Privacy Policy
Effective date: May 1, 2026
DataSuperior LLC ("DataSuperior", "we", "us", or "our") operates the AI Underwriter platform available at aiunderwriter.datasuperior.ai (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
We collect the following categories of information:
- Account information. When you register, we collect your name, email address, and password (stored as a bcrypt hash). If you sign in via Google or Microsoft OAuth, we receive your name and email from that provider.
- Deal and underwriting data. All property details, financial assumptions, unit mix, income and expense figures, financing terms, and other deal data you enter into the Service.
- Uploaded documents. Files you upload (offering memoranda, rent rolls, T-12 financials, inspection reports, etc.) are stored in Microsoft Azure Blob Storage on your behalf.
- Payment information. Billing is processed by Stripe, Inc. We do not store your credit card number, CVC, or full card details on our servers. We receive a Stripe customer ID, subscription status, and plan tier.
- Usage data. We collect information about how you interact with the Service — pages visited, features used, session duration, and API request counts — to improve the product and enforce plan limits.
- Communications. If you contact us via the support form or email, we retain those messages.
- Technical data. IP address (hashed for security logs), browser type, and device type collected automatically via server logs and session records.
2. How We Use Your Information
- To provide, operate, and improve the Service, including calculating underwriting metrics and generating AI-assisted analyses.
- To authenticate you and maintain your session.
- To process payments and manage your subscription through Stripe.
- To send transactional emails — account verification, password reset, OTP codes — via Resend.
- To enforce plan limits, detect abuse, and maintain the security of the Service.
- To respond to support requests and communicate with you about the Service.
- To generate AI analyses of your deals and documents using large language model APIs (Azure OpenAI or OpenAI). Your deal data and documents are sent to these APIs solely to produce the analysis you request; they are not used to train third-party models under our agreements with those providers.
- To comply with applicable laws and legal obligations.
3. Third-Party Service Providers
We share data with the following categories of third parties solely to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe, Inc. | Payment processing and subscription management | Name, email, billing details |
| Resend | Transactional email delivery | Email address, message content |
| Microsoft Azure | Cloud infrastructure, blob storage for documents, AI (Azure OpenAI) | Uploaded documents, deal context sent to AI APIs |
| OpenAI, LLC | AI analysis (when Azure OpenAI is not configured) | Deal context, document text fragments |
| Google / Microsoft | OAuth sign-in (optional) | Name and email (only when you choose OAuth) |
We do not sell, rent, or share your personal information with third parties for their own marketing purposes.
4. Data Ownership
You retain full ownership of all deal data, financial assumptions, and documents you upload to the Service. We do not claim any intellectual property rights over your content. We process your data only as directed by your use of the Service.
5. Data Retention
- Account data is retained for the duration of your account plus 90 days after deletion.
- Deal data and uploaded documents are retained until you delete them or your account is closed.
- Soft-deleted items (trash) are permanently purged on a periodic schedule.
- Security and audit logs (login attempts, error logs) are retained for 12 months.
- Payment records are retained as required by applicable tax and accounting laws.
6. Security
We implement industry-standard security measures including HTTPS encryption in transit, bcrypt password hashing, httpOnly JWT cookies with 12-hour expiry, session revocation on idle timeout, and IP-hashed security logs. Document storage uses Microsoft Azure Blob Storage with access controls. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.
7. Cookies and Session Data
The Service uses a single httpOnly cookie (uw_token) to maintain your authenticated session. This cookie is strictly necessary for the Service to function and is not used for advertising or tracking. We do not use third-party advertising cookies.
8. Your Rights and Choices
- Access. You may request a copy of the personal data we hold about you.
- Correction. You may update your name and email in the Settings page at any time.
- Deletion. You may delete individual deals and documents within the Service. To delete your account and all associated data, contact us at support@datasuperior.com.
- Portability. You may export your deal data at any time using the Excel export feature.
- Opt-out. Transactional emails (verification, password reset) are required for account operation and cannot be opted out of while your account is active.
9. Children's Privacy
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
11. Contact Us
For privacy-related questions or requests, contact us at:
DataSuperior LLC
Email: support@datasuperior.com
Website: datasuperior.com