Privacy Policy
Our commitment to protecting your data and professional identity.
Last Updated: September 6, 2026 | Effective Date: September 6, 2026
Secure & Encrypted
Industry-standard security controls and working toward SOC 2 Type II.
Privacy Focused
Designed with CCPA and GDPR privacy principles in mind.
Transparent Ops
We disclose what we collect — including AI conversations and message screening.
Introduction
Welcome to HomeLeafs. We are committed to protecting your privacy and being transparent about how we collect, use, and share your personal information. This policy explains our practices and your choices regarding your data.
Agreement
By using our Services, you agree to this Privacy Policy and our Terms of Service.
1. Information We Collect
1.1 Information You Provide Directly
Account Information:
- Full name, email address, and encrypted credentials
- Phone number and preferred contact methods
- Professional role (Homeowner, Investor, Agent, etc.)
- Business credentials and profile media
LinkedIn Data:
Optional social sync data includes:
- Professional headline, summary, and work history
- Verified skills, endorsements, and network metrics
- Public profile URL and industry data
Property Data:
- Addresses, mortgage details, and hardship narratives
- Financial status and auction timelines
- Property media and documentation
1.2 Information Collected Automatically
Discovery Feed & Behavioral Data:
To power our personalized feed, we automatically track:
- Interactions with property listings and posts (views, likes, saves, shares)
- Contact conversion events and lead interaction rates
- Derived preference profiles (location, price, urgency, and property affinities)
- A/B testing interactions used to optimize our ranking algorithms
AI Assistant Conversations:
When you use any HomeLeafs AI assistant, we record:
- The message you send and the assistant's reply, stored as written
- Which feature you were using and what you were trying to accomplish
- What the assistant recommended, and whether you acted on it
- Any rating or written feedback you give on an answer
We use these records to measure whether the assistant actually helped, and to improve its answers for you and for other people in your situation. Conversation text is retained for 24 months and then deleted automatically. You can delete your assistant history at any time from Privacy Settings, or by emailing us.
Message Safety Screening:
Direct messages are automatically screened before they send, to protect homeowners from fraud and predatory outreach. The screening looks for:
- Social Security Numbers and similar sensitive identifiers
- Known foreclosure-scam and predatory-offer patterns
- Threatening, abusive, or spam content
This screening runs on your own device. Messages that are not flagged are never sent to our moderation systems. If a message is flagged, we store an excerpt of it (up to 200 characters), the patterns detected, and the sender and recipient, so we can act on repeat violations. Repeated violations affect a professional's standing on the platform and may result in removal.
Usage Data & Tracking Technologies:
- Pages viewed, features used, and time spent on Platform
- Click patterns, navigation paths, and search queries
- Device type, browser, operating system, and IP address
- Session cookies for authentication
- Analytics cookies (Google Analytics, Mixpanel)
- Marketing cookies (Facebook Pixel, LinkedIn Insight Tag)
- LinkedIn conversion tracking and share activity metrics
2. How We Use Your Information
LinkedIn Professional Trust Layer:
- Calculate LinkedIn Trust Scores (0-5.0 scale) based on connections, endorsements, recommendations, and HomeLeafs activity
- Display professional credentials and endorsements
- Show mutual connections between users
- Verify professional identity and credentials
Core Platform Operations & Algorithmic Discovery:
- Create and manage user accounts
- Connect homeowners with qualified service providers
- AI-Powered Discovery Feed: We analyze your viewing history, saved items, and interaction signals to dynamically personalize your property feed and connect you with the most relevant opportunities.
- Process subscription payments and send transactional notifications
- Direct messaging between users and appointment scheduling
Improving Our AI and the Platform:
- Measuring whether our AI helped. We compare what an assistant recommended against what actually happened, so we can tell the difference between advice that worked and advice that did not.
- Learning across users, in aggregate. We analyze conversations and outcomes in groups — never as individual profiles shown to anyone else — to find patterns like which approaches resolve foreclosure cases faster. These aggregate findings improve guidance for everyone on the platform.
- What we require before we state a statistic. When we show you a number ("this approach succeeds X% of the time"), it is computed from real, recorded outcomes and we tell you the sample size behind it. General guidance that is not backed by our own data is labeled as guidance, not presented as a statistic.
- What we do not do. We do not sell your conversations. We do not send your conversations to third parties to train their general-purpose models. We do not show your messages or your property situation to other users except through connections you approve.
Marketing Communications (with consent):
- Educational resources and tips
- Product updates and new features
- Promotional offers and discounts
- Newsletter and market insights
- LinkedIn-targeted advertising
9. LinkedIn Marketing Developer Program
LinkedIn Integration Details:
We participate in LinkedIn's Marketing Developer Program:
- LinkedIn OAuth 2.0 for authentication
- LinkedIn Insight Tag tracks conversions and engagement
- Trust score calculation using LinkedIn professional signals
- Mutual connection matching and professional credential verification
- Targeted advertising via LinkedIn Campaign Manager
Data Sharing with LinkedIn:
- Conversion events (sign-ups, subscriptions, shares)
- Aggregate engagement metrics
- Custom audience matching (hashed emails)
- NO direct sale of individual profile data
Your LinkedIn Privacy Controls:
- Control LinkedIn data sharing
- Opt-out of LinkedIn Insight Tag
- Disconnect LinkedIn account: Settings → Connected Accounts
- Request deletion of synced LinkedIn data: [email protected]
10. Subscription and Payment Privacy
Our Subscription Plans (as of January 2025):
Basic: $0/month
Unlimited listing access, direct messaging
Silver: $499/mo billed annually, $599/mo billed monthly
capacity for up to 10 exclusive homeowner connections/month
Gold: $832/mo billed annually, $999/mo billed monthly Most Popular
capacity for up to 20 exclusive homeowner connections/month
Platinum: $2,499/mo billed annually, $2,999/mo billed monthly
capacity for up to 50 exclusive homeowner connections/month
Payment Security:
- All payments processed securely by Stripe (PCI DSS Level 1 certified)
- We do NOT store full credit card numbers
- Billing address and tax information retained for legal compliance
- Payment history available in account settings
14. Professional Trust and Verification
LinkedIn Trust Score Methodology (0-5.0 scale):
✓ LinkedIn connections / 20 (max 25 points)
✓ Endorsements × 2 (max 15 points)
✓ Recommendations × 5 (max 10 points)
✓ Years on LinkedIn × 1 (max 10 points)
✓ HomeLeafs activity (max 50 points)
✓ LinkedIn Premium bonus: +10%
✓ Company page bonus: +5 points
Public Display: Trust scores are displayed on user profiles, visible to all platform users, and updated every 30 days.
