Privacy Policy

This Privacy Policy describes how Accomplice Real Estate, LLC, a Texas limited liability company doing business as AccompliceRE (“Company,” “we,” “us,” “our”), collects, uses, shares, and protects personal information when you access or use accomplicere.com, analytics.accomplicere.com, and any related services (collectively, the “Platform”).

By creating an account or using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Platform.

1. Information We Collect

1.1 Account Information

When you create an account, you may sign up using Google OAuth, Microsoft OAuth, or email and password. If you use Google or Microsoft OAuth, we receive your name, email address, and profile photo from the identity provider. We do not store or have access to your OAuth provider account password. This information is used to create and manage your account and to communicate with you about your subscription.

1.2 Uploaded Documents

You may upload lease proposals, letters of intent, amendments, and related commercial real estate documents to the Platform for AI analysis. Uploaded documents are:

• Stored temporarily in Supabase Storage in a private, user-scoped folder during the extraction process;
• Transmitted to the Anthropic Claude API for AI extraction under commercial API terms that prohibit Anthropic from using API content for model training;
• Permanently and immediately deleted from our storage infrastructure upon completion of extraction — no copy of any uploaded document is retained anywhere in AccompliceRE's infrastructure after extraction completes;
• Never shared with other users or third parties except as necessary for extraction processing.

1.3 Extracted Data

The structured financial terms extracted from your documents (such as base rent, lease term, TI allowances, operating expenses, and similar fields) are stored in our database. This data is:

• Encrypted at the application layer using AES-256-GCM with a per-user encryption key managed by AWS Key Management Service (KMS);
• Additionally encrypted at rest by Supabase at the infrastructure layer independently;
• Associated exclusively with your account and inaccessible to other users via Row Level Security enforced at the database level.

1.4 Payment Information

Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. AccompliceRE never receives or stores your credit card number, CVV, or raw payment card data. We retain records of subscription status, plan type, and transaction history for billing and legal compliance purposes.

1.5 Usage Data

We collect limited usage data to operate and improve the Platform, including pages visited and features used, browser type and operating system, approximate geographic region, and error logs and performance data. This data is aggregated and does not identify individual users in our analytics systems.

1.6 Communications

If you contact us by email or through any support channel, we retain those communications to respond to your inquiry and for quality assurance purposes. We may also send direct business communications to commercial real estate professionals regarding our services. These communications may include tracking technologies described in Section 7.6.

1.7 Business Development Contact Data

In connection with our business development activities, we may collect and process contact information of commercial real estate professionals, including name, email address, company name, job title, city, state, phone number, and timezone. This data is collected from publicly available sources, professional directories, industry events, and direct business interactions. This information is used solely for direct business-to-business outreach and is managed by Company personnel with administrative access. The Company does not collect or process sensitive personal data (as defined under GDPR Article 9 or equivalent provisions of applicable data protection laws) in connection with its business development activities, including racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or biometric data.

1.8 Marketing Website Analytics (Google Analytics 4)

On our public marketing website (www.accomplicere.com), and only after you affirmatively accept analytics cookies via the cookie consent banner, we use Google Analytics 4 (“GA4”), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, and, where you access the site from the European Economic Area, the United Kingdom, or Switzerland, by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (collectively, “Google”). Our GA4 measurement ID is G-76TVYN3ES1.

GA4 is loaded only if and after you click “Accept” on the cookie consent banner. If you reject analytics cookies, ignore the banner, or have an active Global Privacy Control (GPC) signal, no Google Analytics scripts, tags, cookies, or network requests are loaded, set, or transmitted from our site.

When GA4 is active, Google processes the following categories of data on our behalf to generate aggregated website usage reports: (a) a truncated IP address (IP-anonymization is enforced by GA4's default architecture, under which IP addresses are used only to derive coarse geolocation and are not logged or stored); (b) device and browser characteristics (user agent string, screen resolution, operating system, language); (c) page URLs, page titles, referrer URLs, and outbound link clicks; (d) engagement signals such as session duration, scroll depth, and button interactions; (e) a randomly generated client identifier stored in the “_ga” first-party cookie used to distinguish unique visitors and sessions across page loads; and (f) derived geographic information (country, region, city) inferred from the IP address. We do not transmit, configure, or enable any advertising identifier, Google Signals, cross-device tracking, Google Ads linking, or demographic / interest inference features within our GA4 property.

We do not upload any personal data about you to GA4. We do not combine GA4-collected data with data from the authenticated AccompliceRE application (analytics.accomplicere.com). We have configured GA4 with IP-anonymization, Google Signals disabled, and the shortest data retention window Google offers for event-level data (2 months). Aggregated, non-identifying reports generated by GA4 may be retained indefinitely.

