Privacy Policy

This Privacy Policy explains how PropRaven LLC ("PropRaven", "we", "us") collects, uses, shares and protects personal information when you use propraven.com, the PropRaven web app, our API, our MCP connector for AI assistants, our paid endpoints for software agents, and our mobile app (together, the "Services"). It also explains the choices you have, including if you are a property owner whose name appears in the public records we compile.

If you have questions, write to privacy@propraven.com or use our request form at https://propraven.com/privacy/request.

Summary

• Public-record data about property owners. PropRaven compiles property records that government offices publish. Those records can name property owners and other people, and sometimes include a mailing address, phone number or e-mail address. We show this information to signed-in account holders and to paying callers, not to anonymous visitors. If you're a property owner, you can ask us to stop showing your details: see Your choices as a property owner.
• Account information. If you create an account, we hold your name, e-mail address and sign-in details, your plan and billing status, and what you save in the app.
• Payments. Payments by card and other checkout methods are handled by Stripe. Payments by AI agents use the x402 protocol on a public blockchain; we store the paying wallet address and the transaction.
• Analytics. We use PostHog, Vercel Web Analytics and Vercel Speed Insights to understand how the Services are used and how fast they are. We don't run advertising, and we don't give your account or browsing information to others for their own use.
• Your rights. You can ask to see, correct or delete your account data using the form or the privacy mailbox. We republish public records and don't remove them on request, except under New Jersey's Daniel's Law (section 8).

1. Information we collect

1.1 Public-record information about property owners and other people named in property records

Where it comes from. We collect it from the government offices that publish it:

• county assessor and tax rolls;
• county recorder (deed) records;
• building-permit records;
• state business-entity (Secretary of State) filings;
• state licensing boards;
• county tax-delinquency and tax-certificate lists;
• other federal, state and local public datasets.

We collect people information from the publishing office, not from data brokers. We also use a few publicly available, non-government datasets, only for information about buildings, places and markets that does not identify people: building heights from Overture Maps, business names and categories from OpenStreetMap, and regional housing-market statistics published by Zillow. We do not take any information about people from these datasets.

What it can include:

• the owner of record's name, and other owners named on the same record (co-owners);
• the owner's mailing address as the assessor or tax roll publishes it, and other addresses the records show for the same owner;
• the parties to recorded deeds (grantor and grantee) and, where recorded, a party's address;
• people named on building permits (owners, applicants, contractors) and, where the permit publishes them, their phone number or e-mail address;
• officers, managers, members and registered agents named in state business filings, with the addresses those filings publish;
• licensed individuals as the licensing board publishes them (name, address, and where published, e-mail and phone);
• whether a property is listed as tax-delinquent, the name and mailing address on the tax bill, and the holders of tax certificates.

We don't buy phone numbers or e-mail addresses from data brokers or skip-trace services. The phone numbers and e-mail addresses we show come from building-permit records as the permit office published them.

What it does not include. We do not fill in information a government office withheld. Where a county marks an owner as confidential, we withhold that owner's mailing address for every user.

1.2 Information you give us

• Account information: your name and e-mail address; your password (held by our sign-in service in hashed form) or your Google or Apple sign-in identifier; your plan, and any team or organization you belong to.
• What you save: saved searches, watchlists, cohorts and lists, webhook endpoints, API keys (we store a hash, not the key), and push-notification tokens for the mobile app.
• Support and requests: what you send us by e-mail or through the privacy request form. The form takes your name, e-mail address and, optionally, a phone number, plus the names, addresses and parcels the request is about.
• Payment information: see 1.4.

1.3 Information collected automatically

• Usage analytics (PostHog). Pages viewed, page leave, and specific product events such as sign-up, plan purchase and API-key creation. Once you sign in, these events are linked to your account id and e-mail address. PostHog receives your IP address with each event and uses it to estimate your general location. We record the campaign parameters (utm_source and similar) of the first page you visited; they are kept in your browser's local storage and attached to sign-up and purchase events. Automatic click capture and session recording are off. Text typed into search (for example an owner's name) is removed from page addresses before they are sent to PostHog.
• Server-side analytics (PostHog). For payments and sign-ins that happen without a browser (a Stripe webhook, an x402 payment, an MCP connector sign-in), we send an event identified by your account id, or, if there is no account, by the paying wallet address or a hash of the credit token.
• Vercel Web Analytics counts page views without cookies. It records the page visited, the referring site, and your browser, operating system, device type and country.
• Vercel Speed Insights: page-load performance measurements, with the page measured.
• Page addresses sent to Vercel are cut down to the page itself: the query string (for example text typed into search) and anything after "#" are removed, and owner pages are reported as a generic owner page, so an owner's name doesn't reach Vercel's analytics.
• Sign-in and security records. When you sign in, our sign-in service records the session with your IP address and browser user agent. It also keeps a log of sign-in events (for example sign-in, sign-out and password reset) with your account e-mail.
• Security and rate limiting. We process your IP address to apply request limits and to block abuse; counters keyed by IP address or account are kept for a short time (section 7). When people data is served, the access log stores a keyed hash of the IP address, not the address itself. Our hosting provider (Vercel) and our own servers keep request logs that include IP addresses (section 7).
• Mobile app. Crash reports go to Sentry; they are not linked to your account and are scrubbed of personal details before they are sent. In-app usage analytics go to PostHog and are linked to your account id. Neither is sold or used for advertising.

