Institutional Privacy Policy

1. Information We Collect

We collect and process the following categories of information to provide institutional underwriting and modeling services:

• Account & Identity Credentials: User email addresses, authentication identifiers, full names, corporate organizational affiliations, and primary entity linkages.
• Project & Underwriting Datasets: Property addresses, county parcel numbers, purchase prices, capitalization rates, square footage, unit counts, unit-mix rental schedules, debt financing parameters, expense ratios, and waterfall structures.
• Transactional Billing Records: Subscription tier, billing cycle records, invoice receipts, and tokenized payment identifiers handled securely through payment processing partners (including Stripe). We never store raw credit card numbers or bank credentials on MathTree servers.
• System Telemetry & Diagnostics: IP addresses, browser user-agents, calculation latency metrics, and error logs required for platform security and performance optimization.

2. How We Utilize Information & Market Heat Maps

Information collected by MathTree is utilized for the following operational and commercial purposes:

• Core Financial Modeling: Generating 10-year pro-formas, debt amortizations, waterfall distribution hurdles, and stochastic Monte Carlo simulations requested by users.
• MathTree Market Heat Maps & Commercial Intelligence (Free Tier): For users on the Free (Community) Tier, property addresses, modeling frequency, valuation metrics, asset classes, and buyer interest signals are aggregated into dynamic market heat maps and deal flow indices. MathTree may commercialize, syndicate, or license these aggregated property intelligence feeds to third parties, institutional investors, and lenders.
• Confidential Exemption for Paid Accounts: Properties, rent rolls, and underwriting models saved by active Premium / Enterprise subscribers are strictly excluded from all heat maps, public indices, and commercial data feeds.
• Authentication & Row-Level Security: Verifying user sessions and enforcing multi-tenant database row-level security (RLS) policies.
• Administrative Notifications: Transmitting essential account alerts, subscription invoicing, security notifications, and platform maintenance updates.

3. Security Architecture & Data Governance

MathTree is hosted on secure enterprise cloud infrastructure utilizing industry-standard encryption in transit (TLS) and storage-level encryption at rest. Customer data is isolated between accounts using database row-level security controls to support real-time underwriting calculations and platform operations.

• Encryption in Transit: All communications between client terminals and MathTree cloud endpoints are encrypted using modern TLS protocols.
• Storage-Level Encryption at Rest: Cloud databases, persistent storage volumes, and automated backup snapshots utilize managed storage-level encryption via our enterprise cloud infrastructure providers.
• Multi-Tenant Row-Level Security (RLS): Projects, financial models, and profile data are protected by database row-level security policies, ensuring no user can query or modify data belonging to another account.
• Inactivity Session Protection: Unattended terminals automatically lock or expire after 30 minutes of idle time to prevent physical terminal compromise.

4. Third-Party Sub-Processors

We engage select enterprise infrastructure partners strictly to fulfill cloud computing and authentication obligations:

• Supabase (PostgreSQL & Auth): Secure database hosting, session token verification, and RLS enforcement.
• Google Cloud / Firebase Hosting: Content distribution, static edge hosting, and TLS certificate termination.
• Stripe: PCI-DSS Level 1 certified subscription payment orchestration.

Each infrastructure partner is bound by strict Data Processing Agreements (DPAs) requiring enterprise-grade security controls.

5. California Privacy Disclosures (CalOPPA, CCPA & CPRA)

Pursuant to California privacy statutes, California residents have specific statutory rights:

• Right to Know & Access: You may request disclosure of personal identity credentials collected about your account.
• Right to Delete: You may request the deletion of your account and associated deal records, subject to statutory retention obligations.
• Commercial Data & Opt-Out Rights: MathTree does not sell personal identity credentials (such as your personal name, personal phone number, password hashes, or billing card details). However, underwriting activity, property addresses, and market parameters submitted on our Free Tier are utilized to generate commercial heat maps and market intelligence products. You have the right to opt out of data aggregation by upgrading to our Premium Confidential Tier or by requesting account closure.
• Do Not Track: We do not track users across third-party websites or online services.

6. European Union & UK Disclosures (GDPR & UK-GDPR)

For users located within the European Economic Area (EEA) or the United Kingdom, MathTree processes data based on: (a) performance of our contract with you; (b) compliance with statutory obligations; and (c) legitimate commercial interests in securing and maintaining platform reliability.

You possess rights of access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint with a supervisory authority.

7. Data Retention & Permanent Erasure

Underwritten deals, pro-forma models, and associated financial records remain stored within your account tenancy until deleted by your authorized administrators. Upon explicit account closure or written erasure request, all associated proprietary records will be permanently purged in accordance with standard enterprise data deletion cycles.

8. Data Protection Officer & Inquiries

For questions regarding data processing practices, privacy rights requests, or commercial data exemptions, contact our Data Protection and Governance team at aidanfranklin45@gmail.com.