Privacy Policy

Introduction

Galleon Technologies, Inc., a Delaware corporation ("Galleon," "we," "us," or "our"), operates Operator, software for real estate investors. This Privacy Policy explains how we collect, use, and share information through our website at galleon.io, the Operator web application, and all related services (collectively, the "Services").

This Privacy Policy does not apply to third-party websites, services, or applications, even if they are accessible through the Services.

Revisions to This Privacy Policy

Information we collect is covered by the Privacy Policy in effect at the time of collection. We may revise this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy within the Services or by sending you an email, and we will update the "Last Updated" date above. Your continued use of the Services after changes become effective constitutes acceptance of the revised Policy.

Scope

This Privacy Policy applies to all users of the Services, including site visitors, trial users, and account holders. Users must be 18 years of age or older. We do not knowingly collect information from individuals under 18. If you believe we have inadvertently received information from a minor, contact us at info@galleon.io and we will delete it promptly.

Information We Collect

Information You Provide Directly

Account Information. When you create an account, including through third-party authentication services, we collect your name and email address. When you start a trial, we also collect a payment method through our payment processor as described below.

Portfolio Data. When you use Operator to track what you own, we collect: property addresses and descriptions; deal details including purchase price, financing terms, rental income, and operating expenses; valuation data and transaction history; property-level data you provide such as purchase date, conversion-to-rental date, refinance history, and capital contributions; and notes and custom data you add to properties.

Buy Box Criteria. When you use the Buy Box Agent, we collect the acquisition criteria you define, including target price range, property type, geographic filters, bedroom count, exclusions, and any additional screening parameters you configure. This criteria is transmitted to third-party data providers to surface matching properties. See the Buy Box Agent and Third-Party Data Providers sections below.

Profile Information. You may optionally provide additional profile information including a username, location, or short bio.

Communications. When you contact us for support or with feedback, we collect your name, email address, and the content of your communication.

Payment Information. Payments are processed by Stripe, Inc. We do not retain credit card numbers or personally identifiable financial information. Payment processing is governed by Stripe's privacy policy at stripe.com/privacy.

Information Collected Automatically

Device and Technical Information. When you use the Services, we may collect: IP address, user agent information, network and connectivity information, device identifiers, language preferences, and browser and operating system information.

Location Information. We may derive a general geographic location from your IP address. We do not collect precise location data.

Cookies and Web Technologies. We use cookies, web beacons, and similar technologies for: Necessary Cookies (user authentication and account security); Performance Cookies (site traffic and usage analysis); Preference Cookies (storing your settings and preferences); Analytics Cookies (usage tracking via Google Analytics and PostHog). You may refuse cookies through your browser settings, though some features may not function properly if you do.

Interaction Data. We collect information about actions you take while logged in, such as which tools you use, which properties you view, and how you navigate the product. We use PostHog for this. PostHog's privacy policy is at posthog.com/privacy.

How We Use Your Information

We use the information we collect for:

• Providing the Services: tracking what you own, lender-ready PDF export, rent monitoring via the Rent Monitoring Agent, on-market and off-market monitoring via the Buy Box Agent, and customer support
• Account Administration: creating and maintaining your account, verifying identity, and ensuring account security
• Payments: processing trials, subscriptions, and billing
• Product Improvement: understanding usage patterns, identifying bugs, and improving features through aggregated, de-identified analysis
• Communications: sending product updates, billing information, trial and renewal reminders, and security alerts. You may opt out of promotional emails but cannot opt out of essential account communications
• Legal Compliance: enforcing our Terms of Use, responding to valid legal requests, and detecting fraud
• Fraud Prevention: detecting unauthorized activity and protecting account and platform security

Third-Party Data Providers

Operator integrates with third-party data providers to deliver core product functionality. The following providers may receive property-level information as described:

Property Valuation, Attribute, and Ownership Data

REAPI: receives property addresses to return real estate valuation and comparable sales data, including automated valuation model (AVM) estimates used to populate property values, and receives buy box criteria to return matching on-market and off-market properties.

BatchData: receives property addresses and buy box criteria to return property attribute data and enrichment for the Buy Box Agent, including ownership status, estimated loan balance, distress indicators, and years owned.

Rent Comparable Data

Rentometer: receives property addresses to return rent comparable data by bedroom count and location, used by the Rent Monitoring Agent to benchmark units against current market rents.

Buy Box Agent

When the Buy Box Agent is active, Operator stores your buy box criteria in your account and transmits it to REAPI and BatchData on a continuous basis to surface on-market listings and off-market properties matching your criteria. Enrichment data is retrieved for properties that pass your filters.

