ValoraFlow – Privacy Policy

1. Who We Are

ValoraLens, Inc. ("ValoraLens," "we," "us," or "our") operates the ValoraFlow platform, accessible at valoraflow.valoralens.com. ValoraLens is the data controller for personal information collected through ValoraFlow.

For privacy inquiries, contact us at privacy@valoralens.com.

2. What Information We Collect

2.1 Information you provide directly

Data	When collected	Purpose
Email address	Anonymous trial sign-up or account registration	Session identification; one transactional email for anonymous users
Name	OAuth account creation (Google or LinkedIn)	Account personalization
Professional profile data	Account profile completion (role, firm, investment strategy)	Platform experience and access tier
Deal inputs	Active use of scenario modeling features	Generating analytical outputs; not used for any other purpose

2.2 Information collected automatically

Data	Purpose
Session identifiers (cookies)	Maintaining login state for authenticated users; 30-day persistent cookie
Browser type, device type, OS	Platform compatibility and error diagnosis
IP address	Security, fraud prevention, and general geographic region (country/state level only)
Feature usage logs	Understanding which features are used to improve the platform; not linked to individual identity for analytics
Error logs	Diagnosing and fixing platform bugs

2.3 Information from OAuth providers

If you sign in with Google or LinkedIn, we receive only the data those providers make available under the scopes you authorize: typically your name, email address, profile picture URL, and a provider-specific user identifier. We do not receive passwords, contacts, or calendar data. You can review what each provider shares in their respective privacy settings.

3. Anonymous Trial Access — Special Treatment

✓ Minimal data, short retention Anonymous trial users provide only an email address. No account is created. Session data — including any deal inputs entered during the trial — is automatically deleted within 24 hours of session inactivity. ValoraLens does not retrieve, restore, or reconstruct anonymous session data after deletion. Your email is used only to send one transactional session link; you will not receive marketing emails without separate, explicit opt-in consent.

The anonymous user ID generated from your email is a one-way cryptographic hash (SHA-256). ValoraLens cannot reverse this hash to recover your original email address from the identifier alone.

4. How We Use Your Information

We use the information we collect only for the following purposes:

Delivering the platform — processing your inputs to generate scenario models and analytical outputs
Account management — authenticating your identity, maintaining your session, and managing your subscription or trial access
Platform improvement — analyzing aggregated, anonymized usage patterns to improve features and fix bugs
Security — detecting and preventing unauthorized access, fraud, or abuse
Legal compliance — meeting our obligations under applicable law, including responding to valid legal process
Communications — sending transactional emails (session links, account notices, material Terms updates) to registered users

                What we do not do: We do not sell your personal information. We do not share it with advertisers. We do not use your deal inputs to train AI models or for any purpose other than generating your requested outputs.
            

5. When We Share Information

ValoraLens does not sell, rent, or trade personal information. We share data only in the following limited circumstances:

5.1 Service providers

We use a small number of third-party service providers to operate the platform, including cloud hosting (Railway), static site hosting (Netlify), and authentication infrastructure. These providers access only the data necessary to perform their service and are bound by contractual data processing agreements.

5.2 Broker-Lender Matching (Opt-in)

🔒 Broker & Lender Data Sharing — Only With Your Explicit Consent
If you are a loan broker or lender, you may choose to list your loan products on the platform. When you do so, the following information is shared with investors who analyze deals that match your product criteria:

Loan product parameters (interest rates, terms, LTV limits, DSCR minimums, geographic availability)
Your firm name as displayed on your profile

What is NOT shared unless you explicitly request qualification:

No investor contact information is shared with you unless the investor explicitly requests qualification
No broker/lender contact information is shared with investors unless a match is made

What is NOT shared: Your personal email address, phone number, or any investor deal data beyond the property address and basic metrics required for a lender to evaluate a qualification request.

5.3 Legal requirements

We may disclose information if required to do so by law, court order, or valid governmental process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ValoraLens, our users, or the public.

5.4 Business transfers

In the event of a merger, acquisition, or sale of all or substantially all of ValoraLens's assets, user data may be transferred as part of that transaction. We will notify registered users via email before their data becomes subject to a materially different privacy policy.

5.5 With your consent

We may share information for any other purpose with your explicit prior consent.

6. Data Retention

Data type	Retention period
Anonymous trial session data (inputs, outputs)	Deleted within 24 hours of session inactivity
Anonymous user email hash	Deleted with session data
Registered account data	Retained while account is active; deleted within 30 days of account deletion request
Deal inputs (registered users)	Retained while account is active; deleted with account on request
Error and security logs	90 days, then deleted
Terms of Service acceptance records	Retained for 3 years from date of acceptance for legal compliance

7. Cookies and Session Storage

ValoraFlow uses a single persistent authentication cookie (vf_user_id) for registered users. This cookie is set for 30 days and is used solely to maintain your login session. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

Anonymous trial users do not receive a persistent cookie. Session state is maintained in browser memory only and is not persisted across sessions.

You can clear this cookie at any time through your browser settings. Clearing it will require you to sign in again on your next visit.

8. Security

ValoraLens implements industry-standard security practices appropriate for a Beta-stage B2B SaaS platform, including encrypted data transmission (TLS), hashed session identifiers, and restricted access controls on production systems.

No system is completely secure. We cannot guarantee the absolute security of information transmitted to or stored within the platform. In the event of a data breach affecting registered users' personal information, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable law.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

Access — request a copy of the personal information we hold about you
Correction — request correction of inaccurate or incomplete information
Deletion — request deletion of your personal information (subject to legal retention requirements)
Portability — request your data in a portable format
Objection — object to processing of your personal information in certain circumstances

To exercise any of these rights, contact us at privacy@valoralens.com. We will respond within 30 days. We do not charge a fee for reasonable requests.

9.1 California residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to opt out of the sale of personal information (ValoraLens does not sell personal information), and the right to non-discrimination for exercising CCPA rights. To submit a CCPA request, contact privacy@valoralens.com.

9.2 European residents (GDPR)

If you are located in the European Economic Area, our legal basis for processing your personal information is: (a) performance of a contract, for data necessary to deliver the platform; (b) legitimate interests, for security and platform improvement; and (c) your consent, where required. You have the right to lodge a complaint with your local supervisory authority. ValoraFlow is currently operated from the United States; data transfers are subject to standard contractual clauses where applicable.

10. Children's Privacy

ValoraFlow is a B2B platform designed exclusively for real estate professionals. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email at least fourteen (14) days before taking effect. The "Effective" date at the top of this page will always reflect the date of the most recent version. Continued use of the platform after the effective date of an updated policy constitutes acceptance of the changes.

For Beta release users: given the active development stage of the platform, we may update data handling practices more frequently than a mature product. We will always notify registered users of changes that affect how their data is used.

12. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or your personal information, please contact:

ValoraLens, Inc.
Privacy inquiries: privacy@valoralens.com
Legal inquiries: legal@valoralens.com
Website: valoralens.com