Privacy Policy

This Privacy Policy describes how Accomplice Real Estate, LLC, a Texas limited liability company doing business as AccompliceRE (“Company,” “we,” “us,” “our”), collects, uses, shares, and protects personal information when you access or use accomplicere.com, analytics.accomplicere.com, and any related services (collectively, the “Platform”).

By creating an account or using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Platform.

1. Information We Collect

1.1 Account Information

When you create an account, you may sign up using Google OAuth, Microsoft OAuth, or email and password. If you use Google or Microsoft OAuth, we receive your name, email address, and profile photo from the identity provider. We do not store or have access to your OAuth provider account password. This information is used to create and manage your account and to communicate with you about your subscription.

1.2 Uploaded Documents

You may upload lease proposals, letters of intent, amendments, and related commercial real estate documents to the Platform for AI analysis. Uploaded documents are:

• Stored temporarily in Supabase Storage in a private, user-scoped folder during the extraction process;
• Transmitted to the Anthropic Claude API for AI extraction under commercial API terms that prohibit Anthropic from using API content for model training;
• Permanently and immediately deleted from our storage infrastructure upon completion of extraction — no copy of any uploaded document is retained anywhere in AccompliceRE's infrastructure after extraction completes;
• Never shared with other users or third parties except as necessary for extraction processing.

1.3 Extracted Data

The structured financial terms extracted from your documents (such as base rent, lease term, TI allowances, operating expenses, and similar fields) are stored in our database. This data is:

• Encrypted at the application layer using AES-256-GCM with a per-user encryption key managed by AWS Key Management Service (KMS);
• Additionally encrypted at rest by Supabase at the infrastructure layer independently;
• Associated exclusively with your account and inaccessible to other users via Row Level Security enforced at the database level.

1.4 Payment Information

Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. AccompliceRE never receives or stores your credit card number, CVV, or raw payment card data. We retain records of subscription status, plan type, and transaction history for billing and legal compliance purposes.

1.5 Usage Data

We collect limited usage data to operate and improve the Platform, including pages visited and features used, browser type and operating system, approximate geographic region, and error logs and performance data. This data is aggregated and does not identify individual users in our analytics systems.

1.6 Communications

If you contact us by email or through any support channel, we retain those communications to respond to your inquiry and for quality assurance purposes. We may also send direct business communications to commercial real estate professionals regarding our services. These communications may include tracking technologies described in Section 7.6.

1.7 Business Development Contact Data

In connection with our business development activities, we may collect and process contact information of commercial real estate professionals, including name, email address, company name, job title, city, state, phone number, and timezone. This data is collected from publicly available sources, professional directories, industry events, and direct business interactions. This information is used solely for direct business-to-business outreach and is managed by Company personnel with administrative access. The Company does not collect or process sensitive personal data (as defined under GDPR Article 9 or equivalent provisions of applicable data protection laws) in connection with its business development activities, including racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or biometric data.

2. How We Use Your Information

We use your information only for the following purposes:

• Providing, operating, and improving the Platform;
• Authenticating your identity and managing your account;
• Processing subscription payments and managing your subscription;
• Processing and returning AI extraction results from uploaded documents;
• Providing customer support;
• Sending transactional emails (subscription confirmations, billing receipts, material changes to this Policy or our Terms of Service);
• Detecting and preventing fraud, abuse, and security incidents;
• Complying with applicable legal obligations;
• Enforcing our Terms of Service;
• Conducting direct business-to-business outreach to commercial real estate professionals regarding our services, including automated multi-step email campaigns managed by Company personnel.

We do not use your personal information or Customer Data for advertising, marketing profiling, or sale to third parties. We do not use your uploaded documents or extracted data to train, fine-tune, or improve any artificial intelligence or machine learning model, including AccompliceRE's own systems or any third-party AI system.

3. How We Share Your Information

We do not sell your personal information. We share information only with the following categories of service providers who process data on our behalf, each under written data protection agreements. For the complete list of subprocessors, see Exhibit A of our Data Processing Agreement.