Legal basis. For visitors in the EEA, UK, or Switzerland, our legal basis for processing personal data through GA4 is your freely given, specific, informed, and unambiguous consent under Article 6(1)(a) of the GDPR and the equivalent provisions of the UK GDPR, the Swiss Federal Act on Data Protection, and the ePrivacy Directive as implemented in your member state. Consent is obtained via the cookie consent banner prior to any GA4 script loading. You may withdraw consent at any time (see Section 5 and Section 7.5) with effect for the future.

For visitors in California and other U.S. states with comprehensive privacy laws, we treat analytics cookies as non-essential and load GA4 only after affirmative opt-in, which exceeds the opt-out standard required under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar state laws. We do not “sell” or “share” (as those terms are defined under CCPA/CPRA) personal information collected through GA4 for cross-context behavioral advertising, and we have disabled all GA4 advertising features.

International data transfers.GA4 data is processed on Google's infrastructure, which includes servers located in the United States. For EEA, UK, and Swiss visitors, transfers of GA4 personal data from Google Ireland Limited to Google LLC in the United States occur under: (i) the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, to which Google LLC is self-certified; and (ii) as a secondary safeguard, the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), incorporated into the Google Ads Data Processing Terms and the Google Cloud Data Processing Addendum executed between AccompliceRE and Google. Google also implements supplementary technical and organizational measures including in-transit encryption, at-rest encryption, and access logging.

Your controls.You may: (a) refuse analytics cookies on first visit using the cookie consent banner; (b) withdraw a previously given consent at any time by clicking the “Cookie Settings” link in the site footer and selecting “Reject”, which immediately deletes GA4 cookies from your browser for this site; (c) install the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout, which disables GA4 measurement across all websites and all browsers on which it is installed; (d) enable a Global Privacy Control (GPC) signal in your browser, which we honor as an automatic opt-out of analytics cookies; or (e) clear cookies through your browser's standard cookie management controls. Google's own privacy practices are governed by the Google Privacy Policy available at policies.google.com/privacy. Additional information about how GA4 collects and processes data is available at support.google.com/analytics/answer/6004245.

2. How We Use Your Information

We use your information only for the following purposes:

• Providing, operating, and improving the Platform;
• Authenticating your identity and managing your account;
• Processing subscription payments and managing your subscription;
• Processing and returning AI extraction results from uploaded documents;
• Providing customer support;
• Sending transactional emails (subscription confirmations, billing receipts, material changes to this Policy or our Terms of Service);
• Detecting and preventing fraud, abuse, and security incidents;
• Complying with applicable legal obligations;
• Enforcing our Terms of Service;
• Conducting direct business-to-business outreach to commercial real estate professionals regarding our services, including automated multi-step email campaigns managed by Company personnel.

We do not use your personal information or Customer Data for advertising, marketing profiling, or sale to third parties. We do not use your uploaded documents or extracted data to train, fine-tune, or improve any artificial intelligence or machine learning model, including AccompliceRE's own systems or any third-party AI system.

3. How We Share Your Information

We do not sell your personal information. We share information only with the following categories of service providers who process data on our behalf, each under written data protection agreements. For the complete list of subprocessors, see Exhibit A of our Data Processing Agreement.

We may also disclose information: (a) if required by applicable law, regulation, or valid legal process; (b) to protect the rights, safety, or property of AccompliceRE or others; or (c) in connection with a merger, acquisition, or sale of all or substantially all of our assets, subject to the acquirer being bound by this Privacy Policy.

4. Data Retention

We retain different categories of data for different periods:

• Uploaded source documents: Deleted immediately upon completion of AI extraction — no retention period.
• Extracted lease data: Retained for the duration of your active subscription and for 30 days following subscription termination, after which it is permanently deleted.
• Account information: Retained while your account is active and for 30 days following account deletion.
• Billing and payment records: Retained for 7 years following termination as required for financial and tax compliance.
• Usage and access logs: Retained for 12 months.
• Business development contact data: Retained for the duration of active outreach and for 12 months following the last communication, or until the recipient requests deletion, whichever is earlier.
• Email campaign engagement data: Open, click, bounce, and complaint records are retained for 12 months following campaign completion.
• Google Analytics 4 event data: Retained by Google for 2 months from collection, the shortest retention window available under GA4. Aggregated, non-identifying reports derived from GA4 may be retained by AccompliceRE indefinitely.
• Aggregated, de-identified analytics: May be retained indefinitely.