The following applies:

• Your buy box criteria are transmitted only for the purpose of returning matching properties. They are not used for advertising, profiling, or any purpose other than executing the search on your behalf.
• REAPI and BatchData are contractually prohibited from using your criteria for any purpose beyond returning results for your account.
• Disabling a buy box in your account settings stops transmission of that criteria to data providers.
• You may update or delete your buy box criteria at any time through your account settings.

Information About Property Owners

The Buy Box Agent displays information about properties and their owners, including owners who are not Operator users. This may include ownership type (for example, absentee, out of state, corporate, or inherited), estimated loan balance, tax delinquency, foreclosure status, and how long a property has been held.

This information is not collected by Galleon. It comes from public records and from our licensed Data Providers, who compile it from public and commercial sources. We display it to help our users evaluate properties. We do not sell it, use it for advertising, or make it available outside the Services.

Our users are required by our Terms of Use to use this information only for their own real estate investment activities and in compliance with all applicable laws, and are prohibited from redistributing it or using it for credit, insurance, employment, or tenant screening decisions.

If you are a property owner and would like your property suppressed from Buy Box Agent results, contact us at info@galleon.io with the property address. We will act on verified requests within 30 days. Because the underlying data comes from Data Providers and public records, suppression applies to Operator only and does not remove the information from its original sources.

Use of Language Models

Operator's agents use large language models provided by third parties to perform certain tasks, such as interpreting buy box criteria, summarizing property data, and generating alerts. When an agent performs one of these tasks, the data needed for that task, which may include property addresses, property attributes, your criteria, and your rent and financial figures, is transmitted to the model provider for processing.

We currently use [LLM provider] under terms that prohibit the provider from using your data to train its models. Data is transmitted only for the task at hand and is not retained by the provider beyond what is needed to return a result, subject to the provider's own policies. We do not use any model provider that trains on customer data.

We do not feed your individual Portfolio Data into any model for the purpose of training, and no model provider has standing access to your account.

Information You Should Not Store in Operator

Operator will not prevent you from entering certain types of sensitive information, but we strongly advise against storing the following in the Services:

• Bank account passwords or login credentials
• Social Security numbers or tax identification numbers
• Tenant personally identifiable information such as names, email addresses, or phone numbers
• Sensitive personal documents such as divorce decrees or wills

These data types fall outside Operator's core functionality, create unnecessary security risk, and are not encrypted differently than other data. All data receives the same encryption protection regardless of sensitivity.

Product Analytics and De-Identified Data

We analyze usage data in aggregate, de-identified form to understand and improve the product. Examples include: average deal metrics by geography; popular features and usage patterns; portfolio size distribution across the user base; and market trends visible across aggregated, anonymized portfolios.

De-identification standard: we strip your name, email address, account ID, and all personal identifiers before any analysis. We aggregate across a minimum of 5 to 10 users per data point and do not report on small cohorts that could identify you. Individual deal details and property addresses are never included in aggregate analytics.

We do not sell your data to third parties. We do not share your portfolio with competitors, investors, or researchers. We do not use your data for targeted advertising or marketing. We do not license our analytics to any real estate platform.

Automated Decision-Making

Operator's agents generate alerts and surface properties based on criteria you set and data from our providers. They do not make decisions that produce legal or similarly significant effects about you. Every alert and match is information for you to act on or ignore.

Planned Features

The following feature is on our roadmap but not yet available. This policy will be updated, with notice, before it launches.

Document Storage

We plan to add the ability to store property photos, mortgage documents, repair receipts, and other deal-related files in a future release. When available, documents will be encrypted at rest (AES-256) on AWS US East infrastructure and will not be shared with data processors unless you explicitly export them. We will not scan document content for analytics purposes.

Data Storage and Security

All Operator data is stored on Amazon Web Services (AWS) US East (N. Virginia) data centers. Data is encrypted in transit using TLS 1.3 and at rest using AES-256. Backups are stored in geographically redundant AWS facilities within the United States. We do not transfer data outside the US for processing, except to the extent a model provider or Data Provider described in this policy processes data outside the US under its own terms.

We implement reasonable administrative, physical, and electronic measures to protect information from unauthorized access, use, or disclosure, including restricted server access with logging and two-factor authentication for critical systems.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. If we discover a security breach affecting your information, we will notify you by email or by posting a notice within the Services.

Data Retention

Trial Accounts

If your trial ends without converting to a paid subscription, your Portfolio Data is retained for 90 days so you can come back and pick up where you left off. After 90 days, it is permanently deleted.

Active Accounts

Portfolio Data is retained for the duration of your subscription.

Cancelled Subscriptions

If you cancel your subscription, your Portfolio Data is retained for 90 days from the end of your final billing period, during which you may download a complete export in CSV format or resubscribe. After 90 days, all Portfolio Data is permanently deleted.

