Privacy Policy

Last updated: October 7, 2026

1. What We Collect

• Account details — if you create an account: your email address. If you sign in with Google, also the name and profile picture Google shares with us. Passwords are handled by our authentication provider (Supabase) and are not visible to us.
• Your questions and our answers — the text you type, the details we detect in it (for example city, size, number of bedrooms) and the answer we produce. We store them to serve repeated questions faster and to check the quality of our answers. These records are not linked to your account.
• Property details and analyses — the property details you enter (city, size, type, prices) and the analyses we produce for them. They are stored on our servers, linked to your account if you are signed in, or to an anonymous session identifier if you are not.
• Guest-dispute tool — if you use it: the messages you paste (which may include messages written by your guests), the property details you add and any files you upload. They are stored in your account and are visible only to you.
• IP address — used to limit the number of requests per minute. We do not store it in our database. Our hosting provider (Vercel) may record it in its own logs.

2. What We Do Not Collect

• Payment card details. If paid plans are offered, payment is handled entirely by Stripe; we never see or store card numbers.
• Precise device location (GPS).
• Browsing history outside Decumara.

3. How We Use Data

• To produce market insights, revenue estimates, renovation and furnishing costs, and investment assessments.
• To show you your earlier analyses and keep your account working.
• To improve the accuracy of our estimates over time, using aggregated results.
• To detect and prevent abuse (rate limiting, injection protection).

We do not sell or rent your data, and we do not share it with third parties for marketing.

4. Third-Party Services

These services process data on our behalf:

• Supabase — database, sign-in and file storage. Our project is hosted in the ap-south-1 region (Mumbai, India). Privacy policy
• Vercel — website hosting. Privacy policy
• OpenAI — AI analysis. The text of your question, and in the guest-dispute tool the messages you paste, are sent to the OpenAI API. Privacy policy
• Brave Search — live web research. Search terms built from your question (for example a city and a topic) are sent to Brave. Privacy policy
• Google — Google Maps is loaded in some pages, so Google receives your IP address when they open; Google Sign-In if you choose it. Privacy policy
• Stripe — payments, only if paid plans are offered. Privacy policy

Because of these providers, your data may be processed outside your country, including outside the EU/EEA (for example in India and the United States).

5. Cookies & Local Storage

We use a cookie to remember your language, sign-in cookies to keep you logged in, and your browser's local and session storage to remember recent searches and unfinished forms. We do not use advertising or tracking cookies.

6. Data Retention

Cached answers expire after 24 hours. Other records (questions and answers, analyses, account data, guest-dispute cases) are kept until you ask us to delete them or until we delete them; we do not yet run automatic deletion on a fixed schedule. You can ask us to delete your data at any time (section 7).

7. Your Rights

You can ask to access, correct, export or delete the personal data we hold about you, and to close your account. If you are in the EU/EEA or the UK, these are your rights under the GDPR. Write to hello@decumara.com from the email address of your account, or tell us what you searched for and when, so we can find records that are not linked to an account.

8. Changes to This Policy

We will update this page when the way we handle data changes, and show the new date at the top.

9. Contact

Questions? hello@decumara.com