5. Your Privacy Rights

5.1 All Users

Regardless of location, you have the right to: access your account information and extracted data within the Platform; request deletion of your account; update your account information; and request an export of your extracted lease data by contacting legal@accomplicere.com.

5.2 California Residents (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information collected about them; delete personal information we have collected (subject to certain exceptions); correct inaccurate personal information; and opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. California residents also have the right to non-discrimination for exercising their privacy rights. To exercise California privacy rights, contact: legal@accomplicere.com.

5.3 Texas Residents (TDPSA)

Texas residents have the right to confirm whether AccompliceRE processes their personal data; access, correct, and delete their personal data; obtain a portable copy of their personal data; and opt out of the sale of personal data — we do not sell personal data. To appeal any decision regarding a privacy rights request, contact: legal@accomplicere.com.

5.4 EEA and UK Residents (GDPR)

The Platform is not directed to residents of the European Economic Area or United Kingdom. If you nonetheless access the Platform from within the EEA or UK, our processing of your personal data is governed by our Data Processing Agreement. You have rights to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise these rights, email legal@accomplicere.com. Where the Company processes Prospect Data (as defined in Section 1.7) relating to EEA or UK residents, the legal basis for such processing is legitimate interest under Article 6(1)(f) of the GDPR — specifically, the Company's interest in conducting direct business-to-business outreach to commercial real estate professionals. Recipients may object to this processing at any time by contacting legal@accomplicere.com or using the unsubscribe link in any email.

5.5 Outreach Recipients

If you have received a business communication from us and are not a Platform user, you may opt out of future communications by clicking the unsubscribe link included in any email, or by contacting legal@accomplicere.com. You may also request deletion of your contact information or request information about the data we hold about you by emailing legal@accomplicere.com. Deletion requests will be fulfilled within 30 days of receipt. When you opt out, your email address is permanently added to a global suppression list and will not receive further outreach from any AccompliceRE campaign. Opt-out requests are honored within 48 hours.

5.6 Other U.S. State Privacy Laws

Residents of states with applicable comprehensive privacy laws may have additional rights regarding their personal data, including rights to access, correct, delete, and opt out of certain processing activities. AccompliceRE does not sell personal data, does not engage in targeted advertising, and does not use personal data for profiling. To exercise any privacy rights available under your state's applicable law, contact legal@accomplicere.com.

6. Security

We implement the following measures to protect your information:

• AES-256-GCM application-layer encryption of all extracted data, with per-user AWS KMS encryption keys;
• Independent Supabase infrastructure-layer encryption of database contents;
• TLS 1.2+ encryption of all data in transit;
• Row Level Security at the database layer preventing cross-user data access;
• Cloudflare Turnstile on all authentication entry points;
• Supabase Auth CAPTCHA as an independent second bot prevention layer;
• Rate limiting on critical API routes including authentication, upload, and AI extraction endpoints via Upstash Redis;
• Immediate and permanent deletion of uploaded documents following extraction.

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@accomplicere.com.

7. Cookies and Tracking Technologies

7.1 Essential Cookies

The Platform uses cookies that are strictly necessary for authentication, session management, and CSRF protection (provided by Supabase Auth). These cookies cannot be disabled as they are required for the Platform to function. They do not track you across third-party websites and are not used for advertising.

7.2 Functional Cookies

When you visit the Platform through a referral link (accomplicere.com/r/<code>), we set a first-party cookie named “ref” that contains only the referrer's code. This cookie has a maximum duration of 90 days, is first-party only, and is used solely to attribute the referral when you create an account. The referral cookie is set only if you have accepted cookies via the consent banner; if you reject cookies, any existing referral cookie is immediately deleted.

A “cookie_consent” cookie with a maximum duration of one year records your acceptance or rejection of non-essential cookies. This cookie contains only the value “accepted” or “rejected” and is required to honor your stated preference across visits.

7.3 Analytics and Error Monitoring

We use two analytics services on our public marketing site at www.accomplicere.com. Vercel Analytics is a first-party, cookieless analytics service that collects aggregated, anonymized page view data without setting any identifier cookies or fingerprinting browsers; Vercel Analytics is loaded for all visitors by default and does not require consent. Google Analytics 4 is loaded only after affirmative opt-in via the cookie consent banner and is described in full in Section 1.8 of this Policy. On the authenticated application at analytics.accomplicere.com, we use Sentry for error monitoring and performance tracking. Sentry collects error reports, stack traces, and browser performance data to help us identify and resolve software defects. Sentry does not track users across third-party websites and is not used for advertising. Sentry initialization is subject to cookie consent where applicable.

