Privacy Policy

Effective Date: May 1, 2026
Last Updated: September 1, 2026

1. Introduction

This Privacy Policy describes how MyInversorAI, a service operated by Your Best Data LLC ("we," "us," "our," or the "Company"), collects, uses, discloses, and protects the personal information of users ("you," "your") who access our website at https://myinversorai.com (the "Website") or our mobile application (collectively, the "Service").

Your Best Data LLC is a Florida limited liability company registered under document number L25000194405 (EIN 61-2256524), with its principal place of business at 3750 S Dixie Hwy, Suite 613, Miami, FL 33133, United States.

The Service provides real estate investment analysis tools that allow users to evaluate residential properties, calculate financial returns, compare investment scenarios, and generate professional reports. The Service is intended exclusively for users located within the United States and is not directed at users outside the U.S.

By accessing or using the Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy, do not use the Service.

This Privacy Policy is incorporated into and governed by our Terms of Service.

2. Eligibility — 18 Years of Age or Older

The Service is intended exclusively for users who are at least eighteen (18) years of age. We do not knowingly collect personal information from individuals under 18. If you are under 18, do not use the Service or submit any personal information to us. If we learn that we have collected personal information from a person under 18, we will delete that information from our records as promptly as commercially reasonable.

If you are a parent or legal guardian and you believe that your child under 18 has provided us with personal information, please contact us at info@myinversorai.com so that we may delete it.

3. Information We Collect

We collect information in three ways: information you provide directly to us, information collected automatically when you use the Service, and information from third-party sources.

3.1 Information You Provide Directly

Account Registration Information. When you create an account, we collect:

• Email address
• Password (which we store only in hashed and salted form; we cannot recover your plain-text password)
• Full name (required for account profile)
• Account role (whether you identify as an Investor, Realtor, or Admin)
• Language preference (English or Spanish)

Profile Information (Optional). Realtor users may additionally choose to provide:

• Profile photograph (uploaded to our secure storage)
• Real estate license information (license number and issuing state)
• Phone number
• Professional biography text

Property Analysis Data. When you create an investment analysis, you provide:

• Property addresses you wish to analyze
• Property characteristics (type, beds, baths, square footage, year built)
• Purchase price, down payment, loan terms, interest rates
• HOA dues, property taxes, insurance, maintenance assumptions
• Investment strategy (rental, flip, BRRRR, resale, short-term)
• Risk profile preference

Client Report Data (Realtor-Plus and above plans). Realtor users may attach client information to generated reports:

• Client name
• Client email address
• Client phone number
• Client notes (free-form text)

This client information is used solely to generate personalized PDF reports for your professional use. It is treated by us as Your Best Data LLC processing data on your behalf as a real estate professional. You are responsible for ensuring you have the appropriate consent from your clients to provide their information to us.

Communications. When you contact us via email, in-app feedback, or other communication channels, we retain the contents of your communications and any related information you provide.

3.2 Information Collected Automatically

Device and Usage Information. When you use the Service, we automatically collect:

• IP address (used to determine approximate location for region-specific defaults like state tax rates)
• Device type, operating system, and version
• Browser type and version (web)
• Mobile device identifier (mobile)
• Push notification token (mobile, only if you enable notifications)
• Timestamps of account creation and last login
• Pages or screens visited within the Service
• Actions you take (analyses created, reports generated, features used)
• First-party operational telemetry, including an account- or session-linked event name, platform, route or feature, action, duration, provider endpoint, success or status, latency, cache result, and limited error code or metadata
• Mobile crash and performance diagnostics, when configured, including app release and build, platform, operating system and device metadata, stack traces, crash or error data, Android ANR data, iOS app-hang data, performance or stall measurements, and sanitized technical breadcrumbs

Location Information (Mobile App, Optional). With your express permission granted through your device's permission system, the mobile app may access your device's location while the app is open. This location data is used solely to:

• Center the in-app map on your current vicinity for convenience
• Surface nearby property comparables in the ZIP Deal Finder

We do not track your location in the background. We do not retain or persist your precise device location on our servers. The location data is used in real-time only and is discarded when you close the app or revoke the permission. You can revoke location permission at any time through your device settings; the Service will continue to function without it.

Cookies and Similar Technologies. Our Website uses essential cookies and local storage to maintain your session, remember your preferences (language, theme, locale), and provide core functionality. We do not use third-party advertising cookies, marketing tracking pixels, or behavioral analytics cookies. We use first-party operational telemetry as described in Section 7. Google Analytics may also operate on the Website and Firebase Analytics may operate in the mobile apps when configured; we do not use these tools for cross-context behavioral advertising.

