Privacy Policy

HoldWise was formerly known as RealTrue. The platform, the company, and the services are the same. Only the name has changed. This policy replaces the version effective May 11, 2026.

This Privacy Policy describes how HoldWise, Inc., a Delaware corporation ("Company," "we," "us," or "our"), collects, uses, shares, and protects your personal information when you use the HoldWise platform and websites ("Service").

This Privacy Policy is provided for transparency about how we handle your personal information. It does not by itself serve as your consent. Where we rely on your consent for a specific activity, such as sending marketing emails or setting non-essential cookies, we ask for that consent separately, and you may withdraw it at any time.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly when you use the Service, including:

• Account information: name, email address, password, and profile details you provide during registration or that an administrator provides during onboarding on your behalf
• Subscription and payment information: billing address, payment method details, and transaction history (payment processing is handled by Stripe; we do not store full payment card numbers)
• Investment profile data: property preferences, investment criteria, deal room affiliations, and onboarding questionnaire responses
• Content you create: notes, pipeline entries, portfolio records, project data, expense records, documents, and photos you upload or create within the Service
• Communications: messages you send us through email, support requests, contact and partner inquiry forms, or feedback forms
• Marketing signups: if you vote for a future HoldWise market or join a waitlist on our website, we collect the market you request and, if you choose to provide it, your email address
• Onboarding recordings: audio recordings and transcripts submitted through our voice-based onboarding flow, used to create your investor preference profile

1.2 Information Collected Automatically

When you access the Service, we automatically collect certain technical information, including:

• Device and browser information: device type, operating system, browser type and version, screen resolution, and language preferences
• Usage data: pages visited, features used, actions taken, timestamps, and session duration
• Session interactions: with your analytics consent, our analytics tooling may record how you interact with pages (sometimes called session replay); text you type into input fields is masked in these recordings
• Log data: IP address, access times, referring URLs, and error logs
• Anti-abuse signals: for public website forms (such as market voting), we process your IP address to prevent duplicate and automated submissions; we store it only as a one-way cryptographic hash, not as a readable address
• Bot protection: our login and public forms use Cloudflare Turnstile, which processes technical signals from your browser to distinguish humans from bots
• Cookies and similar technologies: we use cookies, local storage, and similar technologies to maintain your session, remember preferences, and (with your consent where required) measure usage (see Section 6)

1.3 Information from Third Parties and Public Sources

We may receive information about you from third-party sources, including:

• Public records: property data, foreclosure filings, tax records, and court records sourced from government agencies and public databases
• Authentication providers: if you sign in through a third-party service, we may receive your name, email, and profile information from that provider
• Third-party integrations: data from services we integrate with to provide features such as mapping, transcription, rental market analytics, and property enrichment

Some property-related public records may include the names of individuals, such as owners of record in foreclosure filings. We process such records as published by the originating government source, for the purpose of providing property research tools. If a public record about you appears in the Service and you have questions, contact us at privacy@holdwise.co.

1.4 Sensitive Personal Information

The only sensitive personal information we collect is your account log-in credentials, which we use solely to authenticate you and to secure your account. Because we use this information only for purposes that California law permits without triggering the right to limit, such as performing the Service and preventing security incidents, the right to limit the use of sensitive personal information does not apply. We will nonetheless honor a limitation request where feasible. We do not use or disclose sensitive personal information to infer characteristics about you.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: creating and managing your account, processing subscriptions, delivering features, and enabling deal room collaboration
• Improving the Service: analyzing usage patterns, diagnosing technical issues, testing new features, and optimizing performance
• Personalization: tailoring property recommendations, dashboard views, and notifications to your preferences and investment profile
• AI-assisted features: processing onboarding recordings for transcription and preference extraction, generating property descriptions, producing property intelligence and market reports, and powering screenshot-based property import
• Market expansion: counting market votes to decide where HoldWise expands next, and, if you gave us your email, telling you when we launch there
• Communications: sending transactional emails (account confirmation, password reset, task digests), service announcements, and, where you have opted in or as otherwise permitted by law, product news and promotional emails. Every marketing email includes an unsubscribe link.
• Security and compliance: detecting and preventing fraud and abuse, rate-limiting requests, enforcing our Terms of Service, complying with legal obligations, and responding to lawful requests from authorities
• Analytics and reporting: generating aggregated, de-identified analytics to understand platform usage and improve our products

2.1 Legal Bases for Processing (EEA and United Kingdom users)

Where the EU or United Kingdom General Data Protection Regulation applies, we process your personal information only where we have a legal basis to do so. The bases we rely on are:

Purpose	Legal basis
Creating and operating your account, providing the Service, and enabling deal room collaboration	Performance of a contract with you (Article 6(1)(b))
Processing subscriptions, billing, and payments	Performance of a contract (Article 6(1)(b))
Securing the Service, preventing fraud and abuse, rate limiting, and enforcing our Terms	Our legitimate interests in a secure and reliable service (Article 6(1)(f))
Improving the Service, diagnosing issues, and product analytics	Our legitimate interests in improving our products, or your consent where required for non-essential analytics (Article 6(1)(f) or 6(1)(a))
Personalizing recommendations and dashboards	Our legitimate interests in providing a relevant product, or your consent where required (Article 6(1)(f) or 6(1)(a))
Sending transactional and service messages	Performance of a contract, or our legitimate interest in servicing your account (Article 6(1)(b) or 6(1)(f))
Sending marketing and promotional emails	Your consent, or our legitimate interests where permitted by law, in each case with an unsubscribe option (Article 6(1)(a) or 6(1)(f))
Complying with legal obligations and responding to lawful requests	Compliance with a legal obligation (Article 6(1)(c))

Where we rely on legitimate interests, you may object at any time (see Section 7). Where we rely on consent, you may withdraw it at any time, which does not affect processing that already took place.

3. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may share your information in the following circumstances:

3.1 Within Your Deal Room

If you belong to a deal room or team workspace, certain information (such as your name, email, pipeline activity, portfolio data, and project updates) may be visible to workspace administrators, your linked agent, and other authorized members, as determined by the workspace's configuration, your sharing choices, and your account permissions.

3.2 Service Providers

We share information with third-party vendors who perform services on our behalf, including:

• Cloud infrastructure: hosting, storage, and database services (Supabase, Vercel)
• Payment processing: subscription billing and payment handling (Stripe)
• Email delivery and marketing contacts: transactional, digest, and marketing email services (Resend)
• Transcription: audio-to-text processing for onboarding recordings (Deepgram)
• AI processing: natural language processing for preference extraction, property analysis, and description generation (Anthropic)
• Rental market analytics: when you run a short-term rental analysis, the property address or location is sent to our market data provider to retrieve comparable listings and revenue estimates
• Mapping and geolocation: property location display and directions (Google Maps)
• Bot protection and rate limiting: abuse prevention (Cloudflare, Upstash)
• Analytics: usage analytics (PostHog), collected subject to your cookie consent choices where required

These providers are contractually bound to use your information only to perform the services we have engaged them for and to maintain appropriate security measures.

3.3 Legal Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, or legal process
• Respond to lawful requests from public authorities, including law enforcement
• Protect the rights, property, or safety of HoldWise, our users, or the public
• Enforce our Terms of Service

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

3.5 With Your Consent

We may share your information for other purposes with your explicit consent.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. After account termination, we may retain certain data for a reasonable period to:

• Comply with legal, regulatory, or contractual obligations
• Resolve disputes and enforce our agreements
• Maintain records for audit and compliance purposes
• Prevent fraud and abuse

4.1 Retention by Category

Category of personal information	Retention period or criteria
Account and profile information	For the life of your account, then up to 24 months after closure for legal, audit, and dispute-resolution purposes
Subscription and payment records	As required for tax, accounting, and legal compliance, typically 7 years
Content you create (notes, pipeline, portfolio, projects, expenses, documents, photos)	For the life of your account; deleted or de-identified within 90 days after closure unless you request earlier deletion or we must retain it by law
Investment profile and onboarding responses	For the life of your account
Onboarding audio recordings	Up to 90 days after processing, then deleted; transcripts and extracted preferences retained as account data
Market vote records (market, hashed IP, optional email)	Until the requested market launches or up to 24 months, whichever comes first
Contact and partner inquiry emails	As ordinary business correspondence, typically 24 months
Usage, log, and device data	Typically 24 months, then deleted or aggregated
De-identified or aggregated analytics	Retained indefinitely in de-identified form

When data is no longer needed for any of the above purposes, we will delete or de-identify it in accordance with our internal data retention schedule.

5. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row-level security policies that restrict data access to authorized users
• Regular security assessments and monitoring
• Access controls limiting employee and contractor access to personal data on a need-to-know basis
• Secure authentication with session management, bot protection on login, and rate limiting

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account.

6. Cookies and Tracking Technologies

6.1 What We Use

We use the following types of cookies and similar technologies:

• Essential cookies: required for the Service to function, including authentication session cookies, security tokens, and bot-protection tokens. These cannot be disabled.
• Preference cookies: remember your settings, such as sidebar state, filter preferences, and chart selections
• Analytics cookies: help us understand how the Service is used so we can improve it. Where required by law, analytics cookies are set only after you consent through our cookie banner.

6.2 Your Choices

You can manage non-essential cookies through our cookie banner and through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Disabling essential cookies will prevent you from using the Service.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

7.1 Access and Portability

You may request a copy of the personal information we hold about you. We will provide this in a commonly used, machine-readable format where technically feasible.

7.2 Correction

You may request that we correct inaccurate or incomplete personal information. You can update much of your information directly through your account settings.

7.3 Deletion

You may request that we delete your personal information. We will comply with such requests unless we have a legitimate legal basis for retaining the data (such as legal compliance or dispute resolution).

7.4 Restriction and Objection

You may request that we restrict the processing of your personal information or object to certain processing activities, including direct marketing. You can stop marketing emails at any time using the unsubscribe link in any marketing message.

7.5 Withdrawal of Consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

7.6 How to Exercise Your Rights

To exercise any of the above rights, contact us at privacy@holdwise.co. We will respond within 30 days (or the period required by applicable law). We may need to verify your identity before processing your request, which we do by matching your request against information we already hold, such as the email address on your account. You may designate an authorized agent to submit a request on your behalf; we will require proof of the agent's authorization and may still need to verify your identity directly. If you are a deal room member, some requests may be routed through your workspace administrator where they control the relevant data.

7.7 Right to Lodge a Complaint

If you are in the EEA, the United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal information does not comply with applicable law. We would welcome the chance to address your concerns first, so we encourage you to contact us at privacy@holdwise.co before you do.

7.8 Automated Decision-Making and Profiling

We use profiling to personalize your experience, for example to tailor property recommendations and dashboard content to your stated preferences and activity. We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. If we ever introduce such processing, we will tell you and provide the rights required by law, including the right to obtain human review, to express your point of view, and to contest the decision. You may contact us at privacy@holdwise.co with any questions about our use of automated processing.

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@holdwise.co.

9. International Data Transfers

The Service is operated from the United States, and we store and process personal information in the United States. Our service providers may also process personal information in other countries.

If you access the Service from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal information is transferred to the United States and to other countries whose data protection laws may differ from those in your jurisdiction. When we make such a transfer, we rely on appropriate safeguards recognized under applicable law, including Standard Contractual Clauses approved by the European Commission, together with the United Kingdom International Data Transfer Addendum where applicