Privacy Policy

This Privacy Policy describes how Accomplice Real Estate, LLC, a Texas limited liability company doing business as AccompliceRE (“Company,” “we,” “us,” “our”), collects, uses, shares, and protects personal information when you access or use accomplicere.com, analytics.accomplicere.com, and any related services (collectively, the “Platform”).

By creating an account or using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Platform.

1. Information We Collect

1.1 Account Information

When you sign up using Google OAuth, we receive your name, email address, and profile photo from Google. We do not store or have access to your Google account password. This information is used to create and manage your account and to communicate with you about your subscription.

1.2 Uploaded Documents

You may upload lease proposals, letters of intent, amendments, and related commercial real estate documents to the Platform for AI analysis. Uploaded documents are:

• Stored temporarily in Supabase Storage in a private, user-scoped folder during the extraction process;
• Transmitted to the Anthropic Claude API for AI extraction under commercial API terms that prohibit Anthropic from using API content for model training;
• Permanently and immediately deleted from our storage infrastructure upon completion of extraction — no copy of any uploaded document is retained anywhere in AccompliceRE's infrastructure after extraction completes;
• Never shared with other users or third parties except as necessary for extraction processing.

1.3 Extracted Data

The structured financial terms extracted from your documents (such as base rent, lease term, TI allowances, operating expenses, and similar fields) are stored in our database. This data is:

• Encrypted at the application layer using AES-256-GCM with a per-user encryption key managed by AWS Key Management Service (KMS);
• Additionally encrypted at rest by Supabase at the infrastructure layer independently;
• Associated exclusively with your account and inaccessible to other users via Row Level Security enforced at the database level.

1.4 Payment Information

Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. AccompliceRE never receives or stores your credit card number, CVV, or raw payment card data. We retain records of subscription status, plan type, and transaction history for billing and legal compliance purposes.

1.5 Usage Data

We collect limited usage data to operate and improve the Platform, including pages visited and features used, browser type and operating system, approximate geographic region, and error logs and performance data. This data is aggregated and does not identify individual users in our analytics systems.

1.6 Communications

If you contact us by email or through any support channel, we retain those communications to respond to your inquiry and for quality assurance purposes.

2. How We Use Your Information

We use your information only for the following purposes:

• Providing, operating, and improving the Platform;
• Authenticating your identity and managing your account;
• Processing subscription payments and managing your subscription;
• Processing and returning AI extraction results from uploaded documents;
• Providing customer support;
• Sending transactional emails (subscription confirmations, billing receipts, material changes to this Policy or our Terms of Service);
• Detecting and preventing fraud, abuse, and security incidents;
• Complying with applicable legal obligations;
• Enforcing our Terms of Service.

We do not use your personal information or Customer Data for advertising, marketing profiling, or sale to third parties. We do not use your uploaded documents or extracted data to train, fine-tune, or improve any artificial intelligence or machine learning model, including AccompliceRE's own systems or any third-party AI system.

3. How We Share Your Information

We do not sell your personal information. We share information only with the following categories of service providers who process data on our behalf, each under written data protection agreements. For the complete list of subprocessors, see Exhibit A of our Data Processing Agreement.

We may also disclose information: (a) if required by applicable law, regulation, or valid legal process; (b) to protect the rights, safety, or property of AccompliceRE or others; or (c) in connection with a merger, acquisition, or sale of all or substantially all of our assets, subject to the acquirer being bound by this Privacy Policy.

4. Data Retention

We retain different categories of data for different periods:

• Uploaded source documents: Deleted immediately upon completion of AI extraction — no retention period.
• Extracted lease data: Retained for the duration of your active subscription and for 30 days following subscription termination, after which it is permanently deleted.
• Account information: Retained while your account is active and for 30 days following account deletion.
• Billing and payment records: Retained for 7 years following termination as required for financial and tax compliance.
• Usage and access logs: Retained for 12 months.
• Aggregated, de-identified analytics: May be retained indefinitely.

