Privacy Policy

Real Estate OS (“we”, “our”, or “us”) operates the betonassets.com platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, organization name, and role. If you use SSO, we receive profile data from your identity provider.

Property & Financial Data

You may upload or enter property details, deal information, lease agreements, financial transactions, accounting records, and investor information. This data is stored encrypted and is owned entirely by you.

Payment Data

Payment card details are processed directly by Stripe and are never stored on our servers. Bank account connections via Plaid use tokenized access — we never see your banking credentials.

Usage Data

We automatically collect information about how you interact with the platform, including pages visited, features used, browser type, IP address, and device information. This data is used solely for improving the service and is not sold.

2. How We Use Your Data

• Service Delivery — To provide, maintain, and improve the Real Estate OS platform.
• Analytics — To understand usage patterns and improve user experience.
• Communication — To send transactional emails (invitations, password resets, notifications) and, with your consent, product updates.
• Security — To detect, prevent, and respond to fraud, abuse, and security incidents.
• Legal Compliance — To comply with applicable laws, regulations, and legal processes.

3. Data Sharing

We do not sell your personal data. We share data only with the following SOC 2 Type 2 certified service providers who are necessary to operate the platform:

• Stripe — Payment processing
• Plaid — Bank account verification and linking
• Anthropic — AI-powered document analysis
• Resend — Transactional email delivery
• Sentry — Error monitoring and application stability
• OVH — Infrastructure hosting (EU, France)

Each vendor is bound by data processing agreements (DPAs) and processes data only as necessary to provide their specific service.

4. Data Retention

• Financial data — Retained for 7 years to comply with accounting and tax regulations.
• Audit logs — Retained for 7 years for compliance and forensic purposes.
• Application logs — Retained for 90 days, then automatically purged.
• Account data — Retained for the duration of your account, plus 30 days after deletion to allow recovery.
• Backups — Encrypted backups are retained for 30 days.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your personal data, subject to legal retention requirements.
• Export — Download all your data in standard formats (JSON, CSV, PDF) at any time from your account settings.
• Restriction — Request that we limit processing of your data in certain circumstances.
• Objection — Object to processing of your data for specific purposes.

To exercise any of these rights, contact us at privacy@betonassets.com. We will respond within 30 days.

6. Data Security

We implement comprehensive security measures to protect your data, including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA)
• Role-based access control (RBAC) with row-level security
• Regular security audits and vulnerability assessments
• Automated backups with encryption
• 24/7 infrastructure monitoring

For more details, visit our Security page.

7. Cookies

We use only essential cookies required for the service to function:

• Session cookie — Maintains your authenticated session. HttpOnly, Secure, SameSite=Strict.
• Theme preference — Stores your light/dark mode preference. Local storage only.
• CSRF token — Protects against cross-site request forgery attacks.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

8. Children's Privacy

Real Estate OS is a business-to-business platform designed for real estate professionals. Our service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we discover that a child under 18 has provided us with personal data, we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. For significant changes, we will also send an email notification to your registered email address.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: