Privacy Policy

DeedFlex ("Company," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding that information.

By using the DeedFlex service (the "Service"), you consent to the practices described in this policy. This policy applies to all users of our website at deedflex.com and related services.

1. Information We Collect

1.1 Information You Provide Directly

• Account Registration: Name, email address, and password. Passwords are cryptographically hashed using pbkdf2:sha256 with a unique salt — we never store, view, or have access to your plain text password.
• Profile and Preferences: State preferences, deal alert settings, watchlist selections, and filter configurations.
• Communications: Any messages, support requests, or feedback you send us via email or in-app forms.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, searches performed, properties viewed, time spent on pages, and interaction patterns within the Service.
• Device and Browser Data: IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
• Session Data: Login timestamps, session duration, and authentication tokens (stored in encrypted session cookies).

1.3 Information We Do NOT Collect

• Payment Information: Credit card numbers, bank account details, and billing addresses are collected and processed exclusively by our payment processor, LemonSqueezy (Paddle US Inc.). We never receive, store, or have access to your full payment card details.
• Government IDs: We do not collect Social Security numbers, driver's license numbers, or other government-issued identification.
• Location Data: We do not collect precise GPS location data from your device.

2. Legal Basis for Processing

We process your personal information under the following legal bases:

• Contract Performance: Processing necessary to provide you the Service you signed up for (account management, subscription fulfillment, email delivery).
• Legitimate Interests: Improving the Service, preventing fraud, ensuring security, and communicating product updates — balanced against your privacy rights.
• Consent: Marketing communications and optional deal alert emails. You may withdraw consent at any time.
• Legal Obligation: When required by law, regulation, legal process, or governmental request.

3. How We Use Your Information

• To create and maintain your account
• To provide, operate, and improve the Service
• To process and manage your subscription
• To send transactional emails: welcome messages, password resets, trial reminders, and account notifications
• To send deal alert notifications based on your configured preferences (opt-in only)
• To personalize your experience (remembering state preferences and filter settings)
• To monitor and analyze usage trends for product improvement
• To detect, prevent, and address fraud, abuse, and security issues
• To respond to customer support inquiries
• To comply with legal obligations

We do not use your personal information for profiling, automated credit decisions, or any purpose unrelated to providing the Service.

4. Automated Decision-Making and Scoring

DeedFlex uses automated algorithms to score and rank properties. These scores are applied to property data, not to you personally. Our scoring engine evaluates property equity, risk factors, data completeness, competition levels, and state-specific rules — it does not assess your creditworthiness, financial standing, or personal characteristics.

No automated decisions are made about your account access, pricing, or eligibility based on profiling of your personal data.

5. Information Sharing and Third-Party Service Providers

We do not sell, rent, trade, or otherwise disclose your personal information to third parties for their marketing purposes.

We share limited information with the following service providers, solely to operate the Service:

Provider	Purpose	Data Shared
PaymentCloud	Payment processing (card authorization, recurring billing)	Email, name, subscription tier, billing address
SendGrid (Twilio Inc.)	Transactional email delivery	Email address, name
Twilio	SMS notifications (opt-in deal alerts, security codes)	Phone number, message body
Plausible Analytics	Privacy-friendly site analytics (no cookies, no personal data)	Aggregate page views, referrer, anonymized country/device
Bright Data	Public-record data collection infrastructure (server-side only; never collects your personal data)	None — used for our own outbound requests to public county websites
Sentry (Functional Software Inc.)	Error monitoring	Anonymous crash data, IP address (anonymized)
DigitalOcean	Cloud hosting	All Service data (encrypted at rest)
Cloudflare	CDN and DDoS protection at the network edge	IP address, User-Agent (transient, for request routing)

Each subprocessor operates under a written data processing agreement and applicable privacy law (GDPR Art. 28, CCPA / CPRA). For privacy-specific questions, email hello@deedflex.com with "Privacy Question" in the subject line.

We may also disclose information if required by law, court order, subpoena, or government request, or to protect the rights, property, or safety of DeedFlex, our users, or the public.

6. Cookies and Tracking Technologies

Essential Cookies Only. We use strictly necessary cookies for:

• Session management (keeping you logged in)
• CSRF protection (preventing cross-site request forgery)
• Filter and preference persistence (remembering your dashboard settings)

We do NOT use:

• Third-party tracking cookies
• Advertising or retargeting cookies
• Social media tracking pixels
• Google Analytics or similar behavioral analytics tools

Do Not Track: We honor Do Not Track (DNT) browser signals. Since we do not engage in cross-site tracking, no additional action is needed when DNT is enabled.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including:

• SSL/TLS encryption for all data in transit (HTTPS enforced site-wide)
• Cryptographic password hashing with unique per-user salts (pbkdf2:sha256)
• CSRF token protection on all state-changing requests
• HTTP security headers (X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy)
• Session-based authentication with HttpOnly, Secure, SameSite cookies
• Daily encrypted database backups with 7-day retention
• Firewall (UFW) restricting access to necessary ports only
• Automated error monitoring via Sentry for rapid incident response

No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of discovery, as required by applicable law.

8. Data Retention

• Active Accounts: We retain your personal data for as long as your account remains active and for a reasonable period thereafter to fulfill legal obligations.
• Deleted Accounts: Upon account deletion, we remove your personal information from active systems within 30 days. Backup copies are purged within 90 days.
• Anonymized Data: Aggregated, anonymized usage data (which cannot identify you) may be retained indefinitely for analytics and product improvement.
• Legal Holds: We may retain data beyond the standard period if required by legal proceedings, regulatory investigation, or dispute resolution.

9. Your Privacy Rights

9.1 All Users

Regardless of location, you have the right to:

• Access: View your account data at any time via the Account page
• Correction: Update or correct inaccurate information
• Deletion: Delete your account and personal data (Account → Delete Account)
• Portability: Request a machine-readable copy of your data by emailing us
• Opt-Out: Unsubscribe from marketing and deal alert emails at any time via the link in any email or your Account settings

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, email hello@deedflex.com with "CCPA Request" in the subject line. We will respond within 45 days.

9.3 European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access, rectification, erasure, and data portability
• Right to restrict or object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

Your data is processed and stored on servers located in the United States. By using the Service, you consent to the transfer of your data to the US. We rely on Standard Contractual Clauses (SCCs) where applicable for lawful international data transfers.

10. Third-Party Property Data

The property data displayed in the Service — including addresses, parcel IDs, auction dates, and bid amounts — is sourced from publicly available government records and third-party auction platforms. This data relates to properties, not to our users. We do not collect personal information about property owners through the Service beyond what is published in public records.

11. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected information from a child under 18, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. Material changes will be communicated via email to your registered address at least 30 days before taking effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, data access requests, or concerns:

DeedFlex
Email: hello@deedflex.com
Website: https://deedflex.com

We aim to respond to all privacy inquiries within 5 business days.