Privacy

Two kinds of people, and whose data it is

Firms are our customers. Their staff sign in to the product. Their clients — the property owners who ask a firm for an estimate — use a firm's public estimate form, on the firm's own address, and never sign in.

What a firm collects from its clients, and what it does with it, is the firm's decision. Each firm can link its own privacy notice from its public estimate form; if it has set one, the form shows the link. If you are a firm's client, that firm's notice and the firm itself are the place to ask about your information.

Each firm's records are kept separate from every other firm's, and enforced in the database. That separation is between firms; it does not mean we cannot technically access the data held for a firm — the data is in our database.

What the product holds

Exactly these kinds of information:

• Account data — for each person who signs in: name, email address, a password stored as a hash (never the password itself), and session records, which include the IP address and browser description the session was opened from.
• Firm data — the firm's name and its web address on the product, its logo and icon if it uploads them, its notification email address, its privacy-notice link, its members and their roles, pending invitations, each member's picture if they upload one, and a record of changes made to the firm's settings and team.
• Client submissions — what a client types into a firm's estimate form: the property's address, purchase price, date placed in service, property type, land value and square footage where given, and the client's name, email address and phone number where given.
• Uploaded documents — files a firm uploads (engagement-letter templates, documents on an estimate, its logo and icon, members' pictures) and the letters the product generates.
• The work itself — estimates, their figures and history, comments between a firm's members, assignments, reminders and in-app notifications.
• Logs and counters — records of each email the product sent and whether sending it succeeded, an append-only history of significant actions, and rate-limit counters keyed by IP address (for the public form and for sign-in).
• A referral code — if a client arrives through a firm member's link, the `ref` code in that link is passed with the submission and the estimate records which member referred it. An unknown code is ignored.
• Requests for access — the firm name, name, email address and note someone types into the request-access form on this site.

Who processes it for us

These services run parts of the product, and the information above passes through or is stored with them:

• Vercel — hosts the application; every request passes through it, and it keeps its own request and function logs.
• Neon — hosts the database that holds everything listed above except files.
• Resend — sends the product's email (password resets, invitations, notifications to firms, acknowledgements to clients, letters a firm chooses to send).
• Cloudflare R2 — stores uploaded documents and generated letters.
• Cloudflare Turnstile — the check on each firm's public estimate form that a person, not a script, is submitting it. It receives the visitor's IP address.
• Stripe — will handle subscription billing once billing is switched on. No payment is taken through the product today.

How long it is kept

No retention period has been decided. Until one is, nothing in the product deletes information on a timer, by decision: losing a client's tax document because a timer fired is a worse failure than keeping it.

Deleting something in the product — a client, an estimate, a document, a comment — hides it everywhere the firm can see it and keeps it in the database and in storage. Removing a member ends their access to the firm. A firm can be suspended; deleting or erasing a firm is not built.

Two things are removed: an upload that fails the product's checks is deleted at once, and an upload that was started and never finished is deleted the next time the firm uploads something, once an hour has passed.

A sign-in session lasts 7 days and is renewed while it is used.

If you want information about you removed, write to hello@selantia.com. There is no self-service deletion today.

Cookies

The cookies the product sets are listed on the Cookies page.

Changes

This page will change when the product does, and when it is reviewed. The effective date above will say which version you are reading.