Skip to main content

Privacy Policy

Last updated: July 30, 2026

Introduction

Pierce Industries LLC, doing business as PREP ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our real estate management platform.

Information We Collect

Personal Information

  • Name and contact information
  • Email address and phone number
  • Real estate license information
  • Payment and billing information
  • Property and transaction data
  • Signup attribution data (where available at the time you create your account): the referring URL, landing page URL, and UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) associated with the session that led to your signup. These are captured once at account creation and stored in your account record.

Usage Information

  • Platform usage and activity
  • Device and browser information
  • IP address and location data
  • Cookies and tracking technologies: We use two categories of cookies. Strictly necessary — NextAuth session cookies keep you signed in for the duration of your browser session (deleted when you close your browser or sign out). Analytics — Google Analytics 4 sets _ga and _gid cookies to distinguish users and sessions; these persist for up to 2 years and 24 hours respectively. Analytics cookies are off by default and are set only after you opt in — see "Cookie Consent and Analytics" below for how to control them.

Analytics and Measurement

We collect analytics data through two distinct systems, described separately below.

First-Party Product Analytics (authenticated users only)

When you are signed in to PREP, we record certain in-product actions (such as creating a deal, applying a checklist from a template, or setting a follow-up date on a contact) in a first-party analytics event store in our own PostgreSQL database. Each event is keyed to your user account ID and includes the event name and structured metadata about the action (for example, the deal type). These events do not contain personally identifiable information such as your name, email address, or phone number.

Legal basis: We rely on legitimate interest (GDPR Art. 6(1)(f); CCPA business purpose, not a sale or share) to collect this data. Our legitimate interest is understanding how our product is used so we can improve it, measure feature adoption, and track the “activation” journey that leads to a successful real estate workflow. This data is never shared with third parties and is never used for advertising.

Attribution data at signup: When you create a PREP account, we capture (where available) the UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the HTTP referrer, and the landing page URL associated with the session that led to your signup. This information is stored in your account record and is used only for internal measurement of which marketing channels are effective. It is not shared with advertising networks.

You may object to this processing at any time by contacting [email protected] (GDPR Art. 21). If you object, we will suppress further product analytics writes to your account. This does not affect our ability to operate your account or provide the service. If you submit a right-to-erasure request, all product analytics events tied to your account are hard-deleted as part of that process.

Third-Party Website Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand how visitors use our marketing website. GA4 collects the following information:

  • Pages visited and time spent on pages
  • Device type, browser, and operating system
  • Approximate geographic location (city and region level)
  • Referral source and session behavior
  • Core Web Vitals performance metrics (page load time, interactivity, and visual stability) to monitor and improve site performance

GA4 uses cookies and similar technologies to collect this data. Data collected through GA4 is processed by Google LLC under their privacy policy. We use this data to improve our website, understand usage patterns, and optimize the user experience. We do not use GA4 to collect personally identifiable information.

Google Analytics is loaded only after you opt in. See "Cookie Consent and Analytics" below for the controls available to you.

Cookie Consent and Analytics

We use Google Consent Mode v2 to keep analytics off until you choose to allow it. When you first visit the site, all analytics and advertising storage signals default to denied, so no Google Analytics cookies are set and no analytics measurement occurs unless and until you opt in. PREP runs no advertising pixels, and the advertising signals are kept permanently denied regardless of your choice. You have the following controls:

  • Consent banner: On your first visit, a banner lets you Accept or Decline analytics cookies. Analytics stays off unless you select Accept. Declining or dismissing the banner keeps analytics off. You can change your choice at any time using the "Do Not Sell or Share My Personal Information" control described below.
  • Global Privacy Control (GPC): If your browser or an extension sends a Global Privacy Control signal, we honor it automatically: analytics is kept denied and the consent banner is suppressed. A GPC signal overrides any prior opt-in.
  • "Do Not Sell or Share My Personal Information": A control with this label is available in the site footer. Selecting it turns analytics off for this browser at any time, including after a prior opt-in. PREP does not sell or share your personal information for cross-context behavioral advertising and runs no ad trackers; this control ensures analytics is opted out.
  • Browser settings: You can also remove or block cookies through your browser settings, or install the Google Analytics Opt-out Browser Add-on.

How We Use Your Information

  • Provide and maintain our services
  • Process payments and subscriptions
  • Send important updates and notifications
  • Improve our platform and user experience
  • Comply with legal obligations

Product Update Emails

We send weekly product update emails to all account holders by default. You can unsubscribe via the link in any email, or by toggling Product Updates off in /account/notifications. Public subscribers (non-account-holders) confirm via double opt-in and can unsubscribe from any email. We retain consent records (timestamp, IP address, user agent, and source) for GDPR compliance and never share or sell email addresses. To request deletion of your consent record, contact [email protected].

Data Security

We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure servers, and regular security audits.

Third-Party Services and Sub-Processors

We use trusted third-party services to operate PREP. These sub-processors receive only the information required to perform their service and are bound by their own privacy and security commitments:

  • Stripe — payment processing (card data is sent directly to Stripe and never stored on PREP servers). We store a Stripe customer identifier in our database to link your account to your payment history.
  • Google — authentication (Sign in with Google) and optional Google Calendar integration (details below)
  • Google Analytics 4 — aggregate website usage measurement and Core Web Vitals
  • Google Places API — address autocomplete in property and contact forms (the partial address you type is sent to Google to return matching address suggestions)
  • Vercel — application hosting (United States)
  • Supabase — managed PostgreSQL database (United States)
  • Amazon Web Services (AWS) — cloud infrastructure including Amazon S3 (document storage), Amazon SES (email delivery), and Amazon Bedrock (AI document and email extraction, described below). Data is processed in the AWS us-east-1 region (United States).
  • Resend — transactional email delivery and optional inbound email ingestion
  • Cloudflare Turnstile — bot and spam protection on public lead-capture forms (described below)

All sub-processors listed above operate in the United States. International customers should be aware that submitted information will be transferred to, stored, and processed in the United States. By using PREP or submitting information through a PREP-powered form, you consent to this transfer.

Public Handles and Campaign Link Addresses

When you create your first campaign form or share link, PREP automatically assigns your workspace a public "handle" — a short, URL-friendly name derived from your account name (for a personal workspace) or your team's name (for a team workspace). For example, an account for "Ryan Pierce" may receive the handle ryan-pierce.

Your handle is public. It appears in the web address of every campaign form and share link you share (for example, https://www.the-prep.casa/p/ryan-pierce/open-house). Anyone you share a link with, and anyone who visits that page, can see your handle.

You can change your handle at any time — from your Account settings for a personal workspace, or from your team settings for a team workspace (if you are the team's owner or an admin). Changing your handle updates the address of all your existing campaign links at once; links that used your previous handle will stop working. Because a handle is derived from a name, you may also edit it to remove or alter that name if you prefer.

We do not use your handle for advertising, and we do not sell or share it. If you ask us to delete your account, your handle is deleted as part of that process (see "Data Retention" and "Your Rights").

Public Lead-Capture Forms

PREP customers (real estate agents, teams, and brokerages) can publish public lead-capture forms at PREP-hosted URLs (for example, https://www.the-prep.casa/p/<handle>/<slug>). If you submit information through one of these forms:

  • The information you provide (name, email, phone, and any other fields the agent has configured) is delivered to the PREP customer who owns that form. That customer is the primary recipient and controller of your information and will contact you directly.
  • PREP acts as the service provider (processor) that stores and routes the submission on behalf of the customer.
  • To prevent spam and abuse, we also collect technical metadata: your IP address, browser user agent, the referring URL, UTM parameters from the link you clicked, and timing signals about your interaction with the form.
  • We set a first-party cookie (pierce_portal_visited, 30-day lifetime) to recognize returning visitors for spam scoring. This cookie is used only for anti-abuse purposes and does not track you across other websites.
  • We use Cloudflare Turnstile to verify that form submissions come from a human and not an automated bot. Turnstile may process technical signals from your browser according to Cloudflare's privacy policy.

