number. We receive limited billing details from Stripe (such as subscription status, plan, billing dates, and the last four digits/brand of your card) to manage your subscription. Stripe’s handling of your payment data is governed by Stripe’s Privacy Policy.
3. How we use information
- To provide, maintain, and secure the Service and your account.
- To perform the mortgage calculations, projections, and alerts you request.
- To process subscriptions, trials, billing, and related notices.
- To send transactional emails (sign-in links, billing notices, alerts you enable).
- To detect, prevent, and respond to fraud, abuse, and security incidents.
- To comply with legal obligations and enforce our Terms of Service.
Where required by law, our legal bases for processing are: performance of a contract (providing the Service), your consent (optional alerts), our legitimate interests (securing and improving the Service), and compliance with legal obligations.
4. How we share information
We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only as follows:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, and file storage hosting | Account, mortgage inputs, documents |
| Stripe | Subscription payments and billing | Email, subscription & billing details |
| Resend | Sending transactional email | Email address, message content |
| Vercel | Application hosting and delivery | Usage/log and device data |
| FRED (St. Louis Fed) | Public market mortgage-rate data | None of your personal data is sent |
We may also disclose information: (a) to comply with law, legal process, or lawful government requests; (b) to protect the rights, property, or safety of CasaCrow, our users, or the public; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you of any change in control or use of your personal information.
5. Data retention
We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a commercially reasonable period, except where retention is required for legal, accounting, fraud-prevention, or dispute-resolution purposes. Backups are retained for a limited period and then overwritten on a rolling basis.
Documents uploaded during setup. If you upload a closing disclosure or mortgage statement while setting up your account, we read the loan details from it to fill in your figures and we store the file itself in your document vault. The vault is a Pro feature: if you do not start a paid or trial subscription, the uploaded file is kept for 30 days and then permanently deleted. Subscribing keeps the file available in your vault for the life of your account. You can delete any uploaded document yourself at any time.
6. Cookies
CasaCrow uses strictly necessary cookies to authenticate you and protect your session. We do not use third-party advertising or cross-site tracking cookies. Because these cookies are essential to operate the Service, disabling them may prevent you from signing in.
7. Security
We use technical and organizational safeguards designed to protect your information, including encryption in transit (TLS) and at rest, row-level access controls that isolate each user’s data, scoped access keys, rate limiting, and signed webhooks. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping access to your email account secure, since sign-in links are delivered there.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these directly in the app (editing your data, changing your email, or deleting your account), or by contacting privacy@casacrow.com. We will not discriminate against you for exercising these rights.
9.1 California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined under California law.
9.2 EEA/UK residents (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the rights described above and may lodge a complaint with your local data protection authority. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.
9. Children’s privacy
The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
10. International users
We operate the Service in the United States. If you access it from outside the U.S., you understand your information will be processed in the U.S. and other countries where our service providers operate.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (such as by email or in-app). Your continued use of the Service after an update constitutes acceptance of the revised policy.
12. Contact us
Questions or requests? Email privacy@casacrow.com or write to [LEGAL ENTITY NAME], [BUSINESS ADDRESS].