3.3 Information from Third-Party Sources

Property Market, ZIP, and Address Data. When you search for or analyze a property address, Geoapify processes partial address queries and the selected result for autocomplete and geocoding. If you grant mobile location permission, mobile address flows may also send Geoapify precise device coordinates, including when used as a proximity bias, and may reverse-geocode coordinates into an address. RentCast processes the selected address and property characteristics for public property records, market rents, estimates, and comparable listings. Mapbox receives property coordinates only to render maps. For a short-term-rental analysis, our Supabase Edge Function sends AirROI the exact five-digit ZIP to retrieve area-level ADR and seasonal occupancy data. AirROI may log API calls and analyze usage for service operation, security, performance, and compliance under its public policy and terms. We do not send these providers your MyInversorAI account identity, email, password, or form contents unrelated to the address or ZIP request.

Authenticated ZIP Deal Finder searches, quota records, and saved ZIP favorites are stored under the account's internal user_id so the Service can return account-specific results, enforce plan limits, and provide saved items. ZIP, city, and state derived from an address or geocoding result may be saved with an account-scoped analysis, ZIP record, or location preference and then used to request AirROI short-term-rental data or location-aware Market Pulse news.

Local Market News. The mobile apps and Website send city, state, and locale to a first-party MyInversorAI backend/proxy. Mobile uses an authenticated Supabase Edge Function; the Website uses its server backend. Depending on platform and availability, that backend sends a minimized location-aware query to Google News RSS or GDELT, with fallback between them. Those sources receive the query plus the applicable backend server's IP address and User-Agent; they do not receive the mobile device's IP address or User-Agent, or a MyInversorAI account identifier, from this proxied flow. They return public news links and may process backend requests under their own privacy terms.

Macroeconomic Data. We retrieve aggregated, non-personal market data (mortgage rates, treasury yields, CPI, unemployment) from the Federal Reserve Economic Data (FRED) API operated by the Federal Reserve Bank of St. Louis. This data is purely public-statistical and contains no personal information.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 To Provide and Operate the Service. We use your information to create and maintain your account, authenticate your sessions, run property analyses, store your work, generate reports, and deliver core features you request.

4.2 To Communicate With You. We send transactional emails relating to your account: signup confirmation, password resets, magic-link authentication, important security notices, plan-limit warnings, and responses to your support inquiries. If you opt in to push notifications, we send notifications about new listings in your saved ZIPs, deal alerts on saved properties, market news, and account re-engagement reminders. You can disable push notifications at any time in your account settings. When you separately opt in to marketing email during registration, we may send product updates, market insights, and offers. You can opt out at any time through the unsubscribe link in those emails or through notification preferences.

4.3 To Enforce Plan Limits and Detect Abuse. Each subscription plan grants defined daily analysis limits and other feature-specific quotas, as shown on the current pricing page. We track your usage against these limits to enforce them. We also use behavioral signals (rapid request patterns, unusual login geography, IP rate limits) to identify and prevent fraud, abuse, and unauthorized access.

4.4 To Improve and Diagnose the Service. We use first-party account- or session-linked operational events to understand feature use, diagnose defects, measure reliability and capacity, provide support, and prevent abuse. We also use aggregated or de-identified statistics for product planning. We do not use this data for advertising profiles.

4.5 To Comply With Legal Obligations. We may process your information to comply with applicable laws, court orders, subpoenas, regulatory inquiries, or governmental requests, and to protect the rights, property, or safety of Your Best Data LLC, our users, or others.

4.6 With Your Consent. Where required by law or where we choose, we will obtain your express consent before using your information for purposes not previously disclosed.

We do not sell your personal information. We do not use your data to train artificial intelligence or machine learning models for use outside of providing the core Service to you. We do not engage in cross-context behavioral advertising.

5. Legal Basis for Processing

For users in the United States, our legal basis for processing personal information is one or more of the following:

• Performance of a contract: Processing necessary to provide you with the Service you signed up for and to fulfill our Terms of Service.
• Legitimate interests: Operating, securing, and improving the Service in ways that do not override your fundamental rights.
• Compliance with legal obligations: Tax, audit, regulatory, and law-enforcement obligations.
• Consent: Where you have given explicit permission (such as enabling location services or push notifications).

