Privacy Policy

Appraisal Ally ("we," "us," or "our") builds practice- management software for real-estate appraisers. This Privacy Policy explains what personal data we collect when you visit our website or use the app, why we collect it, who we share it with, and the choices and rights you have. We are a small, founder-run company based in Colorado Springs, Colorado.

1. Two kinds of data, two different roles

Appraisal Ally is a multi-tenant service. It helps to separate two kinds of personal data, because our role differs for each:

• Your account data — we are the controller. This is information about you and your business as our customer: your name, email, login, company profile, and billing details. This Policy governs how we handle it.
• The data you put into the app about other people — you are the controller, and we are your processor. When you add clients, lenders, AMCs, borrowers, attorneys, property addresses, orders, invoices, and reports, you decide what goes in and why. We process it on your behalf and under your instructions. That relationship is governed by our Data Processing Addendum, not this Policy.

2. Information We Collect

2.1 Information you give us as a customer

• Account & team: name, email address, role (appraiser or assistant), and admin/owner flags for you and any teammates you invite. Passwords are handled by our authentication provider; we never see them in plaintext.
• Company profile: business name, business address, timezone, and similar operating details.
• Billing: billing email and your subscription plan. Subscription payments and any saved card are handled by Stripe — we receive identifiers and status, never your full card number.
• Support: the messages and attachments you send to support@appraisalally.com or through the in-app support form.

2.2 Data you store in the app about your appraisal work

You control this content; we hold it for you. Depending on how you use the app it can include:

• Clients & contacts — names, emails, phone numbers, and roles for borrowers, lenders, AMCs, attorneys, and other parties to an order.
• Appraisal records — property addresses, order numbers, assignment details, and opinions of value.
• Invoices & payments — amounts, fees, and Stripe payment identifiers (not card numbers). Invoice payments from your clients run as Stripe Connect direct charges to your connected account.
• Calendar & inspections — events, times, and locations for scheduled work.
• Documents — uploaded files, appraisal reports, and engagement letters with e-signatures, stored in our database file storage and/or your own connected cloud storage (Dropbox or Google Drive).

2.3 Information collected automatically

• Usage and device data on our marketing website — pages viewed, approximate location from IP, browser, and referrer. On the website this is collected through analytics only after you consent. See our Cookie Policy.
• Diagnostic and security logs from the app, used to operate and protect the service and to debug problems. We also log AI usage (model and token counts) for cost accounting.

2.4 Information from integrations you connect

Integrations are optional and opt-in. If you connect Google (Calendar, Drive, Gmail, and Places) or Dropbox via OAuth, we receive only the scopes you authorize — for example, the calendar events you sync, the Drive or Dropbox folder you choose for assignment files, or the ability to send your business correspondence (engagement letters, invoices, payout statements) from your own Gmail address when you explicitly trigger it. We never receive your password for those services, and you can disconnect at any time in Settings (or from your Google or Dropbox account's security page).

Google user data — Limited Use. Appraisal Ally's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google Calendar data is used only to sync your appraisal events both directions; Google Drive access is used only to create and manage the assignment folders you designate; Gmail access (send-only) is used only to send documents you explicitly choose to send from your own address — engagement letters, invoices, and payout statements — and never to read your mailbox. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and no humans read it except with your consent, for security purposes, or as required by law.

3. How We Use Information

• To provide, operate, secure, and improve the service.
• To authenticate users and guard against fraud and abuse.
• To process subscription billing and send receipts.
• To send transactional messages such as team invitations, password resets, payment notifications, and support replies (delivered through our email provider).
• To power AI assistance features. AI prompts are processed by Anthropic (Claude). We log model and token usage for cost tracking, and your data is not used to train third-party AI models.
• To respond to support requests and to comply with our legal obligations and enforce our Terms of Service.

4. Legal Bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you, our legitimate interests in operating, securing, and improving the service, compliance with legal obligations, and your consent where required (such as non-essential website cookies and marketing email).

5. Service Providers & Subprocessors

We do not sell personal data and we do not share it with advertisers. We share data only with the vetted vendors that run the service for us:

• Vercel — application hosting (United States).
• Supabase — database, authentication, and file storage, with Row-Level Security and Supabase Auth (hosted on AWS, US-East).
• Stripe — subscription billing and client invoice payments. Card data is handled entirely by Stripe.
• Loops — transactional and product email delivery.
• Anthropic — AI features (Claude); not used to train third-party models.
• Google (Calendar, Drive, Gmail, Places) and Dropbox — only when you connect those integrations, and only within the scopes you authorize.
• PostHog — marketing-website analytics only, behind a consent banner.

A current list is maintained at /legal/subprocessors. We may also disclose information when required by law or to protect rights, property, or safety. If we are ever part of a merger or asset sale, we will continue to protect data under terms no less protective than this Policy and notify affected account owners in advance.

6. International Transfers

We are based in the United States and host data in the United States. If you access the service from the EEA, UK, or Switzerland, your data is transferred to the US; where required we rely on Standard Contractual Clauses and the safeguards described in our DPA.

7. Retention & Your Data

Your data is yours. You can export it on demand while your account is active. We retain your account and content for as long as your subscription is active. After cancellation we provide a 90-day read-only grace period so you can export, after which your content is deleted or de-identified from production systems, subject to legal retention obligations and standard backup-rotation schedules.

8. Security

We take security seriously and use measures appropriate to a small company handling sensitive business data:

• Encryption in transit using TLS 1.3.
• Encryption at rest using AES-256.
• Row-Level Security on every multi-tenant table, so one business cannot read another business's data.
• OAuth-only access to integrations — we never hold third-party passwords.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to support@appraisalally.com.

9. Your Rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to certain processing of your personal data, and to withdraw consent. Residents of California (CCPA / CPRA) additionally have the right to know what we collect, to delete and correct it, to opt out of any "sale" or "sharing" (we do neither), and to be free from retaliation for exercising these rights.

To exercise any of these rights, email support@appraisalally.com. If your request concerns data your appraiser or business stores about you as one of their clients, we will refer you to that business, which controls that data — see our DPA.

10. Children

The service is a business tool intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from minors.

11. Cookies

For how we use cookies and similar technologies on the website and in the app, and how to opt out of analytics, see our Cookie Policy.

12. Contact

Questions about this Policy or our privacy practices — including data requests — can be sent to support@appraisalally.com or to our mailing address below.

Appraisal Ally
9235 N Union Blvd Ste 150 #341
Colorado Springs, CO 80920