Privacy Policy

Effective: October 13, 2026

This Privacy Policy describes how VisionCore LLC (“VisionCore,” “we,” or “us”) collects, uses, and shares information when you use Basis (the “Service”). By using the Service you agree to the practices described here.

1. Information We Collect

Account & Identity Data

When you register we collect your email address, name (if provided), authentication identifiers (including OAuth tokens if you sign in with Google), and workspace membership details.

Deal & Property Data You Enter

Any property addresses, deal notes, financial assumptions, contact information, file attachments, and other data you create or import into the Service is stored on your behalf. You own this data; we process it only to provide the Service to you.

Third-Party Enrichment Data

When you trigger a lookup the Service retrieves data from third-party providers and stores the result in your account. This includes:

  • Property records & valuations: RentCast (AVM, rent estimates, comps, listings)
  • Ownership, liens & distress flags: BatchData (ownership, pre-foreclosure, liens, tax default, skip-trace)
  • Photos & listing facts: HasData via Zillow and Redfin (photos, interior features, price history)
  • Maps & Street View: Mapbox and Google Maps Platform
  • Hazard & location data: the U.S. Census Bureau Geocoder and FEMA's National Risk Index. To return a hazard profile we send the property address to the Census Geocoder to resolve it to a census tract, then query FEMA for that tract. These are public government APIs and receive the address only - never your identity, account, or deal figures.

Skip-trace results may include personal contact information (phone numbers, email addresses) sourced from public and licensed records by BatchData. See Section 5 for your obligations when using this data.

AI Processing

Several features are powered by a large language model operated by Anthropic. When you use one of them, the relevant content is transmitted to Anthropic's API to generate the result:

  • AI analyst memos - the deal's property facts and financial assumptions.
  • AI chat - the messages you send, recent messages from the same chat, and the deal details the assistant reads to answer (addresses, statuses, saved figures and notes). Contacts' phone numbers and email addresses are not sent.
  • Deal import - the text, spreadsheets, or documents you paste or upload for extraction.
  • Rehab estimates - the property photos you select, including your own walkthrough photos, together with the property facts.
  • Email deal capture - if you forward or route email to your Basis address, the sender address, subject, message body, and supported attachments are sent for extraction. Email you forward may contain other people's personal information; you are responsible for having a lawful basis to forward it.

Anthropic processes this content to return the result and, under the commercial API terms we use, does not use it to train its models. We store the generated output in your account. Rehab estimates are additionally cached against the photo set so that reopening a deal does not re-run (and re-bill) the same analysis - see Section 6. AI output is generated by a statistical model, may be wrong, and is not professional advice; see our Terms of Service.

Communication Data

If you enable SMS notifications, we collect your mobile phone number and store a timestamped record of your opt-in consent. Email addresses are used to send account, security, and operational notifications via Resend.

Usage & Operational Data

We collect server-side logs of API requests (type, status, timestamp) to meter usage against your plan's monthly allowances, enforce rate limits, detect abuse, and diagnose errors.

Error monitoring. Crash and error reports are sent to Sentry. These include the error and stack trace, your account and workspace identifiers, and a sampled performance trace. Sentry's session replay is enabled with all text masked and all media blocked, so a replay records the shape of an interaction - which elements were clicked, in what order - rather than the deal figures, addresses, or notes on screen.

Product measurement. We record a small set of first-party events in our own database to understand where the product is failing people: when a plan limit blocks an action, and when a checkout is started. On first arrival we also store the campaign parameters in the link you followed, the host of the referring site, and the page you landed on, and attach them to your account once at signup. We record the referring host only, never the full referring URL, which can carry personal information in its own query string.

We do not run behavioral analytics (e.g. Google Analytics), and we do not use cross-site retargeting or ad personalization. We do use Google Ads' and OpenAI/ChatGPT's own conversion tags to measure whether an ad click led to a signup - see our Cookie Policy for exactly what those set and how to control them. Because we don't use cross-site behavioral advertising, the Service does not respond differently to browser “Do Not Track” signals.

