Privacy Policy

1. Who We Are

Aletheia Technologies LLC is a Utah limited liability company that operates usealetheia.com, a platform that provides tools for buyers and sellers to structure and manage real estate transactions in Utah. We are not a real estate broker and do not provide legal, financial, or real estate advice. We are the data controller for personal information collected through the Platform.

2. Information We Collect About Registered Users

This section covers information we collect about people who create accounts on the Platform. For information we hold about people who have not registered, see Section 3.

2.1 Account Information

When you register, we collect: full name; email address; password (stored as a one-way bcrypt hash — we cannot read your password); phone number (optional; used for SMS notifications if you provide and verify it); mailing address (optional); date of birth (used only for age verification). We also store when you accepted the current version of these Terms and the Privacy Policy, so we can notify you when a new version requires your review.

2.2 Offer and Transaction Data

When you submit or respond to offers, we collect the fields you enter, including:

• Purchase price, earnest money amount, financing type, and contingency terms.
• Proposed closing and possession dates.
• Your legal name, address, phone, and email as entered on the offer form.
• Counter-offer terms, negotiation events, and offer status history.
• Transaction milestone and deadline records.

2.3 Financial Documents

The Platform allows you to upload documents supporting a transaction. These may include pre-approval letters, proof of funds letters, inspection reports, property disclosures, appraisal reports, and title documents. Pre-approval letters and proof of funds typically contain income, asset, credit, and lender information. We store these documents on your behalf and make them visible only to the parties in your transaction. We do not analyze or extract data from these documents beyond what is necessary to make them accessible through the Platform.

2.4 Generated Documents and Signatures

When a document is generated and signed through the Platform, we store:

• The generated purchase agreement or addendum PDF.
• An image of each party's drawn signature.
• The IP address and browser information of each signer at the time of signing.
• The date and time of each signature.
• A cryptographic record identifying the exact document version each party signed.

Once signed by all required parties, a document is frozen as an immutable record. Signature records and signed documents are retained for the period described in Section 6.

2.5 Showing and Open House Data

If you use the showing scheduling or open house tools, we collect: requested and confirmed showing dates and times; notes exchanged between buyer and seller about the showing; showing status; and open house visitor sign-ins including name and contact information provided at the door.

2.6 Communication Data

We store messages sent between buyers and sellers through the Platform's transaction messaging tools, questions buyers ask about a property, and answers sellers provide.

2.7 Technical and Usage Data

We automatically collect:

• IP addresses.
• Browser type and version (user agent strings).
• Device operating system.
• Session tokens stored as secure, HTTP-only cookies.
• Login timestamps and rate limit data to prevent brute-force attacks.
• Audit log entries for all significant Platform actions, including offer events, document signatures, milestone completions, and account changes.

2.8 Communication Preferences

We store your opt-in or opt-out status for marketing emails and SMS notifications.

2.9 Error and Diagnostic Data

When something on the Platform errors, we record a diagnostic entry so we can investigate and fix it. That entry includes which route or action failed, the error type, a sanitized description of what went wrong, a stack trace identifying where in our code the failure occurred, and — where relevant — your account ID and the transaction involved. The description is sanitized before it's stored: it never includes the literal content of what you submitted (for example, a value you typed into a form), only structural information about the failure itself.

This diagnostic data is visible only to Aletheia platform administrators. It is not shared with the other party to your transaction, and it is not used for any purpose other than fixing the underlying problem.

3. Information We Hold About Off-Platform Counterparties

3.1 Why We Create These Records

A real estate transaction involves two sides. When one party uses Aletheia to structure a deal and the other party is not on the Platform, we create a limited account record for the off-platform party so that their side of the transaction can be tracked accurately. We do this to make the transaction record complete — not to market to you or draw you into an ongoing relationship you didn't ask for.

3.2 What We Hold

The on-platform user provides your name and email address when logging the transaction. We store:

• Your name (as provided by the other party).
• Your email address (as provided by the other party).
• An internal account identifier linking your identity to the transaction or offer record.
• Any attestation records the on-platform user created about your off-platform actions (see Section 3.4).

We do not collect any other information about you unless you claim the account and register.

3.3 How We Use It

We use your name and email to: (a) identify you in the transaction record, and (b) send you one invitation email letting you know the deal was structured in Aletheia and offering you the option to view it. We do not use your information for marketing and we do not send follow-up emails unless you create an account.

3.4 Attestations About Your Off-Platform Actions

The on-platform user may create attestation records that assert facts about actions you took outside the Platform — for example, that you signed a document or sent an offer. Each attestation includes the affirmation text, the IP address of the person who created it, and a timestamp.

Aletheia stores these records as part of the transaction history. We do not investigate whether an attestation is accurate; we store what the recording user affirmed. Attestations are not findings of fact — they are records that an assertion was made.

3.5 Your Options

Claim the account. If you click the invitation link in the email and complete registration, your record becomes a full Aletheia account. You will be able to see the full transaction record, including any attestations recorded about you, and participate directly in the transaction through the Platform.

Do nothing. If you do not create an account, your name and email remain in the transaction record as the identified counterparty. No additional information is collected and you receive no further contact from us.

Contact us to dispute or correct the record. Email support@usealetheia.com. A member of our support team will investigate manually and respond within 30 days. There is no automated removal path.

What we can do depends on what we find:

• If the record is an error — your information was entered for the wrong person, or the underlying transaction does not exist — we will correct or remove it.
• If the record is tied to a real transaction in which the on-platform user identifies you as a party — we cannot unilaterally remove your identity from the record. Your name and email are part of what makes the transaction record accurate. We will explain what we found and what options, if any, are available to you.

In either case, we will tell you what we find. We will not leave a disputed record unaddressed.

3.6 Retention of Shadow Records

Shadow account records are retained as part of the transaction record for the period described in Section 6. If a shadow counterparty claims their account and later closes it, the account is anonymized using the same process described in Section 7.

4. How We Use Your Information

We use the information we collect to:

• Operate the Platform: create and manage your account, process offer submissions, facilitate negotiations, generate documents, and coordinate transactions.
• Maintain audit and legal records: create and preserve an event log of offer and transaction activity, including for use in potential legal proceedings. Audit writes are best-effort: if a write fails, the action still completes and no entry exists, so the log is a record of what was captured rather than a guarantee that every action was.
• Send transactional notifications: alert you to offer updates, status changes, deadline reminders, and other events in your transaction by email, and by SMS only if you have provided and verified a phone number.
• Send marketing communications: only to users who have opted in. You can opt out at any time. See Section 4.1.
• Prevent fraud and abuse: detect and respond to fraudulent activity, unauthorized access, and security incidents through IP monitoring, rate limiting, and audit logging.
• Comply with applicable law: respond to valid legal process and comply with applicable federal and state law, including fair housing law and electronic records requirements.
• Improve the Platform: understand how the Platform is used in aggregate to identify and fix problems.

4.1 Marketing Communications

We send marketing emails and product announcements only if you opted in during registration or through your account settings. You may opt out at any time by: clicking the unsubscribe link in any marketing email; updating your preferences in account settings; or emailing support@usealetheia.com.

Transactional notifications (offer received, offer accepted, deadline reminders, and similar) are not marketing and cannot be turned off while your account is active. They are necessary for the Platform to function.

5. How We Share Your Information

5.1 With the Other Party in Your Transaction

Offer data is visible to the buyer who submitted the offer and the seller who received it. When an offer creates a transaction, both parties can see the full offer record, signed documents, and transaction timeline. Attestations created by one party are visible to both parties in the transaction.

5.2 With Service Providers

We share data with the following service providers who help us operate the Platform:

• Resend (email delivery) — receives your email address and name to deliver transactional emails and, if you opted in, marketing communications. United States.
• Twilio (SMS delivery) — receives your phone number to deliver text notifications, but only if you provided and verified a phone number. United States.
• Supabase (database and file storage) — hosts the database and stores uploaded documents. All Platform data passes through Supabase. United States.
• Upstash (rate limiting) — receives IP-based identifiers to enforce rate limits on API requests and prevent abuse. Does not receive personal profile information. United States.
• Vercel (hosting and deployment) — hosts the Platform and processes all incoming requests. All traffic passes through Vercel infrastructure. United States.

Our service providers are contractually required to protect your data and may not use it for their own purposes.

5.3 Partner Services

If we ever introduce a feature where connecting with a partner service (such as a title company or lender) would result in sharing your information with a business we have a financial relationship with, we will clearly disclose that relationship at the time and before any sharing occurs. You will never be required to use a partner service. We have no such arrangements currently in place.

5.4 Legal Requirements

We may disclose information if required by a valid court order, subpoena, or other lawful legal process, or if we believe disclosure is necessary to protect the rights, safety, or property of Aletheia, our users, or the public.

