Privacy Policy

Introduction

Grounda ("we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our Service.

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, name (optional), phone number (optional)
• Property Information: Address, property details (square footage, bedrooms, bathrooms, year built)
• Authentication: Email verification codes, Google OAuth data (name, email, profile picture)
• Communications: Messages, feedback, support requests

1.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, actions taken
• Device Information: Browser type, operating system, device type, screen resolution
• Log Data: IP address, access times, error logs
• Cookies: Session cookies, authentication tokens, preferences

1.3 Third-Party Data

• Public Property Records: Assessment values, tax history, property characteristics from County Appraisal Districts (HCAD, FBCAD, etc.)
• Google Maps: Geocoding data, address suggestions
• Google OAuth: Profile information (if you choose Google login)

1.4 AI Assistants

You can ask an AI assistant, such as ChatGPT or Claude, to look up a Texas home through Grounda's assistant connector. The connector has no sign-in. It reads public appraisal records and Grounda's own fee and deadline information, and it cannot change anything. When you use it:

• What we receive: The address or property ID and the language the assistant sends us, which assistant sent it, and the IP address of the request. We do not receive your name, your email, your conversation, or your account with that assistant.
• What we return: Public appraisal and tax records for the home, a comparison of its value per square foot with similar homes nearby, our fee and deadlines, and links to grounda.ai. We never return owner names. The connector cannot sign, file, or change anything. Only the owner can sign, on grounda.ai.
• What we keep: We keep the answer for a home for up to 24 hours so repeat questions are fast. We do not add the addresses you ask about to any account or profile. To stop abuse, requests made directly to our web API, and requests from a connector you added yourself, are counted by IP address, and that count is kept for a few minutes. Requests that ChatGPT, Claude, Meta Muse and Grok send through their own connectors are not counted by IP. Our hosting provider, Vercel, keeps standard request logs for up to 30 days. They include the IP address and the web address requested. For web API requests, that web address contains the address asked about. When you open a link we returned, it contains the assistant's name and, for a home on the county roll, the property's county account number.
• Links: Links we return name the assistant they came from. If you open one and then create an account, we may record that assistant as how you found us, as we do for any other link.
• The assistant itself: What you type into the assistant, and what it does with our answer, is covered by that assistant's own privacy policy.

2. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: Provide property tax information, calculate estimates, generate neighbor comparisons
• Account Management: Create and maintain your account, authenticate users, manage preferences
• Communication: Send verification codes, reminders, updates, and service notifications
• Improvement: Analyze usage patterns, improve features, fix bugs, enhance user experience
• Security: Detect fraud, prevent abuse, secure our systems
• Legal Compliance: Respond to legal requests, enforce our Terms of Service

3. Cookies and Tracking Technologies

We use cookies and similar technologies for:

Managing Cookies: You can control cookies through your browser settings. Note that disabling essential cookies may affect Service functionality.

4. How We Share Your Information

We share your information only as described below.

4.1 Service Providers

Companies that run parts of the Service for us, under contract, and only to provide it:

• Supabase: database and file storage
• Stripe: payment processing and invoices
• Google: Maps API and Google sign-in
• Resend: email delivery
• Vercel: hosting and serverless functions, with built-in logging
• Upstash: rate limiting and caching

4.2 Appraisal Districts and Review Boards

To act as your property tax agent, we give the appraisal district and the appraisal review board for your property the information the protest needs: your name, the property, your signature on the agent designation form (Form 50-162), and the evidence we submit for you.

4.3 Collection of Unpaid Fees

If a fee you owe under your Service Agreement stays unpaid, we may share your name, contact details, property, and the amount owed with a collection agency that collects it for us. We may also assign or sell the unpaid balance to a collection agency or debt buyer, which then receives the same information and may contact you about the balance. You owe only the amount on your invoice. We do not add collection costs.

4.4 Legal Requirements

We may disclose information if required by law, court order, subpoena, or to:

• Comply with legal process
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or illegal activity

4.5 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. You will be notified of any such change.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: HTTPS/TLS for data in transit, AES-256 for data at rest
• Authentication: Passwordless magic codes, JWT tokens with short expiry
• Access Controls: Role-based access, principle of least privilege
• Security Headers: CSP, X-Frame-Options, HSTS
• Monitoring: Error tracking, intrusion detection, audit logs
• Regular Updates: Security patches, dependency updates

6. Data Retention

We retain your information for as long as necessary to provide the Service and comply with legal obligations:

• Account Data: Until you delete your account + 30 days
• Property Information: Until you remove saved properties
• Verification Codes: 15 minutes (auto-expiry)
• Access Tokens: 1 hour (auto-expiry)
• Refresh Tokens: 60 days (auto-expiry)
• Audit Logs: 90 days (security requirement)
• Cached Property Data: 7 days (performance optimization)
• AI Assistant Answers: Up to 24 hours (see 1.4)
• AI Assistant IP Counts: A few minutes (see 1.4)
• Hosting Request Logs: Up to 30 days (see 1.4)

7. Your Privacy Rights

Under applicable privacy laws (GDPR, CCPA, Texas Data Privacy and Security Act), you have the right to:

How to Exercise Your Rights: Contact us at privacy@grounda.ai with your request. We will respond within 30 days.

8. Children's Privacy

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Opt out of the sale of personal information. We do not sell it for advertising or marketing. The only transfer for value is an unpaid balance under 4.3.
• Non-discrimination for exercising your CCPA rights

10. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. By using the Service, you consent to this transfer.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via email or prominent notice. Your continued use after changes constitutes acceptance.

12. Contact Us

For questions, concerns, or to exercise your privacy rights: