Privacy Policy — Andrivex, by HabiLink
Effective Date: September 25, 2026
Last Updated: September 25, 2026
This Privacy Policy describes how HabiLink LLC (“we,” “us,” “our,” or “HabiLink”) collects, uses, retains, and discloses personal information through Andrivex (the “Service”). Andrivex is currently available at analyze.habilink.com and will be available at andrivex.com. This Privacy Policy applies to the Service regardless of the web address at which you access it. This Privacy Policy applies only to Andrivex. It does not apply to the separate HabiLink introduction platform, which has its own privacy policy.
HabiLink LLC is located at 4930 Campus Drive, Newport Beach, CA 92660.
1. Information We Collect
We collect the following categories of personal information:
| Category | What We Collect | Where It Is Kept |
|---|---|---|
| Account | Your name and email address, sign-in credentials | Clerk (authentication provider) |
| Deal inputs | Property address, after-repair value (ARV), rehab estimate, profit target, cost buffer, fee, asking price, property details (beds, baths, square feet, year built, lot size) | Supabase database (saved deals) |
| Pasted deal text | Free text you paste to fill the form (may contain names, phone numbers, or other third-party details) | Sent to Anthropic for parsing; not stored by the app beyond the parsed fields |
| AI analysis | AI-generated risk flags, scenarios, confidence notes, and version comparisons | Supabase database |
| Role | “Buyer” or “Deal Source” | Supabase database and your browser’s local storage |
| Purchases | Stripe checkout session ID, amount, deal address, user ID (no card data) | Supabase database; card data is handled by Stripe only |
| Report email | Recipient email address; the sender’s name and email are shown in the email | Sent through Resend; recipient address is not stored |
| Opt-outs | One-way SHA-256 hash of an opted-out recipient’s email address | Supabase database |
| Usage analytics | Page views | Vercel Analytics |
| Browser storage | Calculator state for the current session; saved role | Browser session storage and local storage |
We do not knowingly collect personal information from children under 18. If you believe we have collected personal information from a child under 18, please contact us at the address listed in Section 11.
2. How We Use Your Information
We use your personal information to:
- Provide the Service, including calculations, analysis, reports, and educational content
- Process payments and manage your purchases
- Send report emails at your request
- Maintain your account and authenticate your identity
- Remember your role (“Buyer” or “Deal Source”) and calculator state
- Maintain the email opt-out list so opted-out recipients are never emailed again
- Improve the Service, including product analytics and feature development
- Comply with legal obligations
We do not use your deal data to make transaction recommendations, solicit buyers or sellers, or facilitate real estate transactions.
3. Third Parties Who Receive Your Information
We disclose your personal information to third parties in two categories: service providers and other third parties.
Service providers process your information on our behalf under written contracts that include all of the prohibitions required by the California Consumer Privacy Act (CCPA): they are prohibited from selling or sharing your information, from using it for any purpose other than providing the services we have engaged them to perform, from retaining or disclosing it outside our business relationship, and from combining it with information from other sources.
Other third parties receive your information in one of two ways: (a) as independent controllers that determine the purposes and means of processing independently under their own privacy policies, or (b) as vendors that process information on our behalf but whose standard published contracts do not include all four CCPA-required service provider prohibitions. Where a third party’s contract does not include all CCPA-required prohibitions, we disclose that fact here in the interest of transparency.
We do not sell your personal information for monetary or other valuable consideration. We do not share your personal information for cross-context behavioral advertising. Disclosures to the third parties listed below are made to enable the services they provide to us, not in exchange for consideration for your data.
Service Providers
The following third parties process your personal information as our service providers. Their contracts include all CCPA-required service provider prohibitions:
| Service | What They Receive | Purpose |
|---|---|---|
| Anthropic | Pasted deal text; deal figures and address for paid analysis | AI parsing and analysis. Inputs and outputs are deleted within 30 days (up to 2 years for content flagged under Anthropic’s usage policy). |
| Supabase | Saved deals, role, purchases, opt-out hashes | Database hosting |
| Stripe (as processor) | Payment details, deal address in the product description | Payment processing |
Disclosures to these service providers are made for our business purposes and are not “sales” or “sharing” as defined under the CCPA.
Other Third Parties
The following third parties receive your personal information. Some act as independent controllers; others process data on our behalf but their standard contracts do not include all CCPA-required service provider prohibitions. We identify the basis for each disclosure below.
| Service | What They Receive | Purpose | Basis | Privacy Policy |
|---|---|---|---|---|
| Google Maps Platform | Address text as typed (search queries), IP address, and geographic coordinates | Providing and improving Google Maps and other Google products and services | Independent controller. Google collects and processes this data under the Google Privacy Policy. Maps Platform Terms §4.4. | Google Privacy Policy |
| Stripe (as controller) | Payment and transaction data for fraud prevention, risk assessment, compliance, and developing Stripe’s own services | Fraud prevention, risk, compliance, and product development | Independent controller. Stripe processes this data under the Stripe Privacy Policy. Stripe DPA §2. | Stripe Privacy Policy |
| Resend | Recipient email address, email content, attached PDF (for delivery); send logs including source and destination email addresses | Email delivery; operating, improving, and securing the Resend platform (send logs retained 30 days) | Resend processes email delivery on our behalf, but its standard contract does not include the “sharing” and “combining” prohibitions required by CCPA § 1798.140(ag)(1). Resend also acts as an independent controller for send logs. | Resend Privacy Policy |
| Clerk | Name, email, credentials, and account information | Sign-in, account management, and operating, improving, and securing the Clerk authentication platform | Clerk processes authentication on our behalf, but the scope of “Account Information” for which Clerk acts as an independent controller is unclear. We disclose Clerk as an independent controller for all data it receives as a conservative measure. | Clerk Privacy Policy |
| Vercel | Application data routed through Vercel’s hosting and analytics services (Customer Data); service-generated data (usage data, metadata) and contact data | Web hosting and page-view analytics (Customer Data); operating, improving, and supporting Vercel’s services (service-generated data) | Vercel processes Customer Data on our behalf. Its standard DPA California schedule may not include an explicit “combining” prohibition required by CCPA § 1798.140(ag)(1)(D). Vercel also acts as an independent controller for service-generated data and contact data. | Vercel Privacy Policy |
When you use the Service, certain personal information is transmitted directly to these third parties. For example, when you type an address in the address field, the text you type is sent to Google Maps Platform, which processes it as an independent controller under the Google Privacy Policy. When you make a payment, transaction data is sent to Stripe, which processes it for fraud prevention and its own business purposes under the Stripe Privacy Policy.
For Google Maps Platform, your use of Google Maps features and content is also subject to the Google Maps End User Additional Terms of Service and the Google Privacy Policy, as described in Section 13 of the Terms of Service.
We encourage you to review the privacy policies of these third parties to understand how they use and retain your information.
4. AI and Your Data
The Service uses artificial intelligence (AI) provided by Anthropic to generate analytical content including risk flags, scenarios, confidence notes, and version comparisons. When you paste deal text or enter deal figures, that information is sent to Anthropic for processing. Anthropic processes this information as a service provider under a written contract. We do not store the raw pasted text beyond the parsed fields that are saved to your deal.
Some content in your analysis may be generated or assisted by AI. AI-generated content describes mathematical relationships based on your inputs and is not professional advice, a transaction recommendation, or a guarantee of results. AI-generated content is labelled in the Service. See Section 4 of the Terms of Service for AI content terms.
5. Data Retention
We retain your personal information according to the following schedule:
| Category | Retention Period |
|---|---|
| Account and profile data | Life of the account plus 4 years after closure |
| Saved deals (inputs and AI outputs) | Life of the account plus 4 years after closure |
| Purchase and billing records | 7 years |
| Terms and Privacy acceptance evidence | 7 years after account closure |
| Legacy introduction requests (feature removed) | 2 years after closure |
| Access and security logs | 2 years |
| Privacy request records | 4 years |
| Backups | 90-day rolling |
| AI prompts | Not stored by the application |
| Report-email opt-out list | Retained indefinitely so opted-out addresses are never emailed again |
The opt-out list stores only a one-way SHA-256 hash of the email address, not the plaintext address. Retaining this hash indefinitely is necessary to prevent opted-out recipients from receiving future emails. This retention is consistent with CCPA Section 1798.105(c)(2), which permits businesses to maintain confidential records for compliance purposes.
6. Your Privacy Rights
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting the information, and the categories of third parties to whom we have disclosed the information.
Right to Delete: You may request that we delete your personal information from our records. We will delete your information and notify our service providers to do the same, subject to the exceptions described in Section 7 below.
Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
Right to Opt Out: You may opt out of any “sale” or “sharing” of your personal information under the California Consumer Privacy Act. We do not sell your personal information for monetary or other valuable consideration. We do not share your personal information for cross-context behavioral advertising. Because we do not sell or share your personal information, a “Do Not Sell or Share My Personal Information” opt-out link is not required and has not been provided. If our practices change in the future such that we sell or share personal information, we will provide the opt-out link required by California law at that time.
Right to Limit: You may request that we limit our use and disclosure of your sensitive personal information. The Service does not collect sensitive personal information as defined by the CCPA.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
7. Deletion Right — Shared Account System
Your account is managed by Clerk, which provides authentication for both Andrivex and the separate HabiLink introduction platform. When you request deletion of your personal information, we will delete all data associated with Andrivex, including:
- Your saved deals and AI analysis outputs from Supabase
- Your role and browser-stored data
- Your purchase records (subject to the 7-year retention requirement for billing records; see Section 5)
- Your Terms and Privacy acceptance evidence (subject to the 7-year retention requirement)
Deletion of your Andrivex data does not affect data held in the separate HabiLink introduction platform. If you wish to delete your account entirely (both platforms), please specify this in your request.
We will instruct our service providers (Anthropic, Supabase, Clerk, Stripe, Resend, Vercel Analytics, Google Places) to delete your personal information from their records to the extent technically feasible, unless retention is required by law or the service provider’s contract.
Note on opt-out list: The email opt-out list stores only a one-way hash. When you submit a deletion request, we will delete your account data but will retain the hash of any email address you previously added to the opt-out list, as this serves solely to prevent future emails. Deleting this hash would result in the email address being re-emailable.
Note on vendor retention periods. When you submit a deletion request, we will instruct our service providers and independent controllers to delete your personal information from their records. However, some providers may retain your information for a period specified in their own terms before it is deleted. The following retention periods apply:
| Provider | Data Retained | Retention Period |
|---|---|---|
| Anthropic | API inputs and outputs | Deleted within 30 days. Content flagged under Anthropic’s usage policy may be retained for up to 2 years. |
| Resend | Send logs (source and destination of messages) | 30 days |
| Google Maps Platform | Address queries, IP addresses, geographic coordinates | Retained according to the Google Privacy Policy |
| Stripe | Payment and transaction data | Retained according to the Stripe Privacy Policy |
| Clerk | Account information | Retained according to the Clerk Privacy Policy |
| Vercel | Service-generated data and contact data | Retained according to the Vercel Privacy Policy |
We will make commercially reasonable efforts to ensure that your personal information is deleted from vendor systems as promptly as each vendor’s retention policy permits.
8. Do Not Track Signals
We do not currently respond to “Do Not Track” signals sent by your web browser. We use Vercel Analytics, which collects page-view data. Vercel Analytics does not use cookies. It collects page-view data through privacy-friendly, cookieless tracking. For more information on how Vercel Analytics handles tracking, see Vercel’s privacy policy at https://vercel.com/legal/privacy-policy.
We will update this section if our practices regarding Do Not Track signals change.
9. Cookie and Analytics Notice
We use Vercel Analytics to collect page-view data for the purpose of understanding how visitors use our website and improving the Service. Vercel Analytics does not use cookies. It collects page-view data through privacy-friendly, cookieless tracking. The data collected includes page views and does not include your name, email address, or deal data.
You may opt out of analytics tracking by enabling the “Do Not Track” setting in your browser, although we do not currently respond to this signal.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last Updated” date at the top. If we make material changes, we will notify you by email or by posting a conspicuous notice on the Service. We recommend that you review this page periodically to stay informed about how we collect and use your information.
11. Contact Us
If you have questions about this Privacy Policy or wish to exercise any of your privacy rights, please contact us at:
HabiLink LLC 4930 Campus Drive Newport Beach, CA 92660
Email: privacy@habilink.com
You may submit a privacy request using the email address above. We will verify your identity before responding to your request. We will respond to your request within 45 days, as required by California law.