Privacy Policy

Last updated: June 29, 2026

This Privacy Policy explains how CapScout ("we," "us," "our") — a service operated by [OPERATOR LEGAL NAME] — collects, uses, shares, and protects personal information. It applies to capscout.ai and the CapScout application (the "Service"). By using the Service you agree to this Policy and to our Terms of Service.

Information we collect

Account information you provide: name, email, and password (stored only as a salted hash). If you sign in with Google, we receive your basic Google profile (name, email) to create your account.
Investor profile and inputs: search criteria, buy-box and calculator assumptions, saved searches, favorites, and analysis requests.
Content you create: property notes, contacts/CRM records, organization branding, and report or document inputs.
Payment information: processed by our payment processor, Stripe. We receive limited billing details (such as plan, amount, and the last four digits and status of your card); we do not see or store full card numbers.
Usage and device data: pages and features used, analyses run, approximate location derived from IP, IP address, browser and device type, and similar log data, collected to operate, secure, and improve the Service.
Communications: messages you send us and your email preferences.
Information about other people: if you are an agent or team, you (and people who submit a lead through a shared report) may provide contact details about prospective clients ("leads"). See "Leads and information about others" below.

How we use information

We use personal information to: provide, secure, and operate the Service; generate analyses and reports; meter and process credits and payments; personalize outputs to your investor profile; provide customer support; send service and transactional messages; send marketing email where permitted (with opt-out); detect and prevent fraud, abuse, and security incidents; and comply with legal obligations. We do not use the protected characteristics of any individual to generate property scores or recommendations. We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising.

AI processing

To generate analyses, we share the minimum necessary property, market, and profile data with a third-party AI provider (currently Anthropic). We do not send your password or payment card details to AI providers. AI providers process this data to return analysis to us under their own terms and do not use it to train their public models where their terms so provide. AI output is informational only and is not professional advice (see our Disclaimers).

How we share information

We share personal information only as needed to run the Service or as required by law, including with service providers ("processors") who act on our behalf under contract:

Stripe — payment processing and billing.
Anthropic — AI analysis.
RentCast and public data sources (FEMA, U.S. Census Bureau, FHFA) — property, market, and neighborhood data.
Geoapify / mapping and Google (Street View) — geocoding and imagery.
Mailgun — transactional and notification email.
Hosting and infrastructure providers (e.g., our cloud host and CDN) — to run and deliver the Service.

We may also disclose information to comply with law or valid legal process, to enforce our Terms, to protect the rights, safety, and security of users or the public, and in connection with a merger, acquisition, financing, or sale of assets (in which case we will require the recipient to honor this Policy). Each provider handles data under its own terms.

Leads and information about others

If you use the white-label or lead-capture features, contact information you collect about prospective clients is provided to the agent or organization that captured it, and that agent or organization is the controller responsible for how it contacts and uses those individuals. We process that information on their behalf to deliver the Service (see the Data Processing terms in our Agent & White-Label Terms). If you submitted your information through a shared report, you may contact us to access or delete it, and we will route your request appropriately. We do not use lead data to generate property scores or for our own marketing.

Cookies and analytics

We use essential cookies and local storage to keep you signed in and operate the Service, and privacy-respecting analytics to understand aggregate usage. You can control cookies through your browser settings. We honor Global Privacy Control (GPC) signals as an opt-out of "sale"/"sharing" where applicable.

Data retention

We retain account, profile, and analysis data for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we delete or de-identify it. You can request deletion as described below; some records may be retained where the law requires.

Security and data-breach notice

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and vetting of service providers, consistent with the New York SHIELD Act and applicable law. No method of transmission or storage is perfectly secure. If a breach of your private information occurs, we will notify affected individuals and applicable authorities as required by law without unreasonable delay.

Your choices and rights

You can access, correct, export, or delete your account data, and opt out of marketing email at any time (use the unsubscribe link or contact us). To make a request, email [email protected]. We will verify your request and respond as required by law. We will not discriminate against you for exercising your rights.

U.S. state privacy rights (California and others)

Depending on your state (including California under the CCPA/CPRA, and similar laws in states such as Virginia, Colorado, Connecticut, Texas, and Utah), you may have the right to: know and access the personal information we collect; know the categories of sources, purposes, and third parties with whom we share it; correct or delete it; obtain a portable copy; and opt out of "sale" or "sharing" for targeted advertising and certain profiling. We do not sell personal information and do not share it for cross-context behavioral advertising.

For California residents, the categories of personal information we collect are described in "Information we collect" above (identifiers, customer records, commercial information, internet/usage activity, approximate geolocation, and inferences from your inputs). We use and disclose these for the business purposes described in this Policy and do not use sensitive personal information to infer characteristics. To exercise a right, email [email protected]; you may use an authorized agent. You may appeal a decision by replying to our response.

Children

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from anyone under 13; if you believe a child provided us information, contact us and we will delete it.

International users

The Service is operated from and intended for users in the United States, and information is processed in the United States. We do not target the Service to the European Union; if you access it from outside the U.S., you consent to processing in the U.S.

Changes

We may update this Policy. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice. Continued use after changes take effect constitutes acceptance.

Contact

Questions or requests? Email [email protected], or write to us at [OPERATOR POSTAL ADDRESS / PO BOX].

This document is a thorough starting point for a personal (sole-proprietor) launch under U.S. and New York law. Before go-live, (1) replace [OPERATOR LEGAL NAME] and [OPERATOR POSTAL ADDRESS / PO BOX], (2) confirm the named service providers match your live stack, and (3) have a licensed attorney review it. It is not legal advice.