Privacy Policy

This Privacy Policy explains what information Dwelize collects when you use the Service — the website, dashboard, and shareable report pages that turn an address, asking price, and estimated rent into an AI-estimated ARV and rental-underwriting report — how we use it, who else receives it, and the choices you have.

• Account information. The email address you sign up with; a hashed password if you use email/password sign-in; your name and profile photo from Google if you use “Continue with Google.”
• Report and deal data. Property addresses, asking prices, estimated rents, underwriting assumptions (down payment, rate, taxes, insurance, vacancy, maintenance, and similar), deal-mode inputs, and any property photos you upload.
• Chat content. Messages you send to a report’s deal-chat assistant, and the AI’s responses.
• Team data. If you create or join a team, the team name, your role, membership, and any custom fields an admin configures for the team’s reports.
• Contact-form submissions. The name, email, subject, and message you submit through the contact page.
• Operational data. When an error occurs, our logging captures request metadata such as user-agent and referer to help us diagnose the problem. We don’t use this for advertising or profiling.

We use this information to operate the Service: to create and secure your account, to generate and display your reports, to compute underwriting metrics, to send account emails (email verification codes, password resets), to respond to contact-form submissions, to support team collaboration, and to diagnose and fix errors. We don’t use your data for advertising, and we don’t sell it.

Operating Dwelize means some information necessarily passes through a small set of infrastructure and data providers. We share only what each one needs to do its job:

• MongoDB Atlas — hosts the application database; stores all account, report, and team data described above.
• Google (Gemini API) — receives property addresses and deal details you enter, to generate the AI ARV estimate and power deal chat.
• Google OAuth — if you sign in with Google, Google shares your name, email, and profile photo with us to create your account.
• Gmail SMTP (Google) — sends transactional emails: email-verification codes, password-reset links, team invitations, and contact-form notifications.
• Mapbox — receives the address text you enter, to geocode it into map coordinates. Mapbox’s client-side token used for this is a public, restricted token intentionally exposed in the browser — it is not a secret credential.
• RapidAPI (Zillow-sourced property data) — receives a property address when you explicitly choose to load comparable sales for a report, to retrieve comp data.
• FRED (Federal Reserve Economic Data) — supplies current mortgage-rate context; no personal information is sent to FRED.
• Cloudflare R2 — stores property photos you upload to a report.
• Axiom — receives operational error logs, which can include request metadata like user-agent and referer, to help us diagnose problems.

We don’t sell your personal information, and we don’t share it with data brokers or for advertising purposes.

A report’s page is readable by anyone who has its link — no account or sign-in is required to view one. This is a deliberate product behavior, not a bug: it’s what lets you share a deal analysis with a partner, lender, or agent who doesn’t use Dwelize. Only the report’s owner can edit its assumptions, retry analysis, upload photos, or use deal chat. Keep this in mind before entering information into a report that you wouldn’t want visible to anyone who obtains the link. If your report is part of a team workspace, it’s also visible to that team’s other members.

Dwelize uses session cookies set by our authentication system (Better Auth) to keep you signed in between visits. These are functional cookies required for the account features to work — we don’t use third-party advertising or tracking cookies.

We retain your account and report data for as long as your account remains active, or as needed to provide the Service and meet legal obligations. If you request deletion (see Section 8), we remove the data associated with your account within a reasonable time, except where we’re required to retain certain records by law.

You can review and edit most of your own report and assumption data directly in the dashboard. For anything else — requesting a copy of your account data, correcting it, or deleting your account — email us at Dwelize-primary@gmail.com or use the contact page. Account deletion is currently handled manually by our team rather than through a self-service control in the product; we’ll confirm with you once it’s complete.

Dwelize is intended for adult real estate investors and is not directed at children. We don’t knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we’ll remove it.

We use reasonable technical and organizational measures to protect your information — including that access to create or modify a report always requires a validated session tied to the report’s owner. No method of storage or transmission is completely secure, so we can’t guarantee absolute security.

We may update this Privacy Policy as the Service changes. If we make a material change, we’ll update the “last updated” date on this page.

Questions about this policy or your data? Reach us at Dwelize-primary@gmail.com or through the contact page.