Privacy · Rental Market Data

1What is collected

When you connect (the consent page)

A random connection id: A UUID. It is not derived from anything about you.
A hash of your IP address: sha256 of the IP plus a salt that changes daily. It limits how many connections one address can create per day. Because the salt changes daily, visits on different days cannot be linked by it, and the hash cannot be turned back into an IP address.
A short user-agent hint: The first 120 characters of the browser’s user-agent string, for diagnosing a failed connection.
Your Turnstile result: The consent page uses Cloudflare Turnstile to keep bots out. Cloudflare receives the challenge token and your IP address under its own privacy policy; this service receives only pass or fail.

When you use a tool

Timestamp: When the call arrived.
Connection id: The same random id. Never a name, email or IP address.
Tool name: For example site_screen.
The inputs you sent: Stored as given. This includes addresses, place names, coordinates and ZIP codes that you or your AI assistant (Claude, ChatGPT or Codex) put into a tool call. If you would not want an address in a log for 90 days, do not send it.
Latency, status, error: How long the call took, whether it succeeded, and the error text if it did not.
Whether it counted: Whether the call used one of the month’s 50.

What is never collected

Your conversation. The service sees only the arguments of a tool call it is asked to run, not the prompt around it, not the answer your AI assistant writes, and not any other message.
Your name, email address, phone number or any platform account. None is asked for, and there is nowhere to enter one.
Your raw IP address. It is hashed with a daily salt on the consent page and is not stored with any tool call.
Cookies and trackers. The consent page sets none and loads no analytics. Its only third-party resource is the Cloudflare Turnstile widget.

2How it is used, and where it is stored

The records above are used for four things only: enforcing the monthly quota and the per-minute limit for each connection, keeping bots and abuse off a free service, debugging a failed or slow call, and counting usage in aggregate (calls per tool, error rates). They are not used to build a profile, to train a model, or for advertising.

Storage is a single PostgreSQL database hosted on Supabase (AWS, US West), in a schema the public service can read and add to but cannot delete from, so the service cannot erase its own audit trail. The connector itself runs on Railway. Both providers hold the data under their own security terms as the service’s infrastructure.

Nothing is sold, rented or shared for advertising. There is no data broker, affiliate or marketing list. The only third parties that see anything are the infrastructure providers needed to run the service:

Cloudflare: the Turnstile check on the consent page (your IP address and the challenge token, under Cloudflare’s own privacy policy).
Supabase and Railway: the database and the server that hold and run what section 1 describes.

To answer a question about an address outside the precomputed metros, a tool may send that address to a public data source: the U.S. Census Bureau geocoder, Census TIGERweb, or the Bureau of Labor Statistics. Those requests carry the address and nothing about you. Beyond that, data is disclosed only if a law or valid legal process requires it.

4Retention

A scheduled job runs daily and enforces these limits:

Tool-call log (timestamps, tool, inputs, latency, status): 90 days, then deleted.
Authorization codes: Deleted 1 day after they expire. They are single-use and live for minutes.
Access and refresh tokens: Deleted 30 days after they expire.
A registered client that stops being used: Deleted after 90 days idle.
The connection row (random id, IP hash, counters): Kept while the connection exists, so the monthly quota means something.

Removing the connector in your AI assistant (Claude, ChatGPT or Codex) stops it being usable. To have a connection switched off or its record deleted, email herman@hermanchan.ai with the connection id (ask the connector’s data_coverage tool for it; every error message also includes it) and it will be revoked or deleted.

5Security

Traffic is HTTPS only. The service reads the database through a narrow, read-only role that can see a published subset of columns and nothing else: owner and property-manager names, the licensed rental-community unit counts and internal processing metadata are absent from what it can read, not filtered out afterwards (public-record unit counts and year built are readable, each with its source). Access tokens are short-lived; refresh tokens are stored only as a hash and replaced on every use.

6Children

The service is for commercial real estate research and is not directed at children. No age-related data is collected.

7Changes

Material changes will be posted on this page with a new effective date. The connector’s directory listing links here, so the current version is always one click away.

8Contact

herman@hermanchan.ai for privacy questions, corrections, and requests to revoke or delete a connection. See also the terms of service and the support page.