Inactive Accounts

If a paid account has no login activity for 12 consecutive months, we will send a warning notification to your registered email address. If you do not log in within 60 days of that notice, we may delete your account and all associated Portfolio Data. You can prevent deletion by logging in at any time before the 60-day window closes.

Account Deletion Requests

You may request immediate account deletion at any time through Settings or by contacting info@galleon.io. Upon deletion:

• Live Portfolio Data is deleted immediately
• Backup copies are retained for 30 days, then permanently purged
• You have 30 days following deletion to contact us for data recovery (restoration is not guaranteed)

Fraud and Security Holds

If your account is disabled for fraud or security reasons, we may retain account information indefinitely to prevent future abuse, even if you are an active subscriber.

Data Portability

You may export your complete Portfolio Data at any time in portable CSV format through your account settings. This allows you to migrate to another platform if desired. Exports do not include access logs or system metadata.

Information Shared with Third Parties

We share your information with third parties only in the following circumstances:

• Service Providers. We engage third-party service providers including cloud hosting (AWS), payment processing (Stripe), product analytics (PostHog, Google Analytics), language model processing (see Use of Language Models above), [error monitoring and customer support tooling, if any], and email delivery. These providers have access to your information only to perform services on our behalf and are contractually prohibited from using it for other purposes.
• Data Providers. We share property addresses and buy box criteria with REAPI, BatchData, and Rentometer as described in the Third-Party Data Providers and Buy Box Agent sections above.
• At Your Request. We may share your information when you explicitly request it, such as when you export Portfolio Data for a lender or advisor.
• Aggregated and De-Identified Data. We may share de-identified, aggregated data derived from use of the Services. This data is not tied to your identity.
• Business Transactions. If Galleon is acquired, merged, or subject to a sale of assets, your Personal Data may be transferred to the acquiring party. We will provide notice before your data becomes subject to a different privacy policy.
• Legal Requirements. We may disclose information to government or law enforcement officials if required by law or in response to valid legal process, including subpoenas and court orders.
• Protection of Rights. We may disclose information to protect our property, rights, and safety or those of third parties, including to detect fraud, investigate Terms violations, and address security issues.

We do not share your data with marketing partners, advertising networks, data brokers, competitors, or third-party researchers.

Your Choices

Email Communications

We send product updates, billing information, trial and renewal reminders, and security alerts. You may opt out of promotional emails through your account settings or by following the unsubscribe instructions in any promotional email. You cannot opt out of essential account communications including billing notices, trial and renewal reminders, Terms updates, and security alerts.

Cookies

You may opt out of non-essential cookies by configuring your browser settings or using cookie-blocking browser extensions. Opting out of necessary cookies may impair core product functionality.

Do Not Track

The Services do not currently respond to Do Not Track browser signals, because there is no accepted standard for how those signals should be interpreted. You may limit tracking as described in the Cookies section above.

Modifying Your Information

You may access and update the Personal Data associated with your account by logging in. To request deletion of your Personal Data or your account, contact us at info@galleon.io.

Your Privacy Rights

Depending on the laws applicable in your jurisdiction, you may have the following rights with respect to your Personal Data: Access; Correction; Deletion; Portability; Objection; Withdraw Consent. To exercise any of these rights, contact us at info@galleon.io. We will respond within the timeframe required by applicable law.

California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA): Right to Know; Right to Know What We Share (we do not sell your Personal Data); Right to Opt Out of Sale or Sharing (we do not sell or share Personal Data for cross-context behavioral advertising; if we ever do, we will provide a method to opt out); Right to Delete; Right to Correct; Non-Discrimination. You may submit two free requests within any 12-month period. We will respond within 45 days, extendable to 90 days if necessary. To make a CCPA request, contact us at info@galleon.io and state that you are a California resident. We will verify your identity before processing the request.

Property Owners Who Are Not Users

If you are a property owner whose information appears in the Services and you wish to exercise privacy rights with respect to that information, see the Information About Property Owners section above.

Links to Third-Party Sites

The Services may contain links to third-party websites and services we do not own or control. We are not responsible for the content, privacy policies, or practices of any third-party sites. We encourage you to review the privacy policies of any third-party services you access through the Services.

Processing in the United States

We are headquartered in the United States. Your Personal Data is processed and stored on servers located in the US East (N. Virginia) AWS data centers. By using the Services, you consent to the transfer of your information to the United States. We implement security measures consistent with applicable law to protect your data from unauthorized access or disclosure.

Contact Us

If you have questions about your Personal Data, our data practices, or this Privacy Policy, contact us at:

Galleon Technologies, Inc.
697 3rd Ave., Suite #222
New York, NY 10017
info@galleon.io