Privacy Policy

What we collect

When you create a Done-Deal account we collect your name, email address, and brokerage affiliation. When you add a transaction, we store the property address, contract dates, counterparty names and email addresses, uploaded documents, and communications drafted or sent through the platform. We also collect standard server logs (IP address, browser type, pages visited) for security and reliability purposes.

How we use it

We use your data solely to provide the Done-Deal service:

• —Running the AI transaction coordinator (Reme) on your active transactions
• —Calculating and tracking Colorado-specific deadlines
• —Drafting and sending emails, notifications, and signing requests on your behalf
• —Generating compliance tasks based on property characteristics
• —Sending you deadline alerts and approval requests

We do not sell, rent, or share your data with third parties for advertising or marketing purposes. We do not use your transaction data to train AI models without your explicit, opt-in consent.

Third-party services

Done-Deal uses the following sub-processors to deliver the service:

• —Supabase (Postgres database and authentication) — data stored in the United States
• —Anthropic (Claude AI for Reme's intelligence) — prompts include transaction context
• —Microsoft Graph API (Outlook email integration) — only for agents who connect their Outlook account
• —Render (cloud hosting) — United States
• —Redis / BullMQ (background job queue) — in-memory, not persisted beyond job lifecycle

Each sub-processor is contractually bound to handle your data only as directed by Done-Deal and not to use it for their own purposes.

Data security

All data is encrypted in transit (TLS 1.2+) and at rest. Portal signing links are unique, time-limited tokens — each link is tied to a specific signer and expires after the transaction closes. We log every portal access (IP, timestamp) for audit purposes. Internally, access to production data is limited to engineers on a need-to-know basis and requires multi-factor authentication.

Data retention

Transaction records are retained for 7 years after closing to support Colorado real estate compliance requirements. You may request deletion of your account and associated data at any time; we will honor the request within 30 days, subject to any legal hold obligations. Note that signed documents and audit logs for closed transactions may need to be retained for the full retention period regardless of account deletion.

Your rights

You have the right to:

• —Access the personal data we hold about you
• —Correct inaccurate data
• —Request deletion of your account and personal data
• —Export your transaction data in a machine-readable format
• —Opt out of any future use of your data for AI model training

Cookies

Done-Deal uses strictly necessary session cookies to keep you signed in. We do not use advertising cookies or third-party tracking pixels. Analytics, if enabled, use privacy-preserving, cookie-free methods.

Contact

Questions about this policy or requests regarding your data should be sent to: support@done-deal.co. We will respond within 5 business days.

Changes to this policy

If we make material changes to this policy, we will notify active users by email at least 14 days before the changes take effect. Continued use of Done-Deal after that date constitutes acceptance of the updated policy.