If you want your information removed after submitting a form, please contact the agent who operates the form first (they are the primary recipient). You may also contact us at [email protected] and we will route the deletion request to the appropriate customer.

Inbound Email Lead Ingestion

PREP customers on eligible plans can forward lead emails (for example, notifications from Zillow or Realtor.com) to a unique PREP-hosted inbound address. When an email is forwarded to that address, we process its subject, body, and sender information so that we can create a contact record for the customer. This may include parsing personal information (name, email, phone) about a third-party lead whose email was forwarded to PREP.

This inbound email data is stored only for the PREP customer who received it and is never used to train AI models. If you believe an email containing your personal information has been forwarded to PREP without your consent, please contact us at [email protected].

Use of Artificial Intelligence

PREP uses large language models operated by Amazon Web Services (Amazon Bedrock, Anthropic Claude family) to assist with specific tasks:

  • Extracting contact information from inbound emails forwarded to a customer's PREP inbound address
  • Mapping columns in uploaded CSV files to PREP contact fields during import
  • Extracting structured fields from real estate documents uploaded by customers
  • Scoring inbound leads on a 1-5 scale based on fields you provided (such as timeline, budget, and pre-approval status). This score is a private organizational aid for the customer and is not a consumer-facing credit, insurance, or housing decision.
  • Generating a deal briefing on request. For customers on eligible plans, PREP can generate a short, plain-language summary of one of the customer's own real estate transactions when the customer clicks "Generate." The summary is based on the customer's existing deal data — such as the transaction stage, key dates and deadlines, checklist items, and whether an earnest-money amount has been recorded — and is produced by a large language model via Amazon Bedrock. This content is not used to train the underlying models, is not used to make any automated decision about housing, credit, insurance, or employment, and is advisory only: the customer is instructed to verify it before relying on it.

Content sent to Amazon Bedrock for processing is transmitted over encrypted connections and is not used to train the underlying models (see AWS Bedrock data privacy). PREP does not use customer or lead information to train its own AI models. PREP does not make automated decisions about housing, credit, insurance, or employment based on AI output. Protected- class attributes (such as race, religion, national origin, or familial status) are not collected by PREP and are not used as inputs to lead scoring.

Data Retention

We retain personal information for as long as needed to provide the service and to meet legal, tax, and audit obligations:

  • Account and customer data — retained while your account is active and for up to 30 days after deletion, after which personal data is removed except where longer retention is required by law
  • Transaction, offer, and agreement records — customers may be required by state real estate regulations to retain these records for 3-7 years; we retain them for the customer accordingly
  • Form-submission metadata (IP address, user agent, referring URL) — retained for the life of the submission record for audit, anti-abuse, and dispute-resolution purposes
  • Raw form payloads (the unmodified JSON of a lead-capture submission) — retained for audit and debugging and are automatically purged 90 days after submission
  • Product analytics events (first-party behavioral telemetry keyed to your account, collected while you are signed in) — automatically purged 760 days (approximately 25 months) after the event is recorded, to support year-over-year product analysis while remaining proportionate to our business need. This telemetry is not subject to real-estate record-keeping regulations, which do not apply to internal product-usage data. Hard-deleted on a valid right-to-erasure request.
  • Billing records (invoices, payment status) — retained as required by applicable tax and accounting law (typically 7 years)
  • AI usage metering records (token counts, task names, model tier, duration, and per-account usage) — retained for 13 months from the date of the call, linked to your account during that period, then anonymized or deleted. On account deletion, the personal identifiers in these records are removed (nulled out) while the aggregate token-count data is retained for billing-integrity purposes.
  • Security and access logs — retained for up to 12 months for incident-response and audit purposes
  • System audit logs (records of administrative actions, billing-status changes, and configuration changes) — retained for 7 years. We keep these to satisfy tax and accounting law and to maintain a reliable audit trail if billing or account questions come up — the same reason most accounting software keeps records this long. These logs contain account identifiers and action records; they do not contain card numbers or full contact information. If you request deletion of your account, we anonymize your name and email in these records but retain the action entries themselves, which we are required to keep.