The public marketing site also loads the LinkedIn Insight Tag only after affirmative opt-in via the cookie consent banner. The LinkedIn Insight Tag is provided by LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) and LinkedIn Corporation (1000 West Maude Avenue, Sunnyvale, California 94085, USA) and is used for aggregate conversion measurement and audience analytics. The Insight Tag sets cookies including “li_sugr”, “bcookie”, “bscookie”, “lidc”, and “UserMatchHistory”. For EEA, UK, and Swiss visitors, LinkedIn processes such data under its own Cookie Policy and relies on SCCs and the EU-U.S. DPF for transatlantic transfers. You may opt out of LinkedIn advertising tracking by visiting linkedin.com/psettings/guest-controls/retargeting-opt-out or by rejecting cookies in our consent banner.

7.4 Third-Party Functional Cookies

Stripe may set cookies during the checkout process to support payment security and fraud prevention. Cloudflare may set cookies in connection with bot protection (Turnstile) to distinguish legitimate users from automated traffic. These are functional cookies necessary for the operation of payment and security features and are not used for advertising or behavioral tracking.

7.5 Your Cookie Choices

On first visit to www.accomplicere.com, a cookie consent banner allows you to accept or reject non-essential cookies, including analytics and marketing cookies. Non-essential tags (Google Analytics 4 and the LinkedIn Insight Tag) are not loaded, and no associated cookies are set, unless and until you click “Accept” on the banner. Your selection is recorded in a first-party “cookie_consent” cookie with a maximum duration of one year. You may withdraw consent at any time by clicking the “Cookie Settings” link in the site footer; withdrawal takes effect immediately and causes any analytics and marketing cookies previously set on your browser for this site to be deleted. You may also manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies; however, disabling essential cookies may prevent the Platform from functioning correctly.

AccompliceRE honors Global Privacy Control (GPC) as a universal opt-out preference signal in accordance with California Civil Code § 1798.135 and California Code of Regulations title 11, section 7025, and as a universal opt-out mechanism under the Colorado Privacy Act (4 CCR 904-3, Rule 5.07), the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and the other comprehensive state privacy laws that recognize such signals. When our server or client detects a GPC signal from your browser, we automatically treat it as a rejection of non-essential cookies, block loading of Google Analytics 4 and the LinkedIn Insight Tag, and decline to “sell” or “share” personal information for cross-context behavioral advertising (although we do not engage in such selling or sharing in any event). We also honor legacy Do Not Track (DNT) browser headers in the same manner for visitors whose browsers still emit them. Because AccompliceRE does not sell personal data, share personal data for targeted advertising, or engage in cross-site behavioral tracking, no further action is required on your part beyond enabling the signal.

7.6 Email Tracking Technologies

Business outreach emails sent by the Company may contain tracking technologies, including single-pixel images (tracking pixels) that record whether and when an email is opened, and redirect links that record whether and when a link is clicked. This data is used solely to measure the effectiveness of our business communications and to manage follow-up sequences. Open and click data is associated with the recipient's email address. Recipients may prevent open tracking by disabling image loading in their email client. Recipients may opt out of all further communications by clicking the unsubscribe link included in every outreach email or by contacting legal@accomplicere.com. All outreach emails include RFC 8058-compliant List-Unsubscribe and List-Unsubscribe-Post headers, enabling one-click unsubscribe directly from supported email clients (Gmail, Yahoo Mail, Apple Mail, and others) without visiting a web page.

8. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA) or from minors under 18. If you believe a child under 13 has provided personal information to us, contact us at legal@accomplicere.com and we will delete it promptly.

9. International Data Transfers

Our primary infrastructure is located in the United States (AWS US East region). If you access the Platform from outside the United States, your information will be transferred to and processed in the United States. For transfers of personal data from the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses as the legal transfer mechanism as described in our Data Processing Agreement. Where Customer Data is transferred to PDFShift SAS (France), such transfers are made under Standard Contractual Clauses in compliance with GDPR Chapter V.

10. Third-Party Services

The Platform integrates with third-party services including Google (OAuth), Stripe (payments), and others listed in Section 3. Each third-party service operates under its own terms and privacy policy. AccompliceRE is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of third-party services you use in connection with the Platform.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email or a prominent notice within the Platform before the changes take effect. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the revised Policy. The effective date at the top of this Policy reflects the most recent revision.

12. Contact Us

For privacy-related inquiries, to exercise your privacy rights, or to report a data protection concern:

Accomplice Real Estate, LLC d/b/a AccompliceRE
Attn: Legal
720 Brazos Street, Floor 12, Austin, TX 78701
legal@accomplicere.com

For security-specific concerns: security@accomplicere.com