We may also disclose information: (a) if required by applicable law, regulation, or valid legal process; (b) to protect the rights, safety, or property of AccompliceRE or others; or (c) in connection with a merger, acquisition, or sale of all or substantially all of our assets, subject to the acquirer being bound by this Privacy Policy.

4. Data Retention

We retain different categories of data for different periods:

• Uploaded source documents: Deleted immediately upon completion of AI extraction — no retention period.
• Extracted lease data: Retained for the duration of your active subscription and for 30 days following subscription termination, after which it is permanently deleted.
• Account information: Retained while your account is active and for 30 days following account deletion.
• Billing and payment records: Retained for 7 years following termination as required for financial and tax compliance.
• Usage and access logs: Retained for 12 months.
• Business development contact data: Retained for the duration of active outreach and for 12 months following the last communication, or until the recipient requests deletion, whichever is earlier.
• Email campaign engagement data: Open, click, bounce, and complaint records are retained for 12 months following campaign completion.
• Aggregated, de-identified analytics: May be retained indefinitely.

5. Your Privacy Rights

5.1 All Users

Regardless of location, you have the right to: access your account information and extracted data within the Platform; request deletion of your account; update your account information; and request an export of your extracted lease data by contacting legal@accomplicere.com.

5.2 California Residents (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information collected about them; delete personal information we have collected (subject to certain exceptions); correct inaccurate personal information; and opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. California residents also have the right to non-discrimination for exercising their privacy rights. To exercise California privacy rights, contact: legal@accomplicere.com.

5.3 Texas Residents (TDPSA)

Texas residents have the right to confirm whether AccompliceRE processes their personal data; access, correct, and delete their personal data; obtain a portable copy of their personal data; and opt out of the sale of personal data — we do not sell personal data. To appeal any decision regarding a privacy rights request, contact: legal@accomplicere.com.

5.4 EEA and UK Residents (GDPR)

The Platform is not directed to residents of the European Economic Area or United Kingdom. If you nonetheless access the Platform from within the EEA or UK, our processing of your personal data is governed by our Data Processing Agreement. You have rights to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise these rights, email legal@accomplicere.com. Where the Company processes Prospect Data (as defined in Section 1.7) relating to EEA or UK residents, the legal basis for such processing is legitimate interest under Article 6(1)(f) of the GDPR — specifically, the Company's interest in conducting direct business-to-business outreach to commercial real estate professionals. Recipients may object to this processing at any time by contacting legal@accomplicere.com or using the unsubscribe link in any email.

5.5 Outreach Recipients

If you have received a business communication from us and are not a Platform user, you may opt out of future communications by clicking the unsubscribe link included in any email, or by contacting legal@accomplicere.com. You may also request deletion of your contact information or request information about the data we hold about you by emailing legal@accomplicere.com. Deletion requests will be fulfilled within 30 days of receipt. When you opt out, your email address is permanently added to a global suppression list and will not receive further outreach from any AccompliceRE campaign. Opt-out requests are honored within 48 hours.

5.6 Other U.S. State Privacy Laws

Residents of states with applicable comprehensive privacy laws may have additional rights regarding their personal data, including rights to access, correct, delete, and opt out of certain processing activities. AccompliceRE does not sell personal data, does not engage in targeted advertising, and does not use personal data for profiling. To exercise any privacy rights available under your state's applicable law, contact legal@accomplicere.com.

6. Security

We implement the following measures to protect your information:

• AES-256-GCM application-layer encryption of all extracted data, with per-user AWS KMS encryption keys;
• Independent Supabase infrastructure-layer encryption of database contents;
• TLS 1.2+ encryption of all data in transit;
• Row Level Security at the database layer preventing cross-user data access;
• Cloudflare Turnstile on all authentication entry points;
• Supabase Auth CAPTCHA as an independent second bot prevention layer;
• Rate limiting on critical API routes including authentication, upload, and AI extraction endpoints via Upstash Redis;
• Immediate and permanent deletion of uploaded documents following extraction.

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@accomplicere.com.