2. How We Use Information

  • To create and manage your account and workspace.
  • To store the deals, contacts, and files you create.
  • To fetch and display property enrichment data you explicitly request.
  • To generate the AI features you invoke - AI chat, analyst memos, deal import extraction, rehab estimates, and email deal capture - as described in Section 1.
  • To send transactional emails (account confirmation, security alerts, team invitations).
  • To deliver SMS alerts you have opted in to receive (see our SMS Terms).
  • To meter API usage against your subscription plan's monthly allowances.
  • To detect abuse and maintain the reliability and security of the Service.
  • To measure whether a Google Ads or OpenAI/ChatGPT ad campaign led to a signup (conversion tracking only - see our Cookie Policy).

We do not sell personal information, and we do not use your personal data to target or personalize ads to you.

3. How We Share Information

We share data only with the sub-processors required to operate the Service. Each receives only the minimum data necessary for the specific function:

  • Supabase - database hosting, authentication, and file storage (data stored in the U.S.)
  • Anthropic - AI processing for the features listed in Section 1, including deal content, uploaded documents, forwarded email, and property photos
  • Stripe - subscription billing and payment processing. Card details are collected and stored by Stripe; we never receive or store your full card number.
  • Resend - transactional email delivery
  • Twilio - SMS message delivery
  • Lovable - hosting of the web app, and the connector gateway our SMS messages pass through on their way to Twilio (your phone number and the message text)
  • OpenAI - interpreting the text of SMS replies you send us (for example, a reply to a deal alert), when that feature is enabled; the message text only
  • Cloudflare - bot protection (Turnstile) on the sign-in and sign-up pages
  • GitHub - internal review of feedback you submit in the app; the feedback text is filed in our private issue tracker
  • Mapbox / Google Maps Platform - map tiles and Street View images
  • RentCast, BatchData, HasData - property data lookups you initiate
  • U.S. Census Bureau / FEMA - public hazard-risk lookups (property address only)
  • Sentry - error monitoring, performance sampling, and masked session replay, as described in Section 1
  • Google Ads, OpenAI - ad conversion measurement (page views and signup events only; see our Cookie Policy). This is separate from OpenAI's SMS role above.

We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of VisionCore, our users, or others.

4. Shared Deal Links

When you generate an investor-facing share link, the deal data visible through that link is accessible to anyone who has the URL. You control what is shared and can revoke access at any time from Settings → Team → Shared deal links. We count how many times a link is opened and can notify you when one of your links is viewed; we do not record who the viewer is.

5. Owner-Contact & Skip-Trace Data

Owner contact information returned by skip-trace providers is sourced from public and licensed records. You may only use it for permissible business-to-business real-estate outreach in accordance with the provider's terms and all applicable laws, including the TCPA, CAN-SPAM Act, CCPA/CPRA, and any state consumer-data or do-not-call regulations. You are solely responsible for scrubbing contact lists against Do-Not-Call registries and honoring opt-out requests before making any contact.

6. Data Retention

Your account and deal data are retained for as long as your account is active. You can delete your account yourself at any time from Settings → Data & account, which removes your rows, your uploaded files, and your login, and cancels any active subscription. If you ask us to delete your account instead, we will do so within 30 days. In either case we may retain records where retention is required by law or for a legitimate business necessity - principally billing and tax records held by us or by Stripe.

Other categories are retained as follows:

  • Provider request logs (which lookups ran, their status and cost) - retained for approximately six months, then pruned automatically. These logs are what your plan's usage meters and spend summary are calculated from.
  • Cached enrichment results (listing photos, Street View imagery, property facts) - refreshed on a rolling basis and retained up to about 30 days, to avoid paying a provider twice for the same answer.
  • Cached AI rehab estimates - kept for as long as the deal they belong to exists, because the cache is keyed to a specific set of photos rather than to a date. Deleting the deal or your account deletes them.
  • AI chat history - kept until you delete the chat or your account. Our usage logs record that a message was sent and which tools answered it, not what it said.
  • SMS consent records - retained after opt-out as proof that consent was given and revoked, which telecom regulations require us to be able to evidence.

