Privacy

This is the privacy policy in place on this deployment. The data handling it describes is the running product's, read from the source, and a gate checks the main parts of it on every run. Where this page and /trust describe the same path, they are meant to agree.

The entity responsible is Underwrite.

It operates from New York, United States, and written notice reaches it at 200 Park Avenue, New York, NY 10166.

Privacy questions are answered at ali@getunderwrite.com.

A deal you work on lives in the page. Without sign-in, Underwrite does not keep a saved deal for you. The optional score email is described below. With Underwrite Core, a deal you save is stored privately under your account, in a folder with a random name that holds no email address, and you can download or delete it at any time; a deal with Confidential Mode on is never saved to the server. A deal saved to this browser's library lives in local storage on your own machine. A share link you sent and a file you exported are copies outside both, and deleting does not reach them.

Three random identifiers are also kept in browser storage so usage can be counted without knowing who anybody is: one for the browser, one for the tab's session, and one for the work item being underwritten. They are minted with the browser's own random number generator. None of them is derived from your property, your document, your numbers, or a hash of any of them. Clearing site data severs them from anything recorded before.

Underwrite sets no cookies for a visitor who does not sign in. Signing in sets two first-party cookies: one that ties the sign-in link to the browser that asked for it, and the session itself, which lasts 30 days or until you sign out. There is no password. There is no advertising identifier, no session replay, no keystroke capture and no third-party analytics script anywhere in the product.

When a subscriber chooses Look up local comps, the property address is sent to the Census geocoder and the property coordinates are sent to RentCast to retrieve nearby rental listings. Listing results are cached on the server for about 24 hours and saved with the deal as a frozen intel snapshot. Agent and office contact fields are discarded. Displaying the map requests tiles from OpenStreetMap. Confidential Mode disables local comps lookups and map tiles.

Lookup sends the address to Underwrite and the Census Geocoder. The matched point is sent to FEMA, the U.S. Geological Survey, the U.S. Fish and Wildlife Service, the Forest Service image service, EPA ECHO, and OpenStreetMap through a public Overpass instance. Census geography codes go to Census for area statistics where configured, and county codes go to the Bureau of Labor Statistics for labor figures. Reference rates are read from the New York Fed, and the Treasury par yield curve from the Treasury. New York City addresses also go to NYC GeoSearch, and matched lot and building identifiers go to NYC Open Data. Other New York State addresses send the county, house number and street name to NYS Open Data for the local assessment roll. Cook County, Philadelphia, San Francisco and Los Angeles County addresses send the house number, street and ZIP (San Francisco also the matched point) to the open assessor data for that county or city. The LL97 covered buildings list is read from a dated copy held by Underwrite, so no request is sent for it. A HUD rent benchmark, when a token is configured, sends the county code to HUD. No deal document or financial assumption is sent. The lookup is cached briefly in server memory. Choosing Use in model or saving the intel snapshot stores the address and those public-record facts with the deal, in the deal link and in deals saved in this browser. The lookup is not written to a server-side deal database. Lookups run only when you press Look up public records. Confidential Mode disables them. Opening a source citation takes your browser to that provider. Opening a blank underwriting desk carries the address in the deal URL, which can appear in hosting access logs.

Without sign-in, four paths carry deal material out, each of them something you press: parsing a document, asking for AI review, asking for an AI summary, and creating a share link or a memo link. With Underwrite Core there are two more, each also something you press: saving a deal to your account sends it to Underwrite's server, which keeps it privately under the account (03 above), and making a share link sends the deal to Underwrite's server, which signs the link and keeps no copy of the deal. A link carries the deal's inputs in the URL itself; it does not carry the source quotes, which stay in the session that made them. Anyone holding the link can open that deal, and opening it sends the whole URL, deal included, to Underwrite's server, which serves the page and keeps no copy. The request line exists in the hosting platform's access log, which this product does not control and does not promise to delete.

A pasted document or a small PDF travels inside the parse request. A larger PDF is staged from your browser into private blob storage under a short-lived token scoped to PDFs and to one folder, read back by the server, and deleted the moment the parse settles, on success and on every failure path. An Excel workbook never travels as a file: it is opened in your browser and only its cell text, normalized and capped in size, is sent.

Where this site has it set up, Public rent context, a folded panel beside the rent on the desk, sends the five-digit ZIP to Underwrite's server when you press its Look up control, and the server asks the Census Bureau's public data API for that area's rent figures. The Census Bureau sees that request from Underwrite's server, not from your browser; the panel's source link, if you open it, takes your browser to the Census Bureau's data site with the ZIP in its address. The server may keep the public figures for that ZIP in memory for up to 30 days, so a later lookup may not need to ask again. While its figures are on the desk, and where this site lets them travel on a link, the desk also sends them back to Underwrite's server with the server's token for them and a one-way digest of the deal's memo or share link, a SHA-256 fingerprint that does not contain the deal, right after the lookup, after each pause in editing and when you copy a link, so the server can sign the figures to that one deal. Nothing else about the deal goes with either. With Underwrite Core, making a share link sends the figures and the server's token for them with the deal itself, as making a share link already sends the deal. Where the lookup is not set up, the panel says so and sends nothing. In Confidential Mode the panel sends nothing.

A comp file you read on the desk is parsing a document too, and takes the same paths: a PDF as a document, an Excel or CSV file as its cell text and file name. Its rows come back to your browser, which keeps them in its storage for the memo until you remove them, load another deal, reload the desk, switch Confidential Mode on, or clear site data. Confidential Mode turns the comp reader off with the parser.

Two forms reach the founder through a form service: what you type in them and the email address you give go to that service and land in his inbox. Type nothing there you would not put in an email.

