Privacy Policy

SFR Analytics, Inc. ("SFR Analytics," "we," "us," or "our") provides a Model Context Protocol (MCP) service that enables AI assistants and development tools to access single-family residential property data, rental analytics, buyer intelligence, and private lending insights. This Privacy Policy describes how we collect, use, and share information in connection with the MCP service.

1. Information We Collect

1.1 Account and Authentication Data

When you create an account or authenticate via OAuth (Auth0), we collect:

• Email address and name (from your identity provider)
• API keys and token identifiers
• Subscription plan and billing status
• Account preferences and saved settings (markets, property types, default filters)

1.2 Service Telemetry and Usage Data

When you use the MCP service, we automatically collect:

• Tool invocations and request parameters (e.g., which tools are called, geographic filters, date ranges)
• Timestamps, response times, and error information
• API key or OAuth token identifiers (hashed)
• IP address, client type, and MCP client metadata
• Usage volumes for rate limiting and billing

1.3 User Profile and Personalization Data

If you configure a profile, we store your preferences including:

• Role and company name
• Geographic markets of interest (states, MSAs)
• Default lender name and loan type preferences
• Uploaded documents (stored in encrypted cloud storage)

1.4 Information We Do Not Collect

• We do not collect or store the full text of your prompts to AI assistants
• We do not have access to your conversations with Claude, Cursor, or other AI clients
• We do not collect payment card information directly (handled by our payment processor)

2. How We Use Information

We use the information we collect to:

• Provide the service: Authenticate requests, execute tool calls, return data, and personalize responses based on your profile and subscription
• Maintain security: Detect abuse, prevent unauthorized access, enforce rate limits, and investigate incidents
• Improve the service: Analyze aggregated usage patterns, identify popular tools and workflows, fix bugs, and optimize performance
• Bill and administer accounts: Track usage for billing, manage subscriptions, and communicate service updates
• Comply with law: Respond to legal obligations, enforce our terms, and protect rights

3. Third-Party AI Clients

The MCP service is designed to be used through third-party AI assistants and development tools such as Claude (Anthropic), Cursor, and other MCP-compatible clients. When you use our service through these tools:

• We provide data to the AI client in response to authorized tool calls. The AI client may process, display, summarize, or cache this data under its own terms and privacy practices.
• We do not control how third-party AI clients handle prompts, tool results, or conversation history. Please review the privacy policy of your chosen AI client.
• Your AI client is your agent. We treat tool calls from your authenticated AI client the same as direct API calls from you.

4. Information Sharing

We share information only in the following circumstances:

• Service providers: Cloud hosting (AWS), authentication (Auth0), observability, and support tools that process data on our behalf under appropriate agreements
• As required by law: In response to valid legal process, to protect safety, or to enforce our terms
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users
• Aggregated data: We may share aggregated, de-identified usage statistics that cannot identify individual users

We do not sell your personal information. We do not use your data to train AI models.

5. Data in SFR Analytics Datasets

The MCP service provides access to property transaction records, rental data, buyer intelligence, and private lending information. This data includes information about property owners, buyers, borrowers, and lenders sourced from:

• Public government records (county assessor, recorder, court filings)
• Licensed data providers and commercial data vendors
• Publicly available business information

If you are an individual whose information appears in our datasets and you wish to exercise your privacy rights, please see Section 7 below.

6. Data Retention

Category	Retention
Account and authentication data	Duration of account plus 30 days
Service telemetry and request logs	90 days (debugging), 1 year (aggregated metrics)
User profile and preferences	Duration of account
Uploaded documents	Until deleted by user or account closure
Billing and subscription records	As required by law (typically 7 years)

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at support@sfranalytics.com. We will respond within 45 days as required by applicable law.

California Residents

Under the California Consumer Privacy Act (CCPA/CPRA), California residents have additional rights including the right to know what personal information is collected, the right to delete, and the right to opt out of sale. For requests, email support@sfranalytics.com with "California Privacy Request" in the subject line.

8. Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• API key hashing (keys are never stored in plaintext)
• OAuth 2.0 with PKCE for browser-based authentication
• JWT token validation with RS256 signatures
• Rate limiting and abuse detection
• Encrypted storage for uploaded documents

9. Access Modes

The MCP service is accessed via the hosted HTTP endpoint at mcp.sfranalytics.com/mcp. Requests pass through our servers. We collect service telemetry as described in Section 1.2.

10. Children

The MCP service is a business-to-business product not directed at children under 16. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last Updated" date and, for significant changes, by email or in-product notice.

12. Contact Us

For privacy questions or requests:

• Email: support@sfranalytics.com
• Website: www.sfranalytics.com