7. Security

All data is encrypted in transit (TLS) and at rest. Row-level security in our database isolates each workspace so that one account cannot access another's data. We use short-lived authentication tokens and do not store passwords in plain text. Despite these measures, no system is perfectly secure; you use the Service at your own risk.

8. Your Rights

You have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate personal data.
  • Delete your account and associated personal data - available to you directly in Settings → Data & account, without needing to ask us.
  • Export your workspace data in a portable format, also from Settings → Data & account.
  • Opt out of SMS notifications at any time (reply STOP or revoke in Settings).

The export and deletion controls are self-serve, so you do not have to wait on us to exercise those two rights. For anything else - or if you would rather we handle it - email visioncorehq@gmail.com. We will respond within 30 days.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), gives you the rights described below in addition to those in Section 8.

Categories of Personal Information We Collect

In the preceding 12 months we have collected the following statutory categories of personal information, as described in Section 1:

  • Identifiers - name, email address, account identifiers, IP address.
  • Customer records - phone number (if you opt in to SMS), billing and payment details processed by Stripe.
  • Commercial information - subscription plan, billing history, API usage.
  • Internet/network activity - login times, API request logs, error and performance reports, masked session replays, first-party product events, and ad-conversion measurement as described in Section 1.
  • Personal information you choose to enter or that a lookup you initiate returns - deal and property data, contacts, and owner-contact/skip-trace results as described in Section 1.
  • Visual information - property photos you upload, including walkthrough photos, which are processed by our AI sub-processor when you request a rehab estimate.

In the same period we disclosed personal information for a business purpose to the sub-processors listed in Section 3 - each receiving only what its specific function requires. We did not disclose personal information to any third party for that party's own purposes.

We collect this information directly from you, automatically through your use of the Service, and (for enrichment data) from the third-party providers listed in Section 1 at your direction. We collect it for the business purposes described in Section 2.

We Do Not Sell or Share Personal Information

We do not sell personal information for money, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Because we do not sell or share, no “Do Not Sell or Share My Personal Information” opt-out link is required, but you remain free to submit any of the rights requests below at any time.

Sensitive Personal Information

Your account password and, if applicable, precise contact details, are the only sensitive personal information categories we hold on you directly, and we use them solely to authenticate you and operate the Service - never to infer characteristics about you or for advertising. We do not use or disclose sensitive personal information in any way that requires you to be offered a right to limit its use.

Your California Rights

  • Right to Know - what personal information we have collected, used, disclosed, and the categories/sources/purposes involved.
  • Right to Delete - request deletion of personal information we hold about you, subject to certain legal exceptions.
  • Right to Correct - request correction of inaccurate personal information.
  • Right to Opt Out of Sale/Sharing - not applicable; we do not sell or share personal information.
  • Right to Limit Use of Sensitive Personal Information - not applicable; see above.
  • Right to Non-Discrimination - we will not deny you goods or services, charge different prices, or provide a different quality of service because you exercised any CCPA/CPRA right.

To exercise any of these rights, email visioncorehq@gmail.com with “California Privacy Request” in the subject line. We will verify your identity using the email address on your account before responding, and will respond within 45 days (extendable by an additional 45 days when reasonably necessary, with notice to you). You may also designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authorization and separately verify your identity.

Separately, under California Civil Code § 1798.83 (the “Shine the Light” law): we do not share your personal information with third parties for their own direct marketing purposes, so no disclosure under that law is required.

10. Children

The Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated in-app or by email at least 14 days before they take effect. The “Effective” date at the top indicates when the current version was last revised.

12. Contact

VisionCore LLC — New York
visioncorehq@gmail.com