Privacy Policy

1. Information we collect

Information you provide

• Contact details — name, email, phone number, city, state, and any message you submit through our contact, lead, cash-offer, or inquiry forms.
• Account information — if you sign up as an agent or business owner: email, password (hashed, never stored in plaintext), display name, and profile details you choose to publish (bio, photo, service areas, business description, hours, social links, etc.).
• Property details — if you use the cash-offer flow: property address and any characteristics you provide or confirm.
• Payment details — if you subscribe as an agent or business owner: payment is processed by Stripe. Your card number and CVC never touch our servers. We store Stripe's customer and subscription identifiers so we can recognize you across future interactions and honor your subscription.

Information collected automatically

• First-party analytics — each page load sends us the URL you visited, the referring URL (if any), your browser's user-agent string, and a session identifier scoped to your browser tab. We also record a hashed fingerprint derived from your IP address and user-agent (SHA-256, truncated to 24 characters). We do not store raw IP addresses.
• Authentication cookie — if you log in, we set one HttpOnly cookie named auth_session. This is a signed JSON Web Token containing your user ID and role. It expires after 24 hours.

2. How we use your information

• To respond to inquiries and match buyers/sellers with independently licensed real estate professionals.
• To generate cash-offer estimates (when you request one) using third-party property data.
• To operate agent and business-owner accounts — including profile management, Stripe-based subscriptions, and transactional emails (welcome, receipts, password resets, approval notifications).
• To measure traffic, identify popular pages, and improve the site (via our first-party analytics — no Google Analytics or similar third-party tracker is used).
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

3. Third-party services we share data with

We do not sell your personal information. We share only what's necessary with the following service providers, each covered by their own privacy policies:

• Stripe — payment processing. Receives your email and (at checkout) your payment method.
• HubSpot — our customer-relationship management (CRM) system, hosted in the United States. When you submit a lead, contact, or inquiry form, we store your contact details and message in HubSpot so our team and the matched agent can follow up and keep track of the conversation.
• Google — Maps and Places APIs used to display maps and autocomplete addresses. When you select a suggested address, Google may log that request.
• Cloudinary — stores images you upload (profile photos, business photos, lake imagery).
• RentCast — if you use the cash-offer flow, we look up property data by the address you provide.
• Resend / Gmail (Google) — delivers transactional emails from our domain.
• Neon — hosts our PostgreSQL database in the United States.
• Render — hosts our application servers in the United States.
• OpenAI — used for certain admin-only assistant features. No end-user personal information is sent to OpenAI during ordinary site usage.

We may also disclose information when required by law, to respond to valid legal process, or to protect our rights, property, or safety (or the rights, property, or safety of others).

4. Lead-sharing with agents

If you submit a lead or contact form, we may share your name, email, phone, message, and property address with one or more independently licensed real estate agents in our network whose service area includes your location. Those agents will contact you directly. We do not require you to use them — the match is informational and any real estate transaction you enter into is between you and the agent's brokerage.

5. Data retention

We retain your information for as long as your account is active or as needed to provide the Service, and as required for legal or regulatory compliance. You can request deletion of your account and associated data at any time (see "Your rights," below). Archived records may be retained for a limited period to satisfy legal obligations, resolve disputes, and enforce our agreements.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your information (subject to limited exceptions for records we're required to keep).
• Opt out of marketing communications at any time — email us, or click the unsubscribe link in any marketing email.
• If you are a California resident: additional rights under the CCPA/CPRA, including the right to know what categories of personal information we have collected and who we shared it with in the past 12 months. We do not sell personal information.
• If you are in the European Economic Area or United Kingdom: rights under GDPR including data portability and the right to lodge a complaint with your supervisory authority.

To exercise any right, email us at minnesotalakehomesforsale@gmail.com. We'll respond within 30 days.

7. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13 without verifiable parental consent, we will delete that information.

8. Security

We use TLS encryption in transit, hashed passwords (bcrypt), HttpOnly + secure session cookies, and server-side signature verification on all payment webhook events. No method of transmission over the Internet is 100% secure, so we cannot guarantee absolute security, but we take commercially reasonable steps to protect your information.

9. International users

The Service is operated from the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data-protection laws than your country of residence.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with a new "Last updated" date. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact us