Privacy Policy

1. Who we are

Catalyst Collective, LLC, a Delaware limited liability company doing business as Realastat ("we," "us," or "our"), operates Realastat at realastat.ai. This policy explains what personal information we collect, how we use it, and your rights regarding that information.

For purposes of applicable data protection law, Catalyst Collective, LLC is the data controller. You can reach us at privacy@realastat.ai or by mail at:

2. Information we collect

Account information

When you sign up, we collect your email address and (optionally) your name. This is managed through Supabase, our authentication and database provider.

Listing screenshots

You upload screenshots of property listings for analysis. These images are sent to our AI pipeline for data extraction and are deleted after processing is complete. We do not retain your screenshots.

Deal data

The extracted inputs, underwriting results, and any edits you make are stored in your account so you can revisit them. Only you can delete your own deals. Realastat staff may access deal data for support, debugging, and product improvement purposes.

Usage data

We collect standard usage data such as page views and feature interactions to understand how the product is used and improve it. We do not sell this data.

3. How we use your information

• To provide, operate, and improve Realastat
• To authenticate your account and enforce plan limits
• To process payments via Stripe (we do not store payment card details)
• To respond to support requests
• To send product updates if you have opted in

Lawful basis for processing (GDPR)

If you are located in the European Economic Area or United Kingdom, we process your personal data under the following lawful bases: contract (to deliver the Service you signed up for), legitimate interests (to improve the product, prevent abuse, and ensure security), and consent (for optional communications such as product update emails, which you may withdraw at any time).

4. Data sharing

We do not sell your personal data. We share data only with service providers that help us operate the product:

• Supabase — authentication and database hosting (United States)
• Stripe — payment processing (United States)
• OpenAI / Anthropic — AI processing of listing screenshots (United States). Screenshots you upload are transmitted to these providers solely for data extraction and are not retained by them for model training under our agreements.

Each provider is contractually required to protect your data and may not use it for their own purposes.

5. International data transfers

Catalyst Collective, LLC and all of our service providers (Supabase, Stripe, OpenAI, Anthropic) are based in the United States. If you access the Service from the European Economic Area, United Kingdom, or another jurisdiction with data-transfer restrictions, your personal data will be transferred to and processed in the United States. Where required by law, we rely on appropriate transfer mechanisms such as the EU Standard Contractual Clauses or equivalent safeguards established by our service providers.

6. Data retention

Your deal data is retained for as long as your account is active. Screenshots are deleted immediately after analysis. Usage and analytics data is retained for up to 24 months. If you delete your account, all associated deal data and personal information is permanently removed within 30 days, except where we are required to retain it by law (for example, payment records required for tax and accounting purposes).

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request that we delete your account and all associated data
• Portability — export your deal data in a structured format
• Restriction — request that we limit processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent (e.g., marketing emails), you may withdraw at any time without affecting prior processing

You can delete individual deals from your dashboard or close your account from your profile settings at any time. For other requests, contact us at privacy@realastat.ai. We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving a verifiable request.

If you are located in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection supervisory authority.

8. California privacy rights (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used.
• Right to delete — you may request deletion of personal information we have collected, subject to certain exceptions.
• Right to correct — you may request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

To submit a California privacy rights request, contact us at privacy@realastat.ai. We will acknowledge your request within 10 business days and respond within 45 calendar days.

9. Data breach notification

In the event of a data breach that is likely to result in a risk to your rights or freedoms, we will notify affected users and, where required, the relevant supervisory authority, in accordance with applicable law (including within 72 hours where required under GDPR). We will provide information about the nature of the breach, the data affected, and the steps we are taking.

10. Cookies

We use only essential cookies required for authentication and session management. We do not use advertising or tracking cookies. We may use limited analytics tools to understand aggregate product usage; any such tools are configured to minimize personal data collection.

11. Security

We use industry-standard security measures including encrypted connections (HTTPS), row-level security in our database, and access controls so only you can view your data. No system is completely secure, and we cannot guarantee absolute security.

12. Children

Realastat is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in-app notice and by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact

Questions about this policy or to exercise your privacy rights? Contact us at privacy@realastat.ai.