Privacy Policy

Data we collect

We collect information you provide directly (account registration, listing details, documents you upload, communications through the platform) and information generated automatically (session data, page views, IP address, device type).

• Account data — name, email address, password hash
• Listing and transaction data — property address, listing details, uploaded disclosures and contracts
• Communications — messages sent through the platform between sellers and buyers
• Usage data — page views, feature interactions, browser type, approximate location derived from IP
• Payment data — handled by Stripe; we store a Stripe customer ID only

Why we collect each category

• Contract — account data and listing data are required to provide the service you signed up for
• Legitimate interest — usage data helps us improve the product and detect abuse
• Consent — analytics and marketing cookies are loaded only after you opt in (see Cookie Policy)

Cookies and trackers

We use cookies for authentication, security, and — with your consent — analytics. See our Cookie Policy for the full list of cookies, their categories, and how to manage your preferences.

Third-party processors

We share data with the following processors to provide the service. Each link goes to that provider's privacy documentation.

• Stripe — payment processing. Stripe Privacy Policy
• Resend — transactional email. Resend Privacy Policy
• OpenAI (AI agent features) — your listing data and conversation history are processed by OpenAI under their API terms, which prohibit training on your data by default. See OpenAI enterprise privacy.
• LangSmith / LangChain (AI quality monitoring) — AI traces (prompts, responses, timing) are sent to LangSmith for real-time quality assurance and debugging. LangSmith is the observability layer; the authoritative long-term record of AI interactions is stored in our own database (subject to the 7-year retention policy below). Traces in LangSmith are associated with an internal identifier, not your email directly. Selfana staff or legal counsel may review traces in connection with disputes, compliance audits, or safety investigations. See LangChain Privacy Policy.
• Cloudflare R2 — document storage. Cloudflare Privacy Policy
• PostHog — product analytics (loaded only with analytics consent). PostHog Privacy Policy

Data retention

• Account data — retained for the life of the account plus 2 years after deletion request
• Listing and transaction data — retained for 7 years after transaction close (required for tax and legal recordkeeping)
• Session logs — 90 days
• Consent records — 24 months per CPRA guidance

Your rights

Depending on your state of residence, you may have the right to access, correct, delete, or export your personal information. California residents may also opt out of the "sale or sharing" of personal information under CPRA. To exercise any of these rights, email us at [email protected]. We respond within 45 days.

Children's data

Selfana is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

Contact for privacy questions

Email [email protected]. We aim to respond within 5 business days.