Privacy Policy

NestCalc.ai LLC dba CasaWise.ai ("CasaWise.ai," "we," "us," or "our") is a Wyoming limited liability company. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the CasaWise.ai web application (the "Service"). By using the Service, you consent to the practices described in this policy.

1. Information We Collect

Account Information

When you create an account, we collect your email address and an encrypted password. Authentication is managed by Supabase. We do not store your password in plaintext.

Property & Deal Data

You may enter property details such as address, purchase price, loan terms, rental income estimates, operating expenses, and investment strategy preferences. This data is stored in your Supabase account so you can save and retrieve analyses.

Payment Information

If you subscribe to a paid tier, payment is processed by Stripe. We do not receive or store your full credit card number. Stripe provides us with a tokenized reference, your subscription status, and billing history. See Stripe's Privacy Policy for details on how Stripe handles your payment data.

Usage Data

We automatically collect technical information such as browser type, device type, pages visited, and timestamps. This data helps us improve performance and diagnose issues.

Location-Related Data

When you enter a property address, we use a geocoding proxy to convert that address to geographic coordinates. The address is sent to our server, which forwards the request to Nominatim (OpenStreetMap) on your behalf. We do not share your IP address with Nominatim.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your subscription and manage your account
• Run investment calculations and generate deal projections
• Generate AI-powered deal narratives, market intelligence, and macro dashboards
• Fetch real-time economic data (mortgage rates, treasury yields) for your analyses
• Improve, personalize, and expand the Service
• Communicate with you about your account, updates, or support requests
• Detect and prevent fraud or abuse

3. Third-Party Services

We rely on the following third-party services to operate CasaWise.ai. Each service receives only the minimum data required to perform its function:

• Supabase — Authentication and database. Stores your account credentials (hashed), saved deals, and cached API responses. Hosted in the United States.
• Stripe — Payment processing for paid subscriptions. Receives your email and payment method. We never see or store your full card number.
• Perplexity Sonar — Market intelligence for paid tiers. Receives the property city and state to generate local market analysis. No personal data is sent.
• Anthropic Claude (Haiku) — AI deal narratives for paid tiers. Receives anonymized property metrics (numbers only, no address or personal data) to generate investment commentary.
• Google Gemini — Powers macro economic dashboards for all tiers. Receives economic indicator queries. No personal or property-specific data is sent.
• FRED API (Federal Reserve Economic Data) — Provides real-time treasury yields and mortgage rate data for all tiers. No personal data is sent.
• Nominatim / OpenStreetMap — Geocoding service accessed through our server-side proxy. Converts property addresses to coordinates. Your IP address is not forwarded to Nominatim.
• Netlify — Hosting and serverless functions. Serves the application and processes API requests. See Netlify's Privacy Policy.

4. Cookies & Local Storage

CasaWise.ai uses browser local storage (not traditional cookies) to:

• Maintain your authentication session (Supabase JWT token)
• Store your current deal inputs so they persist between page reloads
• Remember UI preferences (e.g., last active tab)

We do not use third-party tracking cookies. We do not use advertising cookies. If Stripe or Supabase set cookies for session management, those are governed by their respective privacy policies.

5. Data Retention

We retain your account data and saved deals for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., payment records for tax compliance).

Cached API responses (market data, macro dashboards) are stored in our database with a 6-hour time-to-live and are automatically overwritten. These caches contain no personal data.

6. Data Security

We implement reasonable technical and organizational safeguards to protect your data:

• All data in transit is encrypted via HTTPS/TLS
• Passwords are hashed by Supabase (bcrypt)
• API endpoints validate JWT tokens and request origin
• Payment data is handled entirely by Stripe (PCI-DSS compliant)
• Serverless functions enforce origin validation and authentication

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your personal data, subject to legal retention requirements.
• Portability — Request your data in a portable, machine-readable format.
• Opt-Out of Sale — We do not sell your personal data. We do not share your data with third parties for their marketing purposes.

California Residents (CCPA): You have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, contact us at privacy@casawise.ai.

European Residents (GDPR): If you are located in the European Economic Area, you have additional rights including the right to lodge a complaint with your local data protection authority. Our lawful basis for processing is contract performance (providing the Service) and legitimate interest (improving the Service).

8. Children's Privacy

CasaWise.ai is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@casawise.ai.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or an in-app notice. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: privacy@casawise.ai
• Mailing Address: NestCalc.ai LLC dba CasaWise.ai, 30 N Gould St Ste R, Sheridan, WY 82801
• Entity: NestCalc.ai LLC dba CasaWise.ai — a Wyoming limited liability company

Effective Date: March 30, 2026