Privacy Policy

When you register, we collect your name and email address. Sign-up, sign-in, email verification, password storage and hashing, password reset, multi-factor authentication, and session management are performed by our authentication provider, Clerk, Inc. (see Section 4.6). We do not store your password or a password hash on our systems; your account is identified on our systems by the user identifier Clerk assigns to it. Your email address is verified before billing or product access is enabled. You may optionally upload brand assets (logo, business name) to personalize reports — these are stored on your behalf and are not used for any other purpose.

All payment card data is collected and processed directly by Stripe, Inc. We do not store card numbers, CVVs, expiry dates, or full payment credentials on our systems. We retain non-sensitive billing metadata returned by Stripe, including your Stripe customer and subscription identifiers, plan, billing status and dates, and invoice history. We also keep a record of your access, meaning the plan, how you received it (a subscription, the free trial, or complimentary, invitation, or temporary access), its trial status and end date, and its start and end dates, and a record of the AI-processing cost of each Analyst request, which we use to apply your plan's usage limit. To prevent repeated free-trial abuse, we retain keyed pseudonymous identifiers derived from verified email addresses, which are kept after account deletion so that a deleted account's email address cannot start another trial, and, for card-based trials offered before the current no-card trial, Stripe-provided card fingerprints. These identifiers cannot be used to reconstruct the original email address or a card number and are retained only as long as justified by the one-trial policy and fraud, dispute, or legal requirements under our reviewed retention schedule.

When you use the Service, we automatically collect operational log data on our own infrastructure, including your IP address, browser and device type and version, operating system, requested pages, and timestamps. We also record the searches and questions you run within the platform, including listing IDs and geographic filters you interact with, together with counts of product events such as a completed Analyst conversation. Listing IDs in this context refer to property-record identifiers and do not contain your personal financial decisions. We use this information to operate, secure, and improve the Service. We do not use session replay. In the signed-in platform, no third party receives an automatic record of your clicks or page interactions; on our public pages, Google Analytics records page views, a few named events, and the events it collects itself, as described in Section 4.7.

If you contact us by email or through support channels, we retain your messages and our responses to resolve your inquiry and improve the Service.

A bug report can include up to five screenshots, if you choose to attach them. They show whatever was on your screen when you took them, so leave out anything you would rather we not see. We keep them in private storage that only Princeps can open, use them only to investigate the report, and delete them 90 days after you send them, or sooner if you delete your account. Support may download a copy while working on your report, and deletes it once the report is handled. We do not keep the names of the files.

When you use Princeps Analyst, we collect and store your prompts, analyst responses, model and usage metadata, tool traces, generated artifacts, and related errors so we can provide support, debug issues, monitor abuse, and improve the Service.

Our public property pages offer to connect the owner with a local real-estate agent. You do not need an account, and this section describes everything we do with such a request. If you send one, we collect your name, email address, phone number, and optional note; the property's address and postal code as you confirm or correct them; when you might sell and whether you are also buying; and your language and the page you sent it from. The request does not record your IP address or your browser.

We use this information only to choose one local real-estate agent for you, to pass your request to that agent so that the agent can contact you about selling, and to follow up on that introduction. Princeps selects the agent itself and shares your request with that one agent, and with no one else, except that the property's address and when you might sell go to our own support inbox in the notice described in Section 4.3. Princeps may receive a referral fee from that agent's brokerage. Once the agent has your request, the agent and the agent's brokerage also handle your information under their own privacy policy and the rules that govern real-estate brokerages.

To keep out automated requests, the form uses Cloudflare Turnstile, which receives your IP address and browser signals when you open the form (see Section 4.2). To limit repeated requests, we count them against a keyed hash of your IP address and a keyed hash of your email address; these counters are kept apart from your request, hold nothing else, and are deleted within two (2) days. Each request is kept as one file in private storage at Cloudflare that only Princeps can open (see Section 4.2). We send you no automated email about your request (the only one is the notice to our own support inbox described in Section 4.3); we contact you ourselves, by email or phone, to introduce the agent. The details you enter are never sent to our analytics or error-monitoring providers; Google Analytics learns only that the form was opened, started or submitted, never what you entered (see Section 4.7).