6. How We Share Your Information

We share information in the following limited circumstances:

6.1 Third-Party Providers and Data Sources

We use the providers and data sources listed below to operate the Service and supply requested content. Some act as service providers or sub-processors under applicable contractual terms; others are independent API or public-content sources accessed through our backend under their own terms and privacy policies. We do not represent every provider below as processor-only or as covered by a data processing agreement with us.

For vendors acting as service providers or sub-processors, we rely on the contractual and security commitments applicable to those services. Independent API and public-content sources, including AirROI, GDELT, and Google News RSS, may process backend requests for their own stated purposes under their policies; we do not promise that they act only on our instructions. We will update this list as our infrastructure evolves, and substantial changes will be reflected in this Privacy Policy.

6.2 Legal and Regulatory Disclosures

We may disclose your information if we believe in good faith that disclosure is required to:

• Comply with a valid legal process (subpoena, court order, search warrant)
• Respond to a lawful governmental request
• Enforce our Terms of Service or investigate potential violations
• Protect against fraud, security breaches, or technical issues
• Protect the rights, property, or safety of Your Best Data LLC, our users, or the public

6.3 Business Transfers

If Your Best Data LLC is involved in a merger, acquisition, sale of all or substantially all of its assets, financing, or bankruptcy, your information may be transferred to the successor entity as part of that transaction. We will notify you (by email and a prominent Service notice) of any such change in ownership or control of your personal information.

6.4 With Your Consent

We may share your information with third parties if you have given us your express consent to do so. You may revoke this consent at any time, although it will not affect prior sharing.

6.5 Aggregated and De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you (for example, "average investment scores by property type in Florida"). We may publish such aggregated information for marketing, research, or industry-statistics purposes.

6.6 Public Reports and Directory Safety

Anyone with a public client-report link can view that report until the link is revoked or deleted; the sharing user controls the recipient. A published Directory profile displays the professional information its owner chose to make public.

A safety report may include the reported profile, reason, details, status, timestamps, and a technical snapshot of the content needed to investigate. A block associates the blocking account with the blocked profile so the profile can be hidden. Access to reports and blocks is limited, as applicable, to the relevant user and authorized personnel for moderation, safety, and support.

7. Tracking, Analytics, and "Do Not Track"

MyInversorAI uses first-party operational telemetry to operate, secure, support, and improve the Service. A telemetry event may be associated with an authenticated account or a browser/app session and may include the platform, event name, route or feature, action, duration, provider endpoint, success or status, latency, cache result, and a limited error code or metadata.

Our telemetry filters out passwords, access tokens, authorization values, email addresses, property addresses, free-form messages, form contents, and similar sensitive payloads. Authorized administrators may review account-level diagnostics when needed for support, security, abuse prevention, capacity, or reliability; we also use aggregated or de-identified views for product planning.

The mobile apps record a privacy-limited funnel from first open through registration, onboarding completion, and first analysis. The Website signup flow records registration attempts, validation or API failures, and successful account creation. The app creates a random installation UUID and stores it encrypted in the device's secure storage; the Website stores a separate random browser-installation UUID in first-party local storage. The UUID is sent over TLS only to the dedicated ingestion endpoint, is immediately transformed into an HMAC pseudonymous digest, and is not logged or stored raw in the event queue or database. Events may include a pseudonymous session digest, platform, app version and build, locale, event or step, bounded reason code, retry count, and, after authentication, an internal account identifier for reconciliation. They do not include email, name, property address, password, access or push token, form values, or free-form text.

When configured in the mobile apps, Firebase Analytics provides the mobile-app analytics stream and uses an app-instance identifier and technical data such as device category or model, operating-system and app version, language, approximate region, session and first-open events, and bounded registration, onboarding, and first-analysis outcomes. Our mobile configuration disables advertising-ID collection, and we do not send Google names, email addresses, passwords, property addresses, or form contents through these analytics events. We do not use Firebase Analytics for advertising or cross-app tracking.

When configured in the mobile apps, Sentry processes crash, ANR, app-hang, performance, release-health, stack-trace, and other diagnostic data so we can find and fix reliability problems. Our configuration disables default PII and does not send account identifiers, names, email or property addresses, user-entered content, screenshots, view hierarchies, session replay, failed-request bodies, console breadcrumbs, cookies, or authorization values. URLs, messages, HTTP breadcrumbs, and navigation breadcrumbs are sanitized before transmission. These diagnostics are not linked for advertising and are not used for tracking.