4. Your Privacy Rights
Access and Control:
- Access: Request a copy of your personal data
- Correction: Update inaccurate information
- Deletion: Request account and data deletion (subject to legal retention)
- Portability: Download your data in machine-readable format
- Objection: Opt-out of certain processing activities
How to Exercise Your Rights:
- Email: [email protected]
- In-app: Dashboard → My Account → Privacy Settings (for granular data visibility controls)
- Response time: 30 days maximum
California Residents (CCPA/CPRA):
- Right to know what personal information is collected
- Right to opt-out of sale of personal information
- Right to delete personal information (with exceptions)
- Right to non-discrimination for exercising rights
- Do Not Sell Notice: We do NOT sell personal information for money
🚫 Do Not Sell My Personal Information
HomeLeafs does NOT sell your personal information to third parties for monetary consideration. However, we may share data with partners for targeted advertising purposes, which may be considered a "sale" under CCPA.
If you wish to opt out of data sharing for advertising:
- Visit Cookie Preferences to disable marketing cookies
- Opt out of LinkedIn ads: LinkedIn Ad Settings
- Email us: [email protected] with subject "Do Not Sell My Info"
5. Data Security
Technical Safeguards:
- Encryption protocols for sensitive data
- TLS/SSL encryption for data in transit
- Strong encryption standards for data at rest
- Multi-factor authentication (MFA) available
- Regular security audits and reviews
- We follow industry-standard security controls and are working toward SOC 2 Type II
Organizational Safeguards:
- Employee background checks
- Data access controls and logging
- Security awareness training
- Incident response procedures
- Regular security policy reviews
Data Breach Notification:
In the event of a data breach, we will notify affected users within 72 hours of discovery via email and in-app alerts, coordinate with law enforcement if necessary, and implement remediation steps.
6. Data Retention
Retention Periods:
- Active Accounts: Account data retained for duration of account + 90 days
- Transaction Records: 7 years (legal requirement)
- Communications: 3 years
- AI Assistant Conversations: 24 months, then deleted automatically. Deletable on request at any time.
- Flagged Message Excerpts: 3 years, as a safety and repeat-violation record
- Analytics Data: 2 years
- Aggregate Learning Data: Findings computed across many users (for example, "homeowners who upload documents early resolve claims faster") are kept in de-identified form and are no longer linked to you. Deleting your account removes your individual records; it does not retroactively remove aggregate statistics already computed from them.
- LinkedIn Data: Until disconnection or deletion; Trust scores recalculated every 30 days
- Inactive Accounts: Deletion after 180 days of inactivity (with notice)
7. Children's Privacy
Age Restriction:
- Platform is NOT intended for children under 18
- We do not knowingly collect data from minors
- Immediate deletion if minor use discovered
If you believe a minor is using our Platform, contact: [email protected]
8. International Data Transfers
Data Location:
- Primary servers: United States (Railway, MongoDB Atlas)
- CDN: Global (Cloudflare)
- Backup storage: Multi-region (Firebase)
GDPR (European Users):
- Lawful basis for processing
- Data Protection Officer: [email protected]
- Right to lodge complaint with supervisory authority
Transfer Mechanisms:
- Standard Contractual Clauses (EU-US)
- Data Processing Agreements with vendors
- Privacy Shield principles (where applicable)
11. Changes to This Privacy Policy
Update Process:
- New or expanded uses of your data: 30-day advance notice via email, and we do not apply the new use to information collected before that notice
- Clearer descriptions of what we already do, and new protections or controls for you: effective immediately, posted with an updated date
- Minor updates: Posted on Platform with updated date
- Continued use constitutes acceptance
- Option to delete account if you disagree
September 6, 2026 update. We added plain descriptions of two things that were already happening but were not spelled out here: we record your AI assistant conversations, and we screen direct messages for scam and abuse patterns. We also added new limits and controls that took effect the same day — a 24-month cap on how long conversation text is kept, the ability to delete that history yourself, and honouring your cookie choice for our own analytics as well as third-party tools. Separately, we began analyzing conversations in aggregate to improve guidance across the platform; that use applies only to conversations from September 6, 2026 onward, not to anything recorded before we told you about it.
12. Contact Information
Privacy Team:
Email: [email protected]
Mail: HomeLeafs Privacy Team
131 Continental Drive, Suite 301
Newark, DE 19713-4323
County: New Castle
Response Time: 30 days maximum
Data Protection Officer (GDPR):
Email: [email protected]
Responsible for GDPR compliance and EU representative coordination