We delete each request twenty-four (24) months after you send it, or sooner when you ask us to. We delete the notice in our support inbox (Sections 4.3 and 4.8) within the same twenty-four (24) months, or sooner when you withdraw your request or ask us to delete your details.

To withdraw your request, or to see, correct, or delete your details, write to privacy@princep.org and tell us the email address you gave and the property. When you withdraw, we delete the request and, if we had already shared it, tell the agent that you withdrew. You also have the other rights described in Section 7.

A request sent through the earlier version of this form is no longer shared with anyone, and we send no email about it. To ask about one, write to privacy@princep.org.

On the Scout, Ranger, and Vanguard plans, you can connect an AI assistant of your choice, such as Claude Code or Codex, to Princeps over the Model Context Protocol (MCP). The assistant signs in as you through our authentication provider, Clerk (see Section 4.6), and asks Princeps to run search tools for you.

The listing, market, and broker business-contact data each tool returns is sent to that assistant and, through it, to the AI provider you chose. That provider is not one of our service providers: it processes those results under your own agreement with it and its privacy policy, which Princeps does not control. Your prompts and your assistant's replies stay with that provider; Princeps does not receive them.

For each tool call we record your account identifier, the tool, the names of the inputs it was given but not their values, how the call ended, how many records it returned, how long it took, and the name your assistant gives for itself. We use these records to apply your plan's daily limits and to detect abuse, and we delete them after ninety (90) days, or sooner when your account is deleted.

We use your account information to authenticate you, personalize your dashboard, and deliver analytics and reports. This is the primary purpose for which information is collected and the reason you entered into a subscription agreement with us.

We use billing metadata and access and usage records to administer free trials and plan access, apply your plan's usage limit, charge for your subscription, issue invoices, maintain billing records, and assess and configure applicable Canadian sales-tax obligations. Prices are tax-inclusive and automatic tax calculation is disabled; we will obtain qualified advice and update our configuration and disclosures before changing that treatment.

We analyze usage patterns, trial activity, billing metadata, and IP data to detect unauthorized account access, fraudulent subscription or trial activity, and abuse of the platform. This is a legitimate interest that is proportionate to and does not override your privacy interests.

We use our own operational logs to understand how the platform is used, prioritize new features, and fix defects. We use Google Analytics (Section 4.7) to measure, in aggregate, how visitors find and use our public pages and which of them lead to sign-ups and to opening the form to request a sale. Account holders accept the Terms of Service and acknowledge this Privacy Policy through the mandatory checkbox at signup; that stored signup record is our consent record for the disclosed processing.

Under Quebec Law 25, we collect information only for explicit, defined purposes. We do not use personal information for any purpose incompatible with those stated here without seeking fresh, informed consent.

Stripe processes subscription payments and collects your payment card data directly. Stripe may process information in the United States and other jurisdictions under its published service, privacy, and security documentation. See Stripe's privacy policy at stripe.com/privacy. We remain accountable for personal information transferred under our arrangement as required by applicable Canadian privacy law.

Cloudflare hosts the Princeps web application and serves it via a global edge network. Cloudflare processes network traffic — including IP addresses and HTTP metadata — in data centers across the United States and other jurisdictions as part of normal content delivery and security functions (DDoS protection, DNS). See Cloudflare's privacy policy at cloudflare.com/privacypolicy.

Cloudflare also stores the requests to sell a property described in Section 2.6 in its file storage, and provides Turnstile, the check on that form that keeps out automated requests. Turnstile receives your IP address and browser signals only when you open the form. Requests sent through the earlier version of the form are in Cloudflare's database service, and a brokerage's closing or commission statement for one is in its file storage.

