Privacy Policy

Last Updated: May 27, 2026

1. Overview

LeaseReader.ai ("we", "us", or "our") takes your privacy seriously. This policy explains what data we collect, how we use it, and how long we keep it.

The short version: your lease document is deleted from our servers as soon as you pay and receive your analysis. We do not sell your data. Ever.

2. What We Collect

| Data | Why | Retention | |------|-----|-----------| | Lease text (extracted from your uploaded file) | To generate the AI analysis | Deleted immediately after payment is confirmed | | Uploaded file (PDF, DOCX, or TXT) | Temporary storage during analysis | Deleted immediately after payment is confirmed | | Email address (optional) | To send you a copy of your analysis | Not stored after email is sent; never sold or shared | | Payment information | Collected and stored by Lemon Squeezy — we never see your card number | Retained per Lemon Squeezy's policy | | IP address | Fraud prevention; legal record of terms acceptance | Retained for 90 days, then deleted | | Terms acceptance timestamp and version | Legal record that you agreed to our Terms | Retained for 3 years for compliance purposes | | Borough / building type / rent hint (optional) | Improves AI analysis accuracy | Deleted with the analysis job |

3. How We Use Your Data

We use your data only to:

1. Extract text from your uploaded lease file
2. Send the extracted text to Anthropic's API for AI analysis
3. Display and optionally email your analysis results
4. Record your acceptance of our Terms of Service (legal compliance)
5. Prevent fraud and abuse of the Service

We do not use your data for:

• Advertising or remarketing to you
• Training AI models (Anthropic does not train on API inputs by default)
• Selling to, renting to, or sharing with third parties for their marketing purposes
• Any purpose not described in this policy

4. Third-Party Data Processors

We share your data with the following processors only as strictly necessary to provide the Service:

• Anthropic — Your lease text is sent to Anthropic's Claude API for analysis. Anthropic does not train on API inputs by default under their usage policy. See Anthropic Privacy Policy.
• Supabase — Stores job metadata, status, and analysis results (encrypted at rest). Data is stored in US-East regions. See Supabase Privacy Policy.
• Lemon Squeezy — Processes payments. They collect your name, email address, and card details per their own privacy policy. See Lemon Squeezy Privacy Policy.
• Resend — Sends transactional confirmation emails if you provide your email address. See Resend Privacy Policy.
• Vercel — Hosts the application and edge functions. May log IP addresses in server access logs. See Vercel Privacy Policy.

5. Cookies

We use only essential, functional cookies that are strictly necessary to operate the Service. We do not use:

• Advertising or tracking cookies
• Third-party analytics (e.g., Google Analytics, Facebook Pixel)
• Cross-site tracking technologies

You cannot opt out of essential session cookies without disabling the Service entirely, as they are required for the application to function.

6. Your Rights

Regardless of your location, you have the right to:

• Access — Request a copy of personal data we hold about you
• Deletion — Request deletion of your personal data (note: lease text is already auto-deleted after analysis completes)
• Correction — Request correction of inaccurate personal data
• Portability — Request your data in a portable, machine-readable format

To exercise any of these rights, reply to your Lemon Squeezy purchase receipt, which is delivered to the operator. We will respond within 30 days.

7. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• The right to know what personal information is collected about you
• The right to know whether your personal information is sold or shared, and to whom
• The right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising
• The right to limit the use of sensitive personal information
• The right to non-discrimination for exercising your CCPA/CPRA rights
• The right to correct inaccurate personal information

We do not sell or share your personal information with third parties for their direct marketing or advertising purposes.

To submit a CCPA/CPRA request, reply to your Lemon Squeezy purchase receipt with the subject line "CCPA Request". You may also designate an authorized agent to make requests on your behalf.

8. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please reply to your Lemon Squeezy purchase receipt to notify the operator and the information will be deleted promptly.

9. Data Security

We implement industry-standard security measures, including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encrypted storage via Supabase
• Row-level security (RLS) policies limiting database access
• Automatic deletion of lease files and extracted text after payment is confirmed
• No permanent storage of raw lease content beyond what is necessary to deliver the analysis

No security system is impenetrable. While we take reasonable precautions, we cannot guarantee absolute security of your data.

10. International Transfers

Our services are hosted in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.