7. Cookies and Tracking Technologies

7.1 Essential Cookies

The Platform uses cookies that are strictly necessary for authentication, session management, and CSRF protection (provided by Supabase Auth). These cookies cannot be disabled as they are required for the Platform to function. They do not track you across third-party websites and are not used for advertising.

7.2 Functional Cookies

When you visit the Platform through a referral link (accomplicere.com/r/<code>), we set a first-party cookie named “ref” that contains only the referrer's code. This cookie has a maximum duration of 90 days, is first-party only, and is used solely to attribute the referral when you create an account. The referral cookie is set only if you have accepted cookies via the consent banner; if you reject cookies, any existing referral cookie is immediately deleted.

A “cookie_consent” cookie with a maximum duration of one year records your acceptance or rejection of non-essential cookies. This cookie contains only the value “accepted” or “rejected” and is required to honor your stated preference across visits.

7.3 Analytics and Error Monitoring

We use Vercel Analytics on the public marketing site (accomplicere.com) to collect aggregated, anonymized page view data. On the authenticated application (analytics.accomplicere.com), we use Sentry for error monitoring and performance tracking. Sentry collects error reports, stack traces, and browser performance data to help us identify and resolve software defects. Sentry does not track users across third-party websites and is not used for advertising. Sentry initialization is subject to cookie consent where applicable.

7.4 Third-Party Functional Cookies

Stripe may set cookies during the checkout process to support payment security and fraud prevention. Cloudflare may set cookies in connection with bot protection (Turnstile) to distinguish legitimate users from automated traffic. These are functional cookies necessary for the operation of payment and security features and are not used for advertising or behavioral tracking.

7.5 Your Cookie Choices

On first visit to accomplicere.com, a cookie consent banner allows you to accept or reject non-essential cookies. You may also manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies; however, disabling essential cookies may prevent the Platform from functioning correctly. AccompliceRE honors Global Privacy Control (GPC), Do Not Track, and similar universal opt-out preference signals. Because AccompliceRE does not sell personal data, share personal data for targeted advertising, or engage in cross-site tracking, no additional action is required upon receipt of such signals.

7.6 Email Tracking Technologies

Business outreach emails sent by the Company may contain tracking technologies, including single-pixel images (tracking pixels) that record whether and when an email is opened, and redirect links that record whether and when a link is clicked. This data is used solely to measure the effectiveness of our business communications and to manage follow-up sequences. Open and click data is associated with the recipient's email address. Recipients may prevent open tracking by disabling image loading in their email client. Recipients may opt out of all further communications by clicking the unsubscribe link included in every outreach email or by contacting legal@accomplicere.com. All outreach emails include RFC 8058-compliant List-Unsubscribe and List-Unsubscribe-Post headers, enabling one-click unsubscribe directly from supported email clients (Gmail, Yahoo Mail, Apple Mail, and others) without visiting a web page.

8. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA) or from minors under 18. If you believe a child under 13 has provided personal information to us, contact us at legal@accomplicere.com and we will delete it promptly.

9. International Data Transfers

Our primary infrastructure is located in the United States (AWS US East region). If you access the Platform from outside the United States, your information will be transferred to and processed in the United States. For transfers of personal data from the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses as the legal transfer mechanism as described in our Data Processing Agreement. Where Customer Data is transferred to PDFShift SAS (France), such transfers are made under Standard Contractual Clauses in compliance with GDPR Chapter V.

10. Third-Party Services

The Platform integrates with third-party services including Google (OAuth), Stripe (payments), and others listed in Section 3. Each third-party service operates under its own terms and privacy policy. AccompliceRE is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of third-party services you use in connection with the Platform.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email or a prominent notice within the Platform before the changes take effect. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the revised Policy. The effective date at the top of this Policy reflects the most recent revision.

12. Contact Us

For privacy-related inquiries, to exercise your privacy rights, or to report a data protection concern:

Accomplice Real Estate, LLC d/b/a AccompliceRE
Attn: Legal
720 Brazos Street, Floor 12, Austin, TX 78701
legal@accomplicere.com

For security-specific concerns: security@accomplicere.com