Privacy Policy

Your data is yours. We collect only what we need, we never sell it, and we explain everything below. This policy covers all Speculy LLC (“Speculy”) products and services.

What we collect

Account. Name and email to identify your account. We never use your name in marketing without permission.

Property data. Addresses you search, properties you view, appraisal district data corrections you submit, and properties you save or protest. This is how the product works.

Assistant conversations. If you use the Speculy Assistant (our optional AI co-pilot), the messages you type are sent to our AI providers to generate a response and to check the message for safety. Your live conversation is held only in memory to answer you during your session — it is not stored in our database after the session ends, and a server restart clears it. We keep an operational log of each exchange (such as timing, usage counts, the outcome, and any flagged safety event — which may include a short excerpt of text flagged as a security or abuse attempt) for security, abuse-prevention, and to keep the feature within its limits. We use your messages to answer you; we do not sell them.

Billing. If you upgrade to a paid plan, payment goes directly to Stripe. We store only the last 4 digits, billing address, and transaction record. We never see your full card number.

Sensitive information. During the exemption review, you may provide age (65+), disability, or military status to claim tax exemptions. We may pre-populate these fields from your public appraisal district tax records for convenience — you can change or remove any selection before filing. We use this information solely to prepare your filing documents. We never share or sell it. You can withdraw consent anytime by unchecking the boxes or changing your answers, or by emailing support@speculy.ai. We keep it only as long as we need it for your filing and our records, and you can ask us to delete it at any time.

Consent records. When you accept Terms or acknowledge a legal notice, we record the version, timestamp, IP address, and a hash of any narrative text you approved. After account deletion, we replace your identifiers with a one-way hash (pseudonymization) and retain the record for 7 years for legal defense. Then we delete it.

Technical data. IP address (for security and fraud prevention), browser type, pages visited, and load times. Used for analytics and improving the product. Tied to your account while active.

Cookies. We use one essential cookie — your authentication session (HttpOnly, Secure, SameSite) via Supabase. Required for login. We honor Global Privacy Control (GPC) signals.

Public appraisal district records. Property names, addresses, and valuations come from public appraisal district data (e.g. HCAD, FBCAD, MCAD) under the Texas Public Information Act. This is already publicly available and is not your personal data.

Third-party processors

We use a small number of services to run Speculy. None receive your data for their own purposes.

• Supabase — authentication and database (US)
• Stripe — payment processing (US)
• Sentry — error monitoring (US)
• Render — web hosting (US)
• Cloudflare — CDN, DDoS protection, bot detection (US)
• Mapbox — base map tiles only (US)
• OpenAI — content moderation for narrative editing and Speculy Assistant messages (US)
• Anthropic — AI provider that powers the Speculy Assistant's responses (US)

We do not sell or share your data with any other third party.

Your rights

These rights apply to all users regardless of state:

• Know what we collect (this policy)
• Access your data (email us or check account settings)
• Correct inaccurate data
• Delete your data and account
• Export your data (portability)
• Opt out of sale of data (we never sell — but the right is yours)
• Opt out of profiling for decisions with legal effect
• Request human review of automated decisions
• Not be discriminated against for exercising these rights

Texas residents: You have additional rights under the TDPSA (Tex. Bus. & Com. Code Ch. 541), including opting out of targeted advertising (we don't do this) and profiling.

California residents: Under CCPA/CPRA, you may request categories of data collected in the last 12 months. We do not sell personal information. We do not use sensitive information beyond what's needed for your filing.

To exercise any right: email support@speculy.ai or use your account settings. We respond within 45 days (up to 90 with notice).

Security

Encrypted in transit (TLS 1.3) and at rest (AES-256-GCM). Passwords hashed with Argon2. All database queries parameterized. Per-route API rate limiting. Leaked password detection (HIBP). Sensitive data stored separately with shorter retention.

No system is perfectly secure. In the event of a breach, we notify affected users per Texas Business & Commerce Code § 521.053 and applicable state laws.

Automated decisions

Speculy uses algorithms and AI to generate protest recommendations, narratives, and comparable selections. These are informational — not decisions with legal effect. You decide what to file. You may request human review or opt out of profiling by emailing support@speculy.ai.

Data retention

We keep your information for as long as we need it to provide Speculy and to meet our legal, tax, and record-keeping obligations. Some records — including your protest records and consent logs — are kept after your account closes so we can support and defend the work we did for you; where we can, we minimize or pseudonymize them. You can ask us to delete your personal data at any time (see “Account deletion”).

Account deletion

You can cancel your account and ask us to delete your personal data at any time by emailing support@speculy.ai. We honor deletion requests, except for information we are permitted or required to keep — for example, to meet legal or tax obligations or to support and defend the protest work we did on your behalf.

Children

Speculy is for adult property owners. We do not knowingly collect data from anyone under 13 (COPPA, 15 U.S.C. § 6501). If you believe a child has provided us data, email support@speculy.ai and we will delete it.

No data sales

We have never sold personal data. We will never sell personal data.

Changes

We update this policy as needed. Material changes get a new version date. Continued use means acceptance.

Contact

Speculy LLC · Harris County, Texas
support@speculy.ai