Privacy Policy & Data Handling
Last updated: October 2026
1. What We Collect
We collect account information you provide (name, email, organization), the documents you upload for analysis (Offering Memoranda, T-12 statements, rent rolls, and institutional PPM documents), and basic usage data (login activity, feature usage, and processing timestamps) needed to operate and support the Service. We also use a strictly necessary session cookie to keep you signed in; it identifies your session only and is not used for advertising or tracking across other sites.
2. Source Documents: Processing and Deletion
Uploaded source documents are used only to extract the financial data you request. They are staged temporarily on our servers while that extraction runs, and are automatically and permanently deleted once extraction completes — this happens as part of the processing pipeline itself, before the resulting Excel export is even generated, since the source file is no longer needed at that point. A scheduled cleanup process also removes any file older than one hour as a backstop, in the rare case a process is interrupted before completing its own cleanup step. Source documents are not retained, archived, or reused beyond the single analysis you requested.
3. Extracted Data: What Persists
Unlike the source documents themselves, the financial metrics extracted from them (property figures, deal terms, and similar data points) are saved to your account's analysis history so you can review past work, compare analyses, and re-download exports without re-uploading files. This data persists until you delete the record yourself or your account is closed. Rent roll data is additionally held in a short-lived server-side cache (expiring automatically after 30 minutes) solely to let a "Download Excel" action reuse a just-completed analysis without re-processing — it is not retained beyond that window.
4. Third-Party AI Processing
Extracting data from your documents requires sending the relevant document text to a third-party large language model provider (such as OpenAI or Anthropic, depending on configuration). That provider processes the content solely to return the extraction result to us, under its own published API data-handling terms. We do not control those third parties' infrastructure directly, and recommend reviewing their current data usage policies if this is relevant to your own compliance review.
5. Security Measures
All traffic to and from the Service is encrypted in transit using TLS. Access to uploaded documents and extracted data is restricted to authenticated users and scoped strictly to their own organization — one organization's data is never accessible to another's, enforced at the application layer on every request. For a fuller description of our security practices, see our Security Overview.
6. Your Rights
You may request a copy of the personal data and analysis history associated with your account, or request that it be deleted ("data erasure"), by contacting us at privacy@inboundunderwriting.com. We will act on verified requests within a reasonable time.
7. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email.
8. Contact
Questions about this policy or your data can be sent to privacy@inboundunderwriting.com.