Privacy Policy

1. Introduction

This Privacy Policy outlines how Fossa Media Ventures dba SFR Analytics ("we," "us," "our") collects, uses, and protects personal information when you use our websites (including sfranalytics.com, app.sfranalytics.com, mcp.sfranalytics.com, and any subdomains thereof), our APIs, our MCP (Model Context Protocol) integrations, or interact with us directly through customer support channels, social media, or other means of communication.

This Privacy Policy applies to two categories of individuals: (1) users of our platform and services ("Platform Users"), and (2) individuals whose information appears in our real estate and lending datasets ("Data Subjects"), such as property owners, borrowers, lenders, and other real estate professionals. We are committed to respecting your privacy and ensuring that personal information is handled in accordance with applicable laws, including the California Consumer Privacy Act (CCPA/CPRA) and other applicable federal and state privacy laws.

2. Information We Collect

2.1 Information Platform Users Provide

Account-related information:

• Name, email address, mailing address
• Phone number
• Payment information
• Account preferences and settings

Property and investment information:

• Property listing details and specifications
• Property ownership information
• Transaction history
• Investment criteria and preferences
• Supporting documentation for property verification

Communication preferences:

• Newsletter subscriptions
• Marketing preferences
• Notification settings

2.2 Information from Your Use of Our Services

When you visit our websites or use our services (including via API or MCP), we automatically collect:

Technical information:

• IP address
• Browser type and AI client metadata
• Device information
• Operating system
• Referral URLs

Usage information:

• On-site behavior and search patterns
• Property viewing history and saved listings
• Notification preferences

API and MCP usage information:

• API key and account identifiers
• Tool invocations and request parameters
• Timestamps and response metadata
• Performance and error logs
• Usage volumes and billing events
• Subscription tier and saved preferences

2.3 Information from Third Parties

We may receive information from:

• Social media platforms
• Market research partners
• Service providers
• Property ownership databases and public records
• Market analysis data providers
• Property condition inspectors
• Title companies and escrow services
• Real estate agent and broker verification services
• Lending and mortgage data providers

This information may include:

• Demographic information
• Device information
• Location information
• Property ownership records
• Market analysis data
• Property condition reports
• Title and escrow information
• Professional credentials

2.4 Information About Individuals in Our Real Estate and Lending Datasets

Our Services include databases containing information about real estate market participants, including property owners, borrowers, lenders, and other professionals. This information is compiled from public records, publicly available sources, data vendors, and customer submissions, and may include:

• Identifiers and contact information: names, business entity names, email addresses, phone numbers, mailing addresses, and social media profile URLs
• Professional and commercial information: borrower or lender role, institutional activity, property ownership, transaction history, loan history, and market participation
• Derived analytics and inferences: verification status, relationship mapping, activity summaries, and market-participation metrics

Sources for this data include county recorder offices, property tax assessor records, mortgage and deed filings, publicly available business registrations, licensed data vendors, and customer-submitted information.

3. How We Use Your Information

Core Service Operations

• Manage your account
• Provide customer support
• Process transactions
• Improve our website and services
• Facilitate secure communication between parties
• Maintain accurate property status and availability

Property Listing and Deal Management

• Verify and list off-market properties
• Match properties with qualified investors
• Generate market analysis reports
• Prevent fraudulent listings or transactions
• Maintain listing accuracy and status

API, MCP, and AI Integration Services

• Authenticate API keys and user accounts
• Deliver data through API and MCP interfaces
• Personalize responses based on subscription tier, saved preferences, and usage history
• Monitor for abuse, fraud, and security threats
• Measure usage for billing purposes
• Develop aggregated or de-identified analytics to improve the Services
• Provide technical support and troubleshoot issues

Communication and Marketing

• Communicate about your account
• Send service updates
• Deliver promotional offers
• Provide market insights and reports
• Facilitate communication between interested parties

Security and Compliance

• Detect and prevent fraud
• Respond to illegal activities
• Enforce our terms of service
• Comply with legal requirements
• Maintain audit trails
• Protect sensitive information

Analytics and Service Improvement

• Analyze service usage patterns
• Improve user experience
• Develop new features
• Optimize matching algorithms
• Enhance security measures

4. Sharing Your Information

Service Providers

We share information with companies that provide:

• Payment processing
• Data analysis
• Email delivery
• Hosting and infrastructure services
• Customer service
• Property verification services
• Title and escrow services
• Observability, logging, and security monitoring
• Billing and usage analytics

Third-Party AI Services

When you access our Services through third-party AI assistants or platforms (such as Claude, ChatGPT, Cursor, or similar tools), your prompts, tool requests, and our responses may be received and processed by those third-party providers under their own terms and privacy practices. SFR Analytics does not control and is not responsible for the privacy practices, data retention policies, or model-training practices of third-party AI services. You are responsible for reviewing the privacy practices of any third-party AI service you use to access our data.