1.4 Payment information

• Subscriptions and one-off purchases are paid through Stripe on its own checkout pages, by card or another method Stripe offers there (for example Link, Klarna, Cash App Pay or Amazon Pay). Stripe collects your payment details and e-mail address and keeps a customer record with your name and e-mail. We receive a Stripe customer and subscription reference and the purchase details. We don't receive or store your card number, security code, or card brand and last four digits. Stripe's privacy policy: https://stripe.com/privacy.
• x402 payments by AI agents. An agent pays in USDC on the Base network, through a third-party x402 payment facilitator (PayAI). For each payment we store the paying wallet address, a payment nonce, the item paid for, and the settlement time and on-chain transaction id. Blockchain transactions are public by design: the wallet address and transaction are visible on the blockchain regardless of what we store.
• Prepaid credits. When an agent buys prepaid credits (funded by an x402 payment), we store a hash of the credit token (not the token itself), the funding wallet address, the balance, and a ledger of top-ups and debits with the item each debit paid for.
• For people-data deliveries to a paying caller without an account, the access log records the payer as an id only: the wallet address for x402, or part of the token hash for credits.

2. How we use information

• To provide the Services: to run your account and sign-in, deliver the data you search for or buy, apply your plan's limits, and process payments.
• To compile and serve property records, including the public-record people data in 1.1, to account holders and paying callers (see 3.1).
• To keep the Services secure: rate limiting, abuse prevention, fraud prevention, and an access log of who viewed or exported people data.
• To improve the Services: understand which features are used and how fast pages load.
• To answer you, including privacy requests.
• To comply with law and enforce our Terms.

We don't use your information for targeted advertising and we don't run ads on the Services.

3. How we share information

3.1 Public-record people data

Who receives it:

• Signed-in account holders, on the website, through our API (with an API key) and through our MCP connector for AI assistants. Free accounts have a monthly limit on owner look-ups; paid plans include them.
• Paying callers. Software agents that pay for a specific item on our paid endpoints (an x402 payment or a prepaid-credit debit) receive the people data in what they paid for, even without an account.
• Paid subscribers' bulk files and data shares contain the same public-record fields.

Account holders and paying callers use this data for their own purposes, such as property research, lending, investing and contacting owners. Who does not receive it: visitors who are not signed in and have not paid. They receive property records with the people fields withheld, and a notice saying so.

Where it appears: parcel pages and the owner card; owner portfolios; deal and lead lists; per-parcel reports and dossiers; lead feeds; mail-merge list exports; and watch alerts that report an owner change.

Access is logged. Every view or export of people data is logged with the account or payer id, the surface, the records involved (as parcel ids, or a one-way digest of an owner name), the fields, and the time.

3.2 Service providers

They process information only to provide their service to us:

• Stripe: payments and subscriptions.
• Vercel: website and API hosting (United States); Web Analytics and Speed Insights.
• Hetzner: the servers that run our database, our sign-in service and our data processing (United States).
• Cloudflare: file storage, including database backups, and map-tile delivery.
• Upstash: rate-limit and usage counters.
• PostHog: product analytics (United States).
• Mapbox: address suggestions. The text you type into the search box is sent to Mapbox to suggest matching addresses.
• Esri and Carto: map imagery and base maps. When you view a map, your browser loads map tiles directly from them, so they receive your IP address and the map area you view.
• Anthropic: the AI search assistant (section 5).
• Resend: sends account e-mails such as password-reset messages.
• Sentry: crash reports from the mobile app.
• Expo: delivers mobile push notifications.
• Google Workspace: our e-mail.
• PayAI: the x402 payment facilitator that verifies and settles x402 payments on the blockchain.

Account sign-in runs on software we operate on our own servers. Google and Apple receive what you share with them when you choose to sign in with them.

3.3 Other sharing

• Business transfers: in a merger, financing, acquisition or sale of assets.
• Legal reasons: to comply with law, a court order or a valid legal request, or to protect our rights, users or the public.
• With your direction: for example, data you send to your own webhook endpoint or connected AI assistant.

3.4 What we don't do

We don't give or rent information about our website visitors or account holders (such as your account details, payment information or browsing activity) to anyone for their own use, and we don't use it for advertising.