Screenshots attached to a bug report (Section 2.4) are kept in Cloudflare's file storage as well.

We use Resend to deliver our own transactional emails, such as bug-report messages. Verification, password-reset, and other sign-in emails are sent by Clerk (see Section 4.6), not through Resend. Your email address and the minimum message metadata needed for delivery are transmitted to Resend solely for that purpose under its applicable terms. For a request to sell a property sent through the current form (Section 2.6), the only email is a notice to our own support inbox, which carries the property's address and when you might sell and never your name, email address, phone number, or note.

We use Sentry for engineering error monitoring and performance tracing. Sentry may receive error messages, stack traces, request and runtime metadata, browser and device details, IP address, and account context needed to diagnose a failure.

Princeps Analyst is powered by third-party language models. Each Analyst turn is sent to OpenRouter, Inc., which passes it to one or more of the independent inference providers that run the models we use, generally the lowest-priced one available. OpenRouter and these providers may process the request in the United States and other countries. See OpenRouter's privacy policy at openrouter.ai/privacy.

They receive what the model needs to answer that turn: your prompts, the earlier turns of that conversation, and the listing, market, and broker business-contact data returned by the tools the Analyst runs for you. Where you attach an image — such as the photo of a for-sale sign you can upload in the Analyst composer — that image is sent with the turn. A photo taken at a property may incidentally capture people, faces, vehicles, licence plates, or bystanders in the scene, so please do not upload images of people. Your account record — your name, email address, and billing details — is not part of an Analyst request.

An image is sent only on the turn you attach it to and only to generate that response; Princeps does not store the image bytes, and a resumed conversation contains the resulting text only. We rely on each provider's applicable service, privacy, and data-protection terms and remain accountable for personal information transferred under our arrangement as required by applicable Canadian privacy law. If we stop routing Analyst inference through OpenRouter, we will update this policy.

Clerk provides sign-up, sign-in, email verification, password storage and hashing, password reset, multi-factor authentication, and session management for the Service, and sends the verification and password-reset emails those flows require. Clerk processes your email address, name, a hash of your password, sign-in metadata, and the IP address and browser details of your sessions, and may do so in the United States and other jurisdictions under its published service, privacy, and security documentation. See Clerk's privacy policy at clerk.com/legal/privacy. Deleting your Princeps account also deletes your Clerk user; if your Clerk user is deleted, our account-deletion process described in Section 7.3 starts automatically.

We use Google Analytics 4, from Google LLC, to count visits to our public pages: the home page, the blog, the contact and legal pages, and the public property and area pages in English and French. It sends nothing from the signed-in platform, the sign-in and sign-up pages, the home check-up, or the pages opened from the links in our emails to sellers (to confirm a brokerage, withdraw a request, or unsubscribe).

Where it runs, your browser sends Google each page view: the page's address and title, and the address of the page you came from, which we shorten to our domain name when you came from the signed-in platform, the sign-in pages, or the home check-up. Google also receives your IP address, your browser and device details, and the identifier stored in its cookie on your device (see Section 9). Because the address of a property page names the property, Google learns which property pages a browser viewed. A property or area page also adds the type of page, its province, and its release batch when one is assigned. Google Analytics also records events of its own: a browser's first visit, the start of each visit, and how long a page stays in view; and, where they are turned on in our Google Analytics settings, scrolling to the end of a page, clicks on links to other sites, file downloads, video plays, searches named in a page's address, and the start and submission of a form, never what is typed in it.

We also send a few named events from property pages. Each carries the type of page, its province, and its release batch when one is assigned, and only these other fixed values: when you click the button on the AI Analyst card, whether you are signed out or signed in; when you sign up from a property page, the property's identifier and that the sign-up came from a property page; and when you open or start the form to request a sale, where the form was opened from. We never send Google your name, email address, anything you type into a form, your questions to the Analyst, or the details of a request to sell.

