Privacy Policy
Last updated August 20, 2026
1. Summary
We collect the minimum needed to run the Service. We do not sell data, we do not share your documents with other users, and we do not use your content to train machine-learning models.
2. What we collect
Account data. Your email address, name if you provide one, and a hashed password if you use one. If you sign in with Google we receive your email, name and profile image from Google.
Deal data. Listing URLs and text you submit, documents you upload, notes you write, and the reports generated for you.
Billing data. Handled by Stripe. We store a Stripe customer identifier, your plan, your credit balance and a record of each order. We never see or store your card details.
Usage data. Which analyses ran, which models were used, token counts and cost, so we can operate and improve the Service. Page analytics are collected via a self-hosted Umami instance, which does not use cookies and does not track individuals across sites.
Technical data. IP address and user agent are recorded with sessions for security purposes.
3. How uploaded documents are handled
When you upload a document:
- 1.Text is extracted server-side and stored against your deal, so a re-analysis does not need to re-parse the file.
- 2.The extracted text is transmitted to the AI provider you selected, for the duration of the analysis.
- 3.Documents are accessible only to your account.
You can delete a deal and everything attached to it at any time from the deal page. Deletion is immediate and permanent.
Please do not upload documents containing personal information you are not entitled to share. Financial statements for a business under sale are normally provided under an NDA — check that yours permits processing by a service provider.
4. Third parties who process data
| Processor | Purpose | What they receive |
|---|---|---|
| AI model provider (your selection: OpenAI, Anthropic, Google, Moonshot, Zhipu or OpenRouter) | Document analysis and report generation | Extracted document text, listing content, your notes |
| Google Maps Platform | Geocoding and competitor research | The business address |
| U.S. Census Bureau | Trade-area demographics | A ZIP code |
| Internet Archive | Historical listing versions | The listing URL |
| Stripe | Payments | Your email and payment details, which go directly to Stripe |
| MongoDB Atlas | Database hosting | All stored application data |
| Amazon Web Services | File storage and email delivery | Uploaded files and outgoing mail |
| Vercel | Application hosting | Request data |
AI providers are used under their respective API terms. The major providers we use commit not to train on API-submitted data by default; we do not opt in to any training programme.
5. Retention
- Deals, documents and reports — kept until you delete them, or for twelve months after your account closes.
- Billing records — kept for seven years, as tax law requires.
- Sessions — expire after thirty days.
- Usage logs — twenty-four months.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to processing, or to withdraw consent. Write to hello@oodac.com and we will respond within thirty days.
You can delete most of your data yourself: individual deals from the deal page, and your entire account from the settings page.
7. Security
Data is encrypted in transit and at rest. Passwords are hashed with bcrypt. Sessions use signed tokens with server-side revocation. API keys and secrets are held server-side only and never reach the browser.
No system is perfectly secure. If we become aware of a breach affecting your data we will notify you promptly and in any event within seventy-two hours of becoming aware.
8. Cookies
We use one essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. Our analytics are cookieless.
Your theme preference is stored in your browser's local storage and never leaves your device.
9. Children
The Service is not intended for anyone under eighteen and we do not knowingly collect data from children.
10. International transfers
We are based in the United States and our processors operate globally. Where data is transferred out of the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses.
11. Changes
We will notify you of material changes by email or in the application before they take effect.