Privacy Policy

UADReady is a pre-submission validation and QC tool for UAD 3.6 appraisal reports, operated by ContinuousTech (“we”, “us”). This policy explains what we collect, why, and the choices you have. Questions: hello@uadready.com.

• Account data — your name and email, provided when you sign in with Google, a magic link, or email and password.
• Reports you upload — the appraisal packages and MISMO XML you submit for validation, and the findings, versions, extracts, and QC notes generated from them. The uploaded file itself is not kept; see below.
• Copilot conversations — if you are signed in, the questions you ask and the answers you get.
• Usage data — metering counts (uploads, questions), plan tier, and records of each AI model call we make for you. If you are not signed in, we meter you using a salted, irreversible hash of your IP address rather than the address itself.
• Marketing list — your email address, if you enter it into one of our update forms.
• Analytics — page views and the technical details that come with any web request; see Analytics.
• Payment data — handled by our payment processor; card details never reach our servers and we do not store them.
• Support communications — messages you send us.

These are two different things, and we treat them differently.

The file is read into memory, validated, and dropped. We keep no copy of it, we do not store it in our database, and it is never sent to the AI model. (Our web server may buffer a large upload to a temporary file for the duration of the request, which the operating system removes when the request ends.) If you are not signed in, that is the whole story — nothing about your report is kept.

The saved report is what we keep when you are signed in, so your reports are there when you return. It holds the subject street address, city, state, postal code, opinion of value, order number, property type and effective date; the name of the file you uploaded; the full compliance summary, including every finding with the value we observed in your report and where we found it; the pseudonymised extract described below; and any AI QC observations you chose to run and save. Notes you write on a finding are saved too.

Two consequences worth stating plainly. Appraisers often name photo and exhibit files after the borrower, so a borrower’s name can end up inside a stored finding message. And the extract is built and stored on every upload while you are signed in, even if you never run the AI pass.

If you are signed in, your copilot conversations are saved to your account automatically after each reply — the full thread, both your questions and the answers — so you can come back to them. There is no prompt and no setting to switch this off; you can delete any conversation from the copilot, which removes it. If you are not signed in, conversations are not saved.

You can create a share link for a report. It is a public URL: anyone who has it can open it without signing in. It shows the subject street address, city, state, postal code and opinion of value, along with your findings and any saved AI QC observations. We strip observed values, file paths and quoted text out of the findings first, but the address is not redacted. Sharing is off until you turn it on, and you can stop sharing at any time. Links do not expire on their own, and turning sharing back on reuses the same link, so treat a link you have shared as permanently disclosed to whoever received it.

To provide and improve the service: validate reports, run QC, keep your history, enforce plan limits, process payments, provide support, and secure the platform. We do not sell your personal information.

The AI QC pass is opt-in — it runs when you ask for it. What it sends to our AI provider (Anthropic) is a pseudonymised extract of your report, never your raw appraisal package and never the uploaded file.

We call it pseudonymised rather than de-identified because that is what it is. The extract leaves out the subject’s street address, and borrower, appraiser and lender names are not among the fields we pull. But it does include city, state, postal code and county, the year built and the room counts, and the opinion of value together with the contract price and date — which in combination can be enough to identify a property. It also includes nine narrative free-text fields from your report, such as your sales comparison and valuation comments. Those are scrubbed only for number runs that look like an identifier, so any name or address you typed into a comment is sent as written.

We do not send your data to any provider for the purpose of training models. Anthropic’s commercial terms state that they do not train on API inputs, and that is the basis for this; we have not negotiated a separate data processing agreement or a zero-retention arrangement on top of it. The copilot’s answers are grounded in our own knowledge base, and your questions are sent to the model to generate a response.

We keep a record of each model call — which model, how many tokens, how long it took, whether it failed — for cost and reliability. Those records never contain your prompt or the answer.

• Supabase — authentication and database hosting.
• Anthropic — the AI model behind the copilot and AI QC pass.
• Google — optional OAuth sign-in, and Google Analytics.
• Razorpay — payment processing for paid plans.

Each processes data only to perform services for us, under their own terms.

We use Google Analytics 4. It runs with Google’s consent mode set to deny storage by default, so it does not write analytics cookies or any other identifier to your device, and we have not built a prompt that would ask you to turn that on. It measures page views across the whole site, including the pages you use to work on a report.

Measuring a page view sends Google the page address and title, the page that referred you, your browser’s user agent, language and screen size, and your IP address. It also sends a randomly generated identifier for that page view; because nothing is stored on your device, a new one is generated each time and it cannot be used to follow you between pages or visits.

Separately, our pages load two typefaces from Google Fonts. That request reaches Google from your browser on every page, and like any web request it carries your IP address and user agent. It sets no cookies.

If you enter your email address into one of our update forms — the “stay current” box on our home page, or the one in our footer — we store that address, which form you used, and the date, and we may email you about UAD 3.6 changes, new guides, and UADReady product news. Submitting the form is what we record as your agreement to that; we do not ask you to tick a box, and we do not add you to this list just because you created an account. There is no unsubscribe link in the product yet. To be taken off the list, email hello@uadready.com and we will delete your address.

We keep your account, your reports and your conversations while your account is active. We do not currently run anything that deletes them automatically after a set period — data you create stays until you or we remove it.

You can delete a report at any time, and you can delete any copilot conversation. To have your account and the data associated with it deleted, email hello@uadready.com — there is no self-service button for this yet, and we will confirm when it is done. The records of individual AI model calls described above are kept for cost and reliability accounting and are not tied to your account once it is deleted; they contain no report content and no message content. Backups are purged on a rolling schedule.

We use TLS encryption in transit, access controls, and row-level security to protect your data. Card details are handled by our payment processor and never reach our servers, and we store a salted, irreversible hash of a visitor’s IP address rather than the address itself. No system is perfectly secure; we work to protect your information and to notify you of material incidents where required.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. Contact us to exercise them.

We use essential cookies for sign-in and session management. Product analytics runs with storage consent denied by default, so it sets no analytics cookies on your device; if we ever ask for that consent, it will be through a visible prompt, and you can decline. You can also block cookies in your browser — sign-in will stop working, the rest of the site will not.

We operate from India and serve users in the United States and elsewhere. Your data may be processed in countries other than your own, with appropriate safeguards.

We may update this policy; material changes will be posted here with a new date. See also our Terms of Service and Refund & Cancellation Policy. Contact hello@uadready.com.