Privacy Policy

Effective date: April 17, 2026

Aquinas Industries ("Company," "we," "us," or "our") operates Valoris Report (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. It also describes your rights regarding your personal data.

We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, and password when you create an account
• Profile information: Brokerage name, phone number, license number, and branding preferences
• Property data: Subject property details, comparable sales data, MLS exports, and photos you upload to generate CMA reports
• Client information: Names and contact details of your clients that you optionally include in CMA reports
• Payment information: Billing details processed through Stripe (we do not store your full credit card number)
• Communications: Messages you send to us via email or support channels

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, CMA reports generated, and interaction patterns
• Device information: Browser type, operating system, screen resolution, and device identifiers
• Log data: IP address, access timestamps, referring URLs, and error logs

2. How We Use Your Information

We use your personal information to:

• Provide, operate, and maintain the Service
• Generate CMA reports based on the data you upload, including AI-powered analysis and adjustments
• Process payments and manage your subscription
• Send transactional emails (account verification, password resets, billing receipts)
• Improve the Service through aggregated, anonymized usage analytics
• Respond to your inquiries and provide customer support
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

3. Third-Party Services

We share your information with the following third-party service providers, each of which has its own privacy policy governing the data we share:

3.1 Stripe

We use Stripe to process payments. When you subscribe, your payment information is sent directly to Stripe. We store only your Stripe customer ID — not your full card details. Stripe's privacy policy: stripe.com/privacy

3.2 Supabase

We use Supabase for authentication, database hosting, and file storage. Your account data, property data, and generated reports are stored on Supabase infrastructure. Supabase's privacy policy: supabase.com/privacy

3.3 Anthropic (Claude AI)

We use Anthropic's Claude AI models to analyze comparable sales data, calculate adjustments, and generate market narratives. Property data included in your CMA reports is sent to Anthropic's API for processing. Anthropic's privacy policy: anthropic.com/privacy

3.4 Vercel

The Service is hosted on Vercel. Vercel processes your requests and may collect standard server logs. Vercel's privacy policy: vercel.com/legal/privacy-policy

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you delete your account or request deletion
• CMA reports: Retained until you delete them or your account is closed
• Payment records: Retained for up to 7 years to comply with tax and accounting regulations
• Server logs: Automatically purged after 90 days

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

5.1 Under GDPR (European Economic Area)

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request that we limit the processing of your data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to our processing of your data in certain circumstances

5.2 Under CCPA (California Residents)

• Right to know: Request what personal information we collect, use, and disclose
• Right to delete: Request deletion of your personal information
• Right to opt out: Opt out of the sale of your personal information (note: we do not sell personal information)
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise any of these rights, contact us at macantubusiness@gmail.com. We will respond to your request within 30 days.

6. Cookies & Tracking Technologies

We use the following cookies and similar technologies:

• Essential cookies: Required for authentication and session management. These cannot be disabled without breaking the Service.
• Preference cookies: Remember your settings (e.g., report layout preferences, color scheme choices)

We do not use third-party advertising or tracking cookies. We do not participate in ad networks or sell data to advertisers.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) for all communications
• Encryption at rest for database storage
• Row-Level Security (RLS) policies ensuring users can only access their own data
• Secure authentication via Supabase Auth with bcrypt password hashing
• Regular security reviews and access controls

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for keeping your account credentials confidential.

8. International Data Transfers

Your data may be processed and stored on servers located in the United States. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the U.S. We rely on the standard contractual clauses and privacy frameworks of our service providers (Supabase, Stripe, Anthropic, Vercel) to ensure adequate data protection.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service. The "Effective date" at the top of this page indicates when this policy was last revised. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Aquinas Industries
Email: macantubusiness@gmail.com

By using Valoris Report, you acknowledge that you have read and understood this Privacy Policy.