We use this information only to measure, in aggregate, how our public pages are found and used. We do not use Google Analytics data for advertising. Google Analytics keeps event-level data for at most fourteen (14) months; aggregate reports built from it are kept longer. Google may process this information in the United States and other jurisdictions. See Google's privacy policy at policies.google.com/privacy and how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can stop your browser from sending data to Google Analytics with Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout, or by blocking its script. Blocking or clearing its cookies stops it from recognizing a returning browser, but page views can still be sent.

Google hosts the mailbox of support@princep.org. It holds the email in that mailbox: the messages you send us there and our replies from it, and the bug-report messages and the notice of a request to sell a property (Section 2.6) that Resend delivers to it (Section 4.3). Google may process this information in the United States and other jurisdictions.

Your name, email, and trial and subscription history are retained for the duration of your active trial or subscription and for twelve (12) months after your account is closed or your subscription ends. This period covers potential billing disputes, tax record requirements, and any support inquiries arising after cancellation.

Princeps operational usage logs are retained for ninety (90) days. Information held by Sentry is retained according to the applicable service and project retention settings, after which it is deleted or de-identified. Google Analytics keeps event-level data from our public pages for at most fourteen (14) months; aggregate reports built from it are kept longer (see Section 4.7).

Non-sensitive billing and trial metadata from Stripe is retained only for the period justified by applicable tax, accounting, fraud-prevention, dispute, and legal obligations under our reviewed retention schedule; this is not a blanket retention period for every billing field.

After applicable retention periods expire, personal information is securely deleted or anonymized. You may request earlier deletion subject to the limitations described in Section 7.

Princeps Analyst transcripts and related metadata are retained only under a bounded, documented schedule reviewed for support, debugging, abuse prevention, and product-improvement needs. We delete or de-identify them when that period ends, unless a shorter deletion request applies or a specific legal hold requires longer retention.

A request to sell a property is deleted on the schedule described in Section 2.6.

You have the right to know what personal information we hold about you and to receive a copy of it in an intelligible format.

You have the right to request correction of inaccurate or incomplete personal information. Account information such as your name can be corrected directly in your account settings.

You may request that we delete your personal information. We will fulfill deletion requests subject to legal obligations that require us to retain certain records (e.g., tax records). Deletion of your account will be processed upon request and confirmed by email. Deleting your account also deletes your Clerk user; if your Clerk user is deleted, the same deletion process starts automatically.

You have the right to receive your personal information in a structured, commonly used, machine-readable format and to have it transmitted to another organization where technically feasible. Submit portability requests to privacy@princep.org.

You may withdraw your consent to any non-essential data processing at any time, subject to legal or contractual restrictions. Withdrawal of consent to processing required to deliver the Service may result in termination of your subscription.

If you believe we have handled your personal information in a manner inconsistent with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca. If you are a Quebec resident, you may also file a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

Princeps has designated a Privacy Officer responsible for compliance with Quebec Law 25 and PIPEDA. The Privacy Officer can be reached at privacy@princep.org. If you are a Quebec resident and wish to submit a privacy request or complaint, contact the Privacy Officer directly.

Before a relevant project or cross-border disclosure begins, we assess whether Quebec Law 25 requires a privacy impact assessment and complete and document one when required. This statement describes our obligation and does not claim that every possible assessment has already been completed.

In the event of a confidentiality incident (data breach) that presents a risk of serious harm to an individual, we will promptly notify the CAI and affected individuals, as required by Law 25. Notice will describe the nature of the incident, the categories of personal information involved, the number of individuals affected, and the measures we have taken or plan to take in response.

Princeps's analytics engine produces market-intelligence outputs (price indices, absorption rates, days-on-market trends). These outputs are informational and are presented to you as one input among many in your professional decision-making. We do not make consequential automated decisions about individual Subscribers — such as creditworthiness determinations, eligibility decisions, or employment decisions — based solely on automated processing of your personal data.