To request earlier deletion of your personal information, contact [email protected]. We will honor valid deletion requests except where retention is required by law or by the legitimate business purposes listed above.

Data Breach Notification

If we learn of a security incident that affects your personal information, we will notify you and, where required, regulators in accordance with applicable law. We aim to notify affected users without undue delay and, where GDPR applies, within 72 hours of discovering the breach.

Google Calendar Integration

PREP offers an optional Google Calendar integration that allows you to sync critical real estate transaction dates directly to your Google Calendar. When you connect your Google Calendar, the following applies:

Data Accessed

When you connect your Google Calendar, we access calendar event titles, dates, times, locations, and attendees from your primary Google Calendar. We use the calendar.events scope, which provides read and write access to your primary Google Calendar.

Purpose

Calendar access is used solely to sync real estate transaction dates — including closing dates, inspection deadlines, contract expiration dates, and option periods — to your Google Calendar so you never miss critical deadlines. We do not read or process your existing calendar events for any other purpose.

Storage

OAuth access and refresh tokens are stored securely in our database using encryption at rest. Calendar event metadata (event IDs and sync status) is stored for synchronization tracking purposes only.

Sharing

Google Calendar data is never shared with third parties, advertisers, or data brokers. We do not sell, trade, or transfer Google user data to third parties.

Disconnecting and Deletion

You can disconnect your Google Calendar integration at any time from your Account settings. Disconnecting immediately deletes stored tokens and calendar sync data from our systems. You can also revoke PREP's access to your Google Calendar at any time from your Google Account permissions page.

Google API Limited Use Disclosure

PREP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell, trade, or transfer Google user data to third parties.

Your Rights

  • Access and update your personal information
  • Request deletion of your data
  • Opt-out of marketing communications
  • Export your data
  • Withdraw consent for data processing

These rights apply to all users; see the CCPA and GDPR sections below for region-specific details.

Your Choices

You have several options to control how your information is collected and used:

  • Analytics consent: Analytics cookies are off by default. You can decline them on the consent banner, or turn them off at any time using the "Do Not Sell or Share My Personal Information" control in the footer. We also honor Global Privacy Control (GPC) browser signals automatically. See "Cookie Consent and Analytics" above for details
  • Cookie preferences: You can also manage or disable cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when a new cookie is set
  • Marketing communications: You may opt out of marketing emails at any time by clicking the unsubscribe link in any email we send or by contacting us at [email protected]

California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

  • Right to know: You have the right to know what personal information we collect, the sources from which we collect it, the purposes for which we use it, and the categories of third parties with whom we share it
  • Right to delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions
  • Right to opt out of sale: We do not sell personal information to third parties

PREP does not sell personal information, and we do not run advertising trackers. Analytics data collected through Google Analytics may, however, constitute "sharing" of personal information under the CCPA/CPRA. Analytics is off by default and is enabled only if you opt in. To exercise your right to opt out, you can use the "Do Not Sell or Share My Personal Information" control in our footer (which turns analytics off for your browser), decline analytics on the consent banner, or send a Global Privacy Control (GPC) signal from your browser, which we honor automatically as a valid opt-out request.

To exercise your California privacy rights, please contact us at [email protected]. We will respond to verified requests within 45 days as required by law.

European User Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and applicable national laws provide you with the following rights regarding your personal data:

  • Right of access: You have the right to request a copy of the personal data we hold about you
  • Right to erasure ("right to be forgotten"): You have the right to request deletion of your personal data where there is no compelling reason for its continued processing
  • Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller
  • Right to restriction of processing: You have the right to request that we restrict the processing of your personal data under certain circumstances
  • Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal
  • Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR

To exercise any of these GDPR rights, please contact us at [email protected]. We will respond within 30 days of receiving your request.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: [email protected]

For terms-of-service questions, email [email protected].