Privacy policy

This Privacy Policy explains how Canyon Hills Consulting, LLC, operating the DealPulse service ("DealPulse," "we," "us," or "our"), collects, uses, shares, stores, and protects personal data when you use the DealPulse web application, the DealPulse Excel Add-in, our websites, and related support channels (together, the "Service").

DealPulse is a business-to-business service built for commercial real estate professionals. It is intended for use by businesses and their authorized personnel, not by consumers for personal, family, or household purposes.

We collect the following categories of personal data:

• Account and profile data — such as your name, business email address, password (stored only in hashed form), company or account name, role, time zone, and avatar.
• Usage, device, and log data — such as your IP address, browser and device information, the features you use, request timestamps, and analytics events generated as you interact with the Service.
• Business content you provide — the documents and records you upload to or create within the Service, including offering memoranda, financial statements such as trailing financials and rent rolls, deal records, notes, and customer relationship records.
• Contact data about third parties — business contact information about real estate professionals, obtained from publicly available sources and from information our customers enter (see "Personal data about non-users" below).
• Communications — information you provide when you contact support, request a demo, or otherwise communicate with us.

We collect personal data:

• Directly from you, when you register, configure your account, upload content, or contact us;
• Automatically, as you use the Service, through server logs and product analytics; and
• From publicly available sources, for the third-party business contact information described in this policy.

DealPulse includes deal-sourcing and customer-relationship features that use business contact information about real estate professionals — for example, the names, business titles, business phone numbers, business email addresses, office locations, and license information of brokers. We obtain this information from publicly available sources, such as brokerage and listing websites, and from information our customers enter.

This information is used to help our customers identify and manage their professional relationships. If you are a real estate professional and would like to access or request removal of your business contact information, contact privacy@dealpulsecre.ai.

We use personal data to:

• Provide, operate, maintain, and secure the Service;
• Authenticate users and protect account security;
• Run the workflows you initiate, including document processing and analysis;
• Keep the text read from your documents and the results extracted from them, so an analysis can be checked, explained, and run again without reading the file a second time (see "Data retention");
• Provide customer support and respond to your requests;
• Monitor, analyze, and improve the reliability, performance, and features of the Service. This never includes training artificial intelligence models on your business content;
• Communicate with you about the Service, including service and security notices; and
• Comply with legal obligations and enforce our agreements.

We do not use your personal data for a purpose materially different from those described in this policy without providing notice or obtaining consent where required by law.

Some features of the Service use artificial intelligence to generate summaries, analysis, and structured outputs from content you choose to process. These features are optional and run only when you initiate them.

As a matter of current practice, we do not use your confidential business content — such as the documents and financial records you upload — to train artificial intelligence models. We take steps to keep this content confidential with the AI providers we use. We direct the providers we route requests through not to collect your content for model training, and some features use zero-data-retention handling.

Document classification, which reads part of each document you upload to file it, runs on OpenAI models hosted by Microsoft Azure in the United States, with zero data retention. If that service cannot answer, a backup OpenAI model reads the same excerpt through OpenAI directly, or through Microsoft Azure when OpenAI is unavailable, under the no-training direction but without zero data retention.

Most AI requests are processed by providers in the United States, and that is our default. It is not true of every request. Some requests to Google run on its global infrastructure rather than in a United States region. The private reasoning in the AI Investment Committee runs on a provider that hosts primarily in the United States and may route requests to Europe. Some models we use are built by companies outside the United States; we run them through United States hosting providers where one is available. The AI Investment Committee's private reasoning provider is called directly, not through our routing. Its promise not to train on your content is that provider's own stated policy, not a direction we send.

DealPulse keeps its own record of each AI reading of a document, including the provider's reply. That record is kept as described in "Data retention" below.

AI-generated outputs are provided for your internal business use and review. They are not financial, legal, investment, tax, or accounting advice, and they may contain errors. You are responsible for independently verifying any output before relying on it. See our terms of service.

We may create and use de-identified and aggregated data — data that does not identify, and that we do not attempt to re-associate with, you, your account, any individual, or any specific property owner. We may use such de-identified and aggregated data for any lawful business purpose, including to operate, analyze, secure, and improve the Service and to develop market datasets, benchmarks, models, and analytics.

We retain rights in de-identified and aggregated data, and our rights to use it continue after your account is closed.

The DealPulse web application sets two strictly necessary cookies when you sign in. Both are HttpOnly and Secure, so page scripts cannot read them, and your browser sends them only to DealPulse. We do not use either one for analytics or advertising.

The first keeps you signed in. It is a SameSite=Strict cookie that holds a sign-in credential. It is renewed while you use the application, expires when your sign-in session does, and is cleared when you sign out.

The second is a security cookie. The next time this browser signs in, it tells us which account's network access rules to check, such as a list of allowed IP addresses. It holds only a one-way hash of your account's identifier and no personal data: not your name, email address, or password. It is a SameSite=None cookie that your browser sends only to our sign-in service. It lasts 90 days and stays in place when you sign out, so the same rules apply at your next sign-in.

The web application also uses browser local storage to remember your profile and account details between visits. The DealPulse Excel Add-in manages authentication within the add-in, without browser cookies.