Our default posture is to notify you before disclosing your information in response to legal process, so that you have the opportunity to respond. We will not be able to do so if we are legally prohibited from notifying you (for example, under a court-ordered gag provision), if the matter involves an emergency involving risk of harm, or if we are unable to reach you at the contact information on file.

5.5 Business Transfers

If Aletheia is acquired by or merges with another company, your information may be transferred as part of that transaction. We will notify you by email or Platform notice before your data is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain your account information for as long as your account is active. When you close your account, we anonymize your profile (see Section 7 for the exact mechanism). After anonymization, we retain the following for six years from the date of the last transaction activity:

• Transaction records, offer data, and negotiation history.
• Signed documents and signature records (drawn signature image, IP address, timestamp).
• Audit trail entries for all significant Platform actions.
• Attestation records.
• Uploaded documents associated with completed transactions.

Retained records are not used for marketing and are not shared except as described in Section 5.

7. Account Closure and Data Anonymization

When you close your account through the account settings page, we anonymize your user record. We do not delete the record outright because transaction history, offer records, signatures, and audit logs reference it and must be retained. Instead, we clear the identifying fields and make the account inaccessible.

7.1 What Gets Cleared

The following fields are cleared when you close your account: email address (replaced with an internal “deleted” placeholder that cannot receive email and cannot be used to log in); password (replaced with a randomly generated, unusable hash); name (replaced with “Deleted User”); phone number; mailing address; date of birth; all account verification tokens and codes; any professional or company information fields.

7.2 What Persists

The user row itself persists as an anonymized skeleton. The internal user ID is required to maintain referential integrity with transaction records. The account creation date is not cleared. Offer records, transaction records, signed documents, audit logs, and attestations linked to that user ID are retained for the six-year period described in Section 6.

Open offers involving your account are withdrawn automatically when you close your account, and the other party is notified. Draft offers you never submitted are deleted entirely.

8. Data Security

We implement technical and organizational security measures appropriate to the sensitivity of the data we hold. Specifically:

• Encryption in transit: all data transmitted between your browser and the Platform is encrypted via HTTPS/TLS.
• Password storage: passwords are stored using bcrypt hashing. We cannot read your password.
• Session security: session tokens are stored in secure, HTTP-only cookies with proper expiration.
• Access controls: role-based access controls limit what data users can see to the transactions and offers they are a party to.
• Rate limiting: login attempts and sensitive API requests are rate-limited to limit brute-force attacks.
• File storage: uploaded documents are stored in private storage with access controlled by signed, time-limited URLs.
• Audit logging: all significant Platform actions are logged with timestamps and IP addresses.

No security system is perfect. We cannot guarantee that unauthorized access will never occur. If you believe your account has been compromised, contact us immediately at support@usealetheia.com.

9. Your Rights

You have the following rights regarding your personal information. To exercise any of them, contact us at support@usealetheia.com. We will respond within 30 days.

• Access: you may request a copy of the personal data we hold about you. This covers your account profile, offer and transaction records, uploaded documents, signature records, messages, and audit log entries associated with your account. If any part of it cannot be provided in an exportable form, we will tell you what and why.
• Correction: you may update inaccurate information through your account settings or by contacting us.
• Deletion: you may close your account through the account settings page. See Section 7 for what actually happens. We retain transaction records, signed documents, and audit logs for the period described in Section 6. Closing your account does not erase those records.
• Opt-out of marketing: you may opt out of marketing communications at any time as described in Section 4.1.

10. Children's Privacy

The Platform is for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us at support@usealetheia.com and we will promptly close it.

11. Utah Privacy Law

If you are a Utah resident, the Utah Consumer Privacy Act (UCPA) may grant you rights regarding your personal data. We do not sell personal data. To inquire about your rights under the UCPA, contact support@usealetheia.com.

12. California Privacy Rights

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we have collected about you, the right to request deletion of your personal information, and the right to opt out of any sale of your personal information. We do not sell personal information. To exercise CCPA rights, contact us at support@usealetheia.com. We will respond to verifiable requests within 45 days.

13. Cookies and Tracking

We set authentication cookies: a session token that keeps you logged in, and a CSRF token used during sign-in to protect against cross-site request forgery. Both are secure and HTTP-only. We do not use third-party advertising cookies, tracking pixels, or analytics services that share data with third parties. Disabling cookies in your browser will prevent you from logging in to the Platform.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on the Platform at least 14 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.