If you choose Email me the check on /check, Underwrite saves your email, the submission time, the check result, flag count, and whether you submitted from a result or the daily limit. No account is created. This record contains no OM text, full report, IP address, or user agent. The existing email provider receives your address and the check result to send the requested email and can send the founder the same saved fields. Delivery can fail after the record is saved.

When follow-up notes are switched on, Underwrite may send up to three more emails about starting the free month, about one day, three days, and seven days after the saved request. Each note includes an unsubscribe link that works without an account. Opening that link, or the mail provider's unsubscribe action, stops the notes immediately. The notes also stop if that address starts a free month or has Underwrite Core. A follow-up record stores the email, the original request time, which notes were sent and when, and whether you unsubscribed or the series stopped. It does not store OM text, a report, an IP address, or a user agent.

Lead and follow-up records are kept in private durable storage until removed by the founder. There is no automatic deletion window. To ask for removal, use the support contact above.

If you watch a saved deal, Underwrite keeps that watch with your account: the deal name, which rates you linked, the DSCR level you set, and a dated history of the verdict, levered IRR, min DSCR and NOI. When the weekly note is switched on, it is sent to the address you sign in with, and it names each watched deal, what changed, and why. The note has an unsubscribe link that works without opening the account. Opening that link, or the mail provider's unsubscribe action, stops the note. The watch itself stays until you unwatch it. An unsubscribe record stores the address and the time. It does not store a document.

Confidential Mode is one switch on the desk that turns off the paths described above for the desk and memo views, Underwrite Core's two included, the feedback question the desk asks after an export, and the usage events below. It does not govern the contact forms or the score email form on the marketing pages, which send the information you choose to submit, or the follow-up notes sent later from a saved score request. What it turns off is listed exactly at /trust.

When you use the desk, the browser may send a small event so the founder can see whether the product is being used. An event carries a name from a fixed allowlist, the moment it happened, the three random identifiers above, a random delivery identifier so a retried send is one record rather than two, an actor class that separates the founder's own testing and facilitated demonstrations from a stranger's use, the build and environment the server stamps on it, and a few operational properties whose keys and values are allowlisted per event.

What an event cannot carry, because the schema has no place for it: document text, rent rolls, addresses, deal names, filenames, financial values, source quotes, memo contents, IP addresses, user agents, keystrokes or page contents. The schema has no free-text field. A field path is accepted only if it is one of the engine's own input paths, and a property value only if it is one the engine knows. Anything else is refused outright with an error, not quietly dropped.

Events are stored as one small JSON object each in a private blob store, readable only with the server's own token. In Confidential Mode no event is sent at all, and the server neither knows nor needs to know why an event did not arrive.

Deleting usage events is a pass somebody runs, not a timer or a background job. The window the pass uses is 90 days: a day older than that is deleted when the pass runs. Each run writes a receipt saying what it deleted and when. Until a pass has run, the events are still there.

The same pass removes staged uploads that were abandoned, meaning a document staged for a parse that never started because the tab closed. It deletes under the usage-event folder and the staging folder and nowhere else, and it refuses to touch billing records.

If the blob store is unavailable, the event is not recorded at all. What is left behind is one diagnostic line in the hosting platform's log naming the event and nothing else: no identifiers, in a log this product does not control and therefore does not promise to delete. An event that was never delivered, or failed to store, is activity nobody observed, not evidence that nothing happened.

When you subscribe, the card is entered on Stripe's own hosted page. Underwrite never sees a card number. What it keeps is a customer identifier, the email address you gave Stripe, the plan, the subscription status and its period, the last invoice outcome, the terms version you accepted and when, and the identifiers of the Stripe events already applied, so the same event arriving twice is recorded once. To keep the free month to one per person it also keeps a one-way fingerprint of your inbox and, from Stripe, of the card used for a free month; neither can be turned back into the address or the card number. If you paid through a Stripe payment link before you had an account, signing in with the same email looks that subscription up at Stripe and records it here.

Link, Stripe's payments service, sells the subscription as the seller of record. It collects your name, billing address, email and payment details at checkout and keeps them under its own privacy policy, to take the payment, work out sales tax and send your receipts.

That is a business record with a different purpose from usage measurement, and it deliberately does not inherit the usage-event window: a payment record is kept for as long as the business needs it. It is never joined to browser activity by inference, and the funnel report counts paying subscribers from this ledger rather than from anything a browser did.

The providers in the path include: Anthropic runs the AI calls, the hosting platform serves the site and holds the private blob store, Stripe takes the payment, an email provider sends the sign-in link, the free-month reminder and requested score emails, and a form service delivers the two contact forms. The AI calls run under Anthropic's commercial API terms, which do not use the input for training; Underwrite itself trains nothing.

No promise is made here about what any provider keeps, or for how long. Underwrite has no signed data processing agreement with any of them. An institution that requires a data processing agreement should run sensitive deals in Confidential Mode or by hand until that paperwork exists.

What you can do today without asking anyone: use Confidential Mode, which stops the desk and the memo page sending anything about your deal; delete any saved deal from the library or your account; download every deal saved to your account; clear the site's browser data, which removes every browser deal and severs the three identifiers; and not press the buttons that send a document. Deals saved to your account stay downloadable for at least 90 days after Core ends; deleting them after that is done by hand, with notice.

Which statutory privacy rights apply to you depends on where you are. Underwrite Core is offered to subscribers in the United States only.

This page does not claim to satisfy any particular privacy regime and does not list rights under one. A request to remove a subscription record is answered at the support contact above.

Every fact these documents needed from the founder is supplied and written in where it belongs: who provides Underwrite, where it operates, where written notice reaches it, the support contact, where subscribers may be, the tax treatment, the refund policy and what a subscription buys. While any of them was blank, it kept live checkout closed on its own.

Every fact this document needs has been supplied.

Supplying them met one of the software preconditions of live checkout.