Privacy policy.

Overview

This Privacy Policy describes how Unlevered, Inc. ("Unlevered," "we," "us") collects, uses, discloses, and protects information when you use the Unlevered platform, our website, and related services (collectively, the "Service").

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

Information we collect

We collect three categories of information:

Account information

Name, work email, firm name, role, billing address. Provided directly when you sign up or update your firm profile.

Client property data

Property addresses, closing statements, rent rolls, remodel receipts, photographs, and the public records we link to those properties. Uploaded by your firm or the property owner you invite.

Operational data

Authentication events, IP addresses, browser fingerprints, audit-log entries, and Stripe payment metadata. Collected automatically as you use the Service.

How we use information

We use information to:

• Provide the Service: run cost segregation engine analyses, generate reports, route engineered review.
• Process payments via Stripe Connect.
• Communicate operationally about your account, studies, and billing.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations (tax records, audit trails, subpoenas).

We do not sell your data, your clients’ data, or any property records you upload.

Sharing and disclosure

We share data only with the subprocessors listed in our Data Processing Addendum: Supabase (database), AWS (storage), Vercel (hosting), Stripe (payments), Smarty (address validation), Google Workspace (internal email), and Sentry (anonymized error reports). All subprocessors are bound by data processing agreements no less protective than this Policy.

We may disclose data when required by law, valid legal process, or to protect the rights and safety of our users.

Your rights

Depending on jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data. To exercise any of these rights, write to privacy@unlevered.io. We respond within 30 days.

Retention

Active accounts: data retained while the account is active. Cancelled accounts: 90-day soft-delete, then full purge. Delivered studies: retained indefinitely (your clients rely on access). Audit logs: 7 years, matching IRS audit windows.

Security

Encryption at rest (AES-256) and in transit (TLS 1.3). Row-level access controls, default-deny. Audit logging on every material action. See our Security page for the full picture.

International transfers

All data lives in US-East. We do not transfer data outside the United States. If you access the Service from outside the US, your data is transferred to and processed in the US.

Changes to this policy

We’ll notify firm admins by email at least 14 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

Contact

Privacy questions: privacy@unlevered.io. Mailing address: Unlevered, Inc., San Francisco, California.