When configured, the Website uses Google Analytics 4 (GA4) to measure Website page and event activity, while Firebase Analytics measures mobile-app product activity as described above. Google may process browser or app-instance and device information, page or screen and event data, and approximate region under its own privacy terms. We do not use first-party telemetry, GA4, or Firebase Analytics for cross-context behavioral advertising, and we do not sell personal information.

Browser "Do Not Track" signals are not applied as a separate control because there is no uniform standard. Our practices remain the same: we do not track users across unrelated websites or build advertising profiles.

8. Data Retention

We retain account information and user content while the account is active and only for as long as reasonably necessary for the purposes described in this Policy.

Authenticated ZIP Deal Finder searches, quota/usage records, and saved ZIP favorites are linked to the account's internal user_id. We keep those active records while needed to provide account history and saved items, enforce plan limits, and operate the feature; account deletion removes the supported active records subject to the limited exceptions and backup cycle below.

When an authenticated user successfully completes the in-app or signed-in web deletion flow, the active Auth account, user-owned product records, and supported profile or branding files are removed as part of that deletion and cannot be recovered through the Service. A request submitted through the public form or by email is not an immediate deletion; we verify the requester and process a valid request within 30 days.

We may retain a limited deletion-compliance record, billing or tax record, support history, security or anti-fraud record, or dispute record only for as long as reasonably necessary to document compliance, meet a legal obligation, protect the Service, or resolve a dispute. These records may include the request contact, status, timestamps, and a technical summary of the deletion. We delete or de-identify them when they are no longer needed for those purposes.

Raw mobile and Website acquisition or signup-funnel events containing only HMAC-pseudonymous installation or session identifiers, plus an internal account identifier after authentication when available, are retained for 90 days. They are then reduced to daily operational totals without installation, session, or account identifiers and retained for up to 25 months. Imported daily App Store, Google Play, and Website acquisition totals may also be retained for up to 25 months for trend and conversion analysis.

AirROI's public policy states that Enterprise API usage logs are retained for 24 months, performance metrics for 12 months, API-related data is deleted within 90 days after account termination except when longer retention is legally required, and anonymized usage statistics may be retained indefinitely. Google retains Google News request data under its own privacy policy and account/settings-dependent schedules. GDELT has not provided us a fixed request-log retention period, so that period is unknown to us.

Deleted information may remain temporarily in encrypted backups or in a provider's restricted operational logs until the provider's normal retention cycle completes. Those copies are not available in the active product and are not restored except for disaster recovery or another legally permitted purpose. Aggregated or de-identified information that cannot reasonably identify a person may be retained for analytics and service planning.

9. Your Rights and Choices

We honor a comprehensive set of privacy rights. The following rights are available to all users of the Service, regardless of their state of residence:

9.1 Right to Access

You have the right to request a copy of the personal information we hold about you. We will provide this in a portable, machine-readable format (typically JSON). Request via info@myinversorai.com.

9.2 Right to Correction

You may correct inaccurate personal information directly through your account settings. For information that cannot be corrected through the interface, contact us at info@myinversorai.com.

9.3 Right to Delete

You may delete your account and associated active product data at any time:

• Authenticated app or Website: Open Profile, choose Delete Account, confirm your account email, and complete the permanent-deletion confirmation. A successful direct deletion is processed immediately and signs the account out.
• Public web request: If you cannot sign in, visit https://myinversorai.com/data-deletion. Submitting the form creates a privacy request for manual identity verification; it does not immediately delete the account.
• Email: Write to info@myinversorai.com from the address associated with the account.

The acknowledgement email for a public request confirms receipt only. It does not contain or require a deletion-verification link. We may ask for additional information needed to verify control of the account, and we process a verified request within 30 days unless applicable law permits or requires otherwise.

Deleting an account or uninstalling an app does not cancel an active subscription. Web subscriptions must be cancelled through MyInversorAI support or the available Square web-subscription controls. Mobile subscriptions must be cancelled in Apple App Store or Google Play.

9.4 Right to Object and Restrict Processing

You may object to certain processing of your personal information or request that we restrict processing in certain circumstances. Send objections to info@myinversorai.com.

9.5 Right to Data Portability

You may request your personal information in a portable format suitable for transmission to another service. Send requests to info@myinversorai.com.

9.6 Right to Withdraw Consent

Where we rely on your consent, you may withdraw that consent at any time. Examples: revoking location permission in device settings, disabling push notifications in account settings, unsubscribing from non-transactional emails (transactional emails such as password resets cannot be unsubscribed because they are necessary for the Service to function).