5. Your Privacy Rights

5.1 All Users

Regardless of location, you have the right to: access your account information and extracted data within the Platform; request deletion of your account; update your account information; and request an export of your extracted lease data by contacting legal@accomplicere.com.

5.2 California Residents (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information collected about them; delete personal information we have collected (subject to certain exceptions); correct inaccurate personal information; and opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. California residents also have the right to non-discrimination for exercising their privacy rights. To exercise California privacy rights, contact: legal@accomplicere.com.

5.3 Texas Residents (TDPSA)

Texas residents have the right to confirm whether AccompliceRE processes their personal data; access, correct, and delete their personal data; obtain a portable copy of their personal data; and opt out of the sale of personal data — we do not sell personal data. To appeal any decision regarding a privacy rights request, contact: legal@accomplicere.com.

5.4 EEA and UK Residents (GDPR)

If you access the Platform from within the European Economic Area or United Kingdom, our processing of your personal data is governed by our Data Processing Agreement. You have rights to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise these rights, email legal@accomplicere.com.

5.5 Other U.S. State Privacy Laws

Residents of states with applicable comprehensive privacy laws may have additional rights regarding their personal data, including rights to access, correct, delete, and opt out of certain processing activities. AccompliceRE does not sell personal data, does not engage in targeted advertising, and does not use personal data for profiling. To exercise any privacy rights available under your state's applicable law, contact legal@accomplicere.com.

6. Security

We implement the following measures to protect your information:

• AES-256-GCM application-layer encryption of all extracted data, with per-user AWS KMS encryption keys;
• Independent Supabase infrastructure-layer encryption of database contents;
• TLS 1.2+ encryption of all data in transit;
• Row Level Security at the database layer preventing cross-user data access;
• Cloudflare Turnstile on all authentication entry points;
• Supabase Auth CAPTCHA as an independent second bot prevention layer;
• Rate limiting on all API routes via Upstash Redis;
• Immediate and permanent deletion of uploaded documents following extraction.

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@accomplicere.com.

7. Cookies and Tracking

The Platform uses essential cookies required for authentication and session management (provided by Supabase Auth). We do not use advertising cookies, third-party tracking pixels, or behavioral profiling cookies. We collect limited aggregated analytics to understand how features are used — this data is not linked to individual users and is not shared with advertising networks.

Stripe may set cookies during the checkout process to support payment security and fraud prevention. Cloudflare may set cookies in connection with bot protection (Turnstile) to distinguish legitimate users from automated traffic. These are functional cookies necessary for the operation of payment and security features and are not used for advertising or behavioral tracking.

AccompliceRE honors Global Privacy Control (GPC) and similar universal opt-out preference signals. Because AccompliceRE does not sell personal data, share personal data for targeted advertising, or engage in cross-site tracking, no action is required upon receipt of such signals.

8. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information to us, contact us at legal@accomplicere.com and we will delete it promptly.

9. International Data Transfers

Our primary infrastructure is located in the United States (AWS US East region). If you access the Platform from outside the United States, your information will be transferred to and processed in the United States. For transfers of personal data from the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses as the legal transfer mechanism as described in our Data Processing Agreement. Where Customer Data is transferred to PDFShift SAS (France), such transfers are made under Standard Contractual Clauses in compliance with GDPR Chapter V.

10. Third-Party Services

The Platform integrates with third-party services including Google (OAuth), Stripe (payments), and others listed in Section 3. Each third-party service operates under its own terms and privacy policy. AccompliceRE is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of third-party services you use in connection with the Platform.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email or a prominent notice within the Platform before the changes take effect. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the revised Policy. The effective date at the top of this Policy reflects the most recent revision.

12. Contact Us

For privacy-related inquiries, to exercise your privacy rights, or to report a data protection concern:

Accomplice Real Estate, LLC d/b/a AccompliceRE
Attn: Privacy / Legal
Austin, Texas
legal@accomplicere.com

For security-specific concerns: security@accomplicere.com