Privacy policy

Information you give us directly

• Account information. When you register, we collect your name, email address, company name, and professional role (e.g., broker, landlord, investor, advisor).
• Search and report inputs. When you use the Service, we store the property addresses you search, the tenants you select, and any notes or configurations you enter.
• Vacancy and outreach data. If you use the leasing and outreach features, we store vacancy details you enter, including square footage, space format, space tags, and notes.

Information generated by the Service

• Reports. We store the reports we generate on your behalf, including AI-generated analysis (health scores, strategy, category recommendations), demographic data, and tenant information.
• Billing metadata. If you purchase a subscription or credits, Stripe processes your payment. We receive and store metadata about your transactions (plan type, subscription status, subscription dates, credit balance) but do not store full credit card numbers or raw payment credentials.

Information collected automatically

• Usage data. We collect information about how you interact with the Service — pages visited, buttons clicked, time spent, and error events. This helps us improve the product and diagnose problems.
• Technical data. Standard web server logs including IP address, browser type and version, operating system, and referring URL.

Cookies and browser storage

• Session cookies. We use a secure, HTTP-only cookie to maintain your login session. This is required for the Service to function.
• sessionStorage. We use browser sessionStorage to temporarily remember your current property search and tenant selections within a tab session. This data lives only in your browser and is cleared automatically when you close the tab. It is never sent to our servers.
• localStorage. We use browser localStorage to save UI preferences that persist across sessions, such as whether the sidebar is collapsed and the number of vacancy rows you have configured for a property. This data lives only in your browser.

We do not use third-party advertising cookies or cross-site tracking cookies.

We use the information we collect to:

• Provide the Service. Your property address, selected tenants, and vacancy data are passed to third-party service providers to generate your report.
• Operate and improve the Service.Usage data helps us understand what's working, fix bugs, and prioritize new features.
• Manage your account and billing. We use your account information to authenticate you, track your credit balance, and manage your subscription via Stripe.
• Send transactional emails. We send emails for account confirmation, password reset, and billing receipts via Resend. These are required for the Service to function and cannot be opted out of while your account is active.
• Prevent abuse. We monitor for patterns that suggest unauthorized use, scraping, or policy violations.
• Respond to support requests. If you contact us, we use the information you provide to respond.

We do not sell your personal information. We do not share your data with advertisers or data brokers.

We use third-party service providers to operate the Service. Payments are processed by Stripe; property addresses and location data are processed by Google. We also work with additional providers for hosting, AI analysis, mapping, and communications — each receives only the data necessary to perform its function and is subject to its own privacy policy.

We are not responsible for the data practices of these providers beyond what our service agreements specify.

Each report is accessible via a unique, unguessable link (a UUID). Anyone who has the link can view the report without logging in — this is by design, to make it easy to share reports with clients.

If you share a report link, anyone with that link can view the full contents of the report, including the property address, tenant analysis, and any vacancy or strategy information. We do not restrict or track access by link recipients.

Treat report links as confidential documents. Once shared, we cannot retrieve or restrict access to a link. If you need to prevent access to a report, contact us to request deletion.

We retain your account information and report data for as long as your account remains active.

If you request account deletion, we will delete your personal information within 30 days, except where we are legally required to retain it (for example, Stripe transaction records for financial compliance purposes).

Cached data from third-party APIs — including tenant research, demographic data, and mirror property search results — may be retained in our database for 30–90 days as part of normal caching operations that allow us to reduce API costs and improve response times. This cached data does not include your personal information; it contains only the third-party data results keyed by geographic location.

Access and correction. You can view and update your account information (name, company, role) at any time on the Account page within the Service.

Account deletion. To delete your account and request removal of your personal data, email us at hello@yellowbrickretail.com. We will process deletion requests within 30 days.

Data portability. If you would like a copy of your report data in a machine-readable format, contact us at hello@yellowbrickretail.com.

Email opt-out. While your account is active, you will receive transactional emails (password reset, billing receipts). If we send promotional or marketing emails in the future, they will include an unsubscribe link.

California residents (CCPA/CPRA). If you are a California resident, you have the right to: (1) know what personal information we collect and how we use it; (2) request deletion of your personal information; (3) correct inaccurate personal information; and (4) opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising purposes). To exercise these rights, contact us at hello@yellowbrickretail.com. We will not discriminate against you for exercising your privacy rights.

We use industry-standard security practices, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Row-level security (RLS) policies on our database so users can only access their own data
• Secure, HTTP-only cookies for session management
• Bcrypt-based password hashing (managed by Supabase Auth)
• Multi-factor authentication on administrative accounts

No security system is perfect. We cannot guarantee that unauthorized parties will never be able to circumvent our measures. If you discover a potential security vulnerability, please disclose it to us responsibly at hello@yellowbrickretail.com before making it public. We appreciate responsible disclosure.

The Service is intended for commercial real estate professionals and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at hello@yellowbrickretail.com.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to your registered address and/or by a prominent notice within the Service. Your continued use of the Service after such notice constitutes your acceptance of the updated policy.

The “Last updated” date at the top of this page always reflects the date of the most recent revision.

Privacy questions, data access requests, or deletion requests: hello@yellowbrickretail.com
Yellowbrick Technologies, Inc.