4. Cookies and similar technologies

We use cookies and browser storage:

• To keep you signed in: the cookie sb-auth-auth-token, set when you sign in. Page scripts can't read it, it is sent only over HTTPS, and it expires about 30 days after you last use the site, or when you sign out. A short-lived cookie is also set while you sign in with Google or Apple.
• For PostHog analytics: the cookie ph_<project key>_posthog, which lasts one year, and matching entries in browser storage.
• To remember first-visit campaign information: the local-storage entry pr_first_touch_v1 (section 1.3).
• To remember your map view and notices you dismissed: local-storage entries such as propraven-map-v2.

Vercel Web Analytics and Speed Insights don't use cookies. We don't use advertising cookies. Most browsers let you block or delete cookies; blocking the sign-in cookie will sign you out. We don't currently respond to Do-Not-Track or Global Privacy Control signals; analytics load the same way when your browser sends them.

5. AI features

• The AI search assistant is available to signed-in users. It turns a request typed in plain English into PropRaven search filters. The text of your request is sent to Anthropic for that purpose; no account details are sent with it. Under Anthropic's commercial terms, Anthropic does not use API inputs or outputs to train its models by default, and deletes them within 30 days.
• Our MCP connector lets an AI assistant you choose (for example Claude) query PropRaven on your behalf. What you ask that assistant is governed by its provider's privacy policy. We receive only the queries it sends us.

6. How we protect information

• Data is encrypted in transit (HTTPS/TLS).
• Database backups are stored encrypted at rest.
• The web application connects to its database with a least-privilege role: it can read what it serves and write only what it must. It can add to the people-data access log and to the privacy request queue, but cannot read or change either.
• API keys and credit tokens are stored as hashes. IP addresses in the people-data access log are stored as a keyed hash.
• People data is sent with private, no-store cache headers so it is not kept in shared caches.

No system is perfectly secure, and we can't guarantee that information will never be accessed without authorization.

7. How long we keep information

8. Public records and your choices

PropRaven republishes public records from government sources. Except for requests under New Jersey's Daniel's Law, we don't remove or suppress public-record data on request. If you want a record corrected or removed, contact the government office that publishes it; we re-collect it with each release.

New Jersey covered persons (Daniel's Law). If you are a covered person under N.J.S.A. 56:8-166.1, or an authorized person acting for one, you can send a nondisclosure request through the form at https://propraven.com/privacy/request (choose "Daniel's Law (NJ)") or to privacy@propraven.com with "Daniel's Law" in the subject line. Include the protected home address and, if you wish, the unpublished home telephone number. We honor these requests within 10 business days of receiving them. We may contact you to confirm the request is yours, or that you are authorized to act for the person it is about.

What a Daniel's Law request does:

• Once we have verified a request, we add the person to our suppression list.
• From then on, their name, mailing address, phone number and e-mail address are withheld wherever we serve the record: on our website, in our app, in our API and MCP connector, and in the reports, lists and exports we produce from then on.
• The property record itself stays (its address, value, permits and so on), and it says that people fields were withheld at the person's request.
• We match the name exactly, in any word order, so other people with a similar name are not affected. If you want only certain properties covered, tell us which.
• This doesn't change the government record. To change that, contact the office that published it.

9. Your privacy rights

Depending on where you live, you may have the right to:

• know whether we process your personal information, and access it;
• correct inaccurate information;
• delete your information;
• get a copy of information you gave us;
• opt out of certain uses of your personal information, such as targeted advertising or profiling;
• not be discriminated against for using these rights.

How to use them: use the form at https://propraven.com/privacy/request, or e-mail privacy@propraven.com. The form records your request with a reference number and shows it to you when you submit. We reply by e-mail from privacy@propraven.com. If you have an account, you can also delete it in the app.

Account data and public records. These rights cover the data in your own PropRaven account: access, correction and deletion. They are separate from public records. We don't remove public-record data on request (section 8), except under Daniel's Law; to correct or remove a public record, contact the government office that publishes it.

Authorized agents. You can use an authorized agent. We may ask for proof of authorization and to verify your identity. Verification. We use the information in your request only to verify it and to act on it.

Response times. You can make any of these requests at https://propraven.com/privacy/request or by e-mail to privacy@propraven.com. We respond to requests to access, correct or delete your account data within 45 days of receiving them, and to a Daniel's Law request within 10 business days (section 8).

Appeals. If we decline a request, you can appeal by replying to our decision or writing to privacy@propraven.com with "Appeal" in the subject line. We'll respond in writing. If your appeal is denied, you may contact your state attorney general.

10. Children

The Services are not directed to children under 18, and we don't knowingly collect information from them through account sign-up. If you believe a child has created an account, contact privacy@propraven.com and we will delete it.

11. Changes to this policy

When we change this policy, we update the "Last updated" date at the top. When we make a material change, we also show a notice on our website that links to the updated policy.

12. Contact

PropRaven LLC
2720 South Blvd, #475
Charlotte, NC 28209
United States
privacy@propraven.com
Privacy requests: https://propraven.com/privacy/request