9.7 Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. Exercising your rights will not result in denial of service, charging you different prices, or providing a lesser-quality experience.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

10.1 Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information (as defined by Cal. Civ. Code § 1798.140):

• Identifiers: Name, email address, IP address, device identifiers
• Customer records (§ 1798.80(e)): Account credentials, billing information (when applicable)
• Commercial information: Subscription tier, transaction history, usage patterns
• Internet/network activity: Pages visited, features used, session timestamps
• Geolocation: Approximate location via IP; precise location only with consent (mobile)
• Professional information: Real estate license details (Realtor users only)
• Inferences: Aggregated usage profiles for plan-limit enforcement

10.2 Sources of Personal Information

We collect personal information from: (a) directly from you, (b) automatically from your device, and (c) from third-party data providers (RentCast, Geoapify) only with respect to property addresses you submit.

10.3 Business Purposes for Collection

We collect personal information for the business purposes described in Section 4 (How We Use Your Information): operating the Service, communications, plan enforcement, security, improvement, and legal compliance.

10.4 Categories of Recipients

We disclose personal information to the categories of recipients listed in Section 6 (How We Share Your Information).

10.5 No Sale or Sharing of Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not sold or shared the personal information of California residents in the past 12 months and do not plan to.

10.6 California Consumer Rights

In addition to the rights described in Section 9, California residents have the right to:

• Right to know what personal information we have collected, used, disclosed, sold, or shared about you in the past 12 months
• Right to delete your personal information (subject to certain exceptions)
• Right to correct inaccurate personal information
• Right to opt-out of sale or sharing (we do not sell or share, but you may register an opt-out preference if you wish)
• Right to limit use of sensitive personal information (we do not use sensitive personal information for purposes beyond providing the Service)
• Right to non-discrimination for exercising your rights

To exercise any of these rights, contact us at info@myinversorai.com or visit https://myinversorai.com/data-deletion. We will verify your identity before fulfilling the request, typically by confirming control of your account email address.

You may designate an authorized agent to make a request on your behalf. The agent must provide written authorization, and we may require you to verify your identity directly.

11. Other State Privacy Rights

If you reside in a U.S. state with comprehensive privacy legislation (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or others as applicable), you have similar rights to those described above. To exercise your rights, contact us at info@myinversorai.com.

12. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: All connections to the Service use HTTPS (TLS 1.2 or higher).
• Encryption at rest: Database and storage volumes are encrypted at rest using AES-256.
• Authentication: Passwords are hashed using industry-standard algorithms (bcrypt or equivalent). We never store plaintext passwords.
• Access control: Production data access is restricted to authorized personnel with role-based permissions enforced at the database layer (Row-Level Security).
• Audit logging: Sensitive actions are logged for security investigation purposes.
• Sub-processor diligence: We select sub-processors who maintain SOC 2, ISO 27001, or comparable certifications.
• Vulnerability management: We monitor security advisories for our software dependencies and apply patches in a timely manner.

Despite these efforts, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. If you become aware of a potential security vulnerability or breach affecting the Service, please notify us immediately at info@myinversorai.com.

In the event of a data breach affecting your personal information, we will notify you and applicable regulators in accordance with applicable law.

13. International Data Transfers

The Service is operated from the United States and is intended for U.S. users only. Your information is processed and stored on servers located in the United States. Your sub-processors (Section 6.1) primarily operate from the United States, with the limited exception of Geoapify (European Union) for address autocomplete only, which receives only partial address strings disassociated from your account identity.

If you access the Service from outside the United States (which is not the intended use), you do so on your own initiative and are responsible for compliance with local laws. Your data will nonetheless be processed in the United States.

14. Third-Party Links

The Service may contain links to external websites and services not operated by Your Best Data LLC. This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party site you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Privacy Policy
• Provide a notice within the Service or by email to your registered address (for material changes)
• For changes that materially expand the scope of how we use your information, obtain your renewed consent if required by law

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

MyInversorAI (a service operated by Your Best Data LLC)
3750 S Dixie Hwy, Suite 613
Miami, FL 33133
United States

Email: info@myinversorai.com

For the fastest response, please use email rather than postal mail. We will respond to verifiable requests within 30 days, or as required by applicable law.

This Privacy Policy is governed by the laws of the State of Florida and the United States, as further described in our Terms of Service.