Subscribers and Authorized Users

Information in our real estate and lending datasets, including contact information, property records, and lending history, is made available to our subscribers through our platform, APIs, and MCP integrations in accordance with their subscription terms. Subscribers are bound by our Terms & Conditions, including restrictions on outreach, redistribution, and AI/model use.

Deal-Specific Information Sharing

We share property and transaction information with:

• Verified investors matching listing criteria
• Property owners and authorized representatives
• Licensed real estate professionals
• Title companies and escrow agents
• Regulatory authorities as required

Legal Requirements

We share information:

• In response to legal requests
• To comply with court orders
• To meet government regulations
• To protect legal rights

Business Transfers

Information may be shared during:

• Merger negotiations
• Company asset sales
• Financing arrangements
• Business acquisitions

Consent-Based Sharing

Information is shared:

• With your explicit consent
• At your direction
• For public posts or reviews
• According to your privacy settings

5. Data Protection and Security

Technical Measures

We implement administrative, technical, and physical safeguards to protect information, including encryption in transit, access controls, secure document storage, and regular security reviews.

Cookie Usage

We use cookies and similar technologies to improve our services. You can manage your cookie preferences through your browser settings.

Data Retention

We retain different categories of information for different periods based on the purpose of collection:

• Account information: Retained while your account is active and for a reasonable period after closure for legal and compliance purposes.
• API and MCP usage logs: Request-level logs are retained for a limited period for debugging and abuse detection. Aggregated and de-identified usage analytics may be retained indefinitely.
• Billing records: Retained as required by applicable tax and financial regulations.
• Real estate and lending dataset records: Retained and updated on an ongoing basis as part of our core data products. Records may be corrected or removed in response to verified requests.
• Support and communications records: Retained for a reasonable period to provide ongoing support and comply with legal obligations.

6. Your Privacy Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information. These rights apply to both Platform Users and individuals whose information appears in our datasets.

6.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Right to Know / Access: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected about you, subject to certain legal exceptions (such as completing a transaction, complying with legal obligations, or exercising free speech).
• Right to Correct: Request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: If we sell or share your personal information (as defined under the CCPA), you have the right to opt out. See "Do Not Sell or Share My Personal Information" below.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

6.2 How to Submit a Request

To exercise any of the rights described above, you may submit a request by:

• Emailing us at privacy@sfranalytics.com
• Writing to us at the address listed in Section 8 below

We will verify your identity before processing your request and will respond within 45 days (or up to 90 days with notice if additional time is needed). You may designate an authorized agent to submit a request on your behalf by providing written authorization.

6.3 Do Not Sell or Share My Personal Information

SFR Analytics makes real estate and lending data available to subscribers through our platform, APIs, and MCP integrations. To the extent that making this data available to subscribers constitutes a "sale" or "sharing" of personal information under the CCPA, individuals whose information appears in our datasets may opt out by contacting us at privacy@sfranalytics.com with the subject line "Do Not Sell or Share."

6.4 Other Jurisdictions

If you are located in another jurisdiction with applicable privacy laws, you may have additional or different rights. Please contact us at the email address above to discuss your specific rights and how we can assist you.

7. Individuals in Our Datasets

If your personal information (such as your name, contact information, property records, or lending history) appears in our real estate and lending datasets, you may exercise the rights described in Section 6 above. We compile this information from public records, publicly available sources, licensed data vendors, and customer submissions for the purpose of providing real estate market intelligence to our subscribers.

If you believe information about you in our datasets is inaccurate or you would like to request correction or deletion, please contact us at privacy@sfranalytics.com with sufficient information for us to locate your records (such as your name, state, and the nature of the inaccuracy).

8. Contact Information

For privacy-related inquiries, rights requests, or questions about this Privacy Policy:

9. Children's Privacy

• Services not directed to users under 16
• No knowing collection of children's data
• Prompt deletion if discovered
• Contact us regarding underage data

10. Changes to Privacy Policy

• Regular policy updates as needed
• Notification of significant changes via email or prominent notice on our website
• Updated policy posted on website with revised "Last Updated" date

11. Consent

By using our Sites, APIs, MCP integrations, or other services, you consent to:

• Data collection and use as described in this Privacy Policy
• Cookie usage
• Information sharing as outlined
• Service Telemetry collection for API and MCP access
• Policy updates

This Privacy Policy is effective as of March 6, 2026, superseding all previous versions.