We use a product analytics provider to understand how the Service is used. This provider sets a device or session identifier and records in-app events so we can measure and improve features. We also use it on our marketing website. We do not use third-party advertising networks or marketing tracking pixels on the application.

The Service does not respond to browser Do Not Track signals, because no common standard exists. We do not allow third parties to track users across other websites through the Service.

We share personal data only as described in this policy.

Service providers (subprocessors). We use third-party service providers to help us deliver and operate the Service. We describe them by category rather than by name on this page:

• Cloud hosting and application infrastructure
• Cloud file and object storage
• Managed database hosting and backups
• Transactional email delivery
• AI inference providers for optional, user-initiated workflows
• Web search providers used by AI research workflows
• Product analytics
• Software development and code hosting tools
• Mapping and geospatial data services
• Error monitoring and operational logging

A current list of our subprocessors is available to customers on request. We require service providers to protect personal data and to use it only to provide services to us.

Legal and protective disclosures. We may disclose data when required by law or legal process, to protect the rights, property, or safety of DealPulse, our customers, or others, or to investigate or prevent fraud or security issues.

Business transfers. We may disclose or transfer data in connection with a merger, acquisition, financing, reorganization, or sale of all or part of the business.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

The business content you upload to DealPulse is stored within your own account and is not shared with other customers or accounts. DealPulse is account-isolated by default, and single-tenant deployments are available for institutional customers on request. For more detail, see our security overview.

DealPulse is operated using managed cloud infrastructure located in the United States. If you access the Service from outside the United States, you understand that your data will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

We retain account and business records for as long as your account is active and as needed to provide the Service, satisfy our contractual and legal obligations, resolve disputes, and maintain security records. Deletion is not instantaneous everywhere: copies persist for a defined period in trash, backups, and recovery systems before being purged.

• Deleted documents move to trash, where you can restore them for 30 days. After that the original file is permanently deleted.
• Database backups hold a recoverable copy for up to 35 days.
• A deleted account is held for a 90-day recovery period before it is purged.

What we keep after a single document is deleted. When DealPulse reads a document you upload, it keeps the text of each page and a record of every AI reading of it: the AI provider's reply, the figures and facts extracted from it, and which account, deal, and user it was read for. We keep this data after you delete a single document, until your account is purged. On a rent roll, this text and data can include residents' names.

What we delete when an account is purged. When a deleted account is purged after its 90-day recovery period, we also delete the page text, AI readings, and extracted facts kept for its documents. There are three exceptions. Page text for a file that another account also holds stays, because that account still uses it. Likewise, an AI reading is kept when another account's saved record still depends on it. And for a property we keep the names given to its floor plans and the rent roll codes each was listed under, which offering memorandum floor plans were attached to its unit types, and whether a later rent roll agreed. These are facts about a building, not about people.

We keep this data so an analysis can be checked and explained later, and so the same file is not read, and charged for, a second time within your account. An account sees this data only for files that account holds itself. We do not use it to train artificial intelligence models. To ask about this data, contact privacy@dealpulsecre.ai.

Residual copies in versioned object storage are removed on their own documented schedules after the periods above. Log, analytics, and support records may be retained for shorter or longer periods depending on the operational or legal reason for retention. De-identified and aggregated data may be retained as described above.

DealPulse uses encryption in transit, access controls, audit logging, and managed-infrastructure protections to reduce the risk of unauthorized access to personal data. No method of transmission or storage is completely secure, but we work to protect your data using reasonable administrative, technical, and organizational measures. For more information, see our security overview.

You can update certain profile information — such as your name, email address, time zone, and avatar — directly within DealPulse.

Depending on where you live, you may have rights to request access to, correction of, or deletion of your personal data, to receive a copy of it, and to object to or restrict certain processing. To exercise these rights, contact privacy@dealpulsecre.ai. We may need to verify your identity before acting on a request, and some requests are subject to legal exceptions or depend on the operational role of the data within the Service.

U.S. state privacy rights. Residents of California and other U.S. states with comprehensive privacy laws may have the right to know what personal data we collect, to request deletion or correction, to opt out of the sale or sharing of personal data, and to not be discriminated against for exercising these rights. As noted above, we do not sell your personal data or share it for cross-context behavioral advertising. To make a request, contact privacy@dealpulsecre.ai.

For most business content processed within DealPulse, we act as a service provider or processor on behalf of our customers. If you are an individual whose data was provided by one of our customers, please direct your request to that customer, and we will support them in responding.

The DealPulse Excel Add-in lets authorized users search active deals, pull underwriting data into Microsoft Excel, and push selected model outputs back to DealPulse through the same authenticated account used in the web application.

The add-in requires permission to read from and write to the active workbook in order to exchange underwriting data between DealPulse and your spreadsheet. Authentication sessions are managed within the add-in without browser cookies.

DealPulse is a business service intended for professional users. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. The Service is not designed to process health data or other special categories of sensitive personal data as a core workflow.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on this page with a revised effective date.

For privacy questions or requests, contact privacy@dealpulsecre.ai. For general help, visit our support page. DealPulse is operated by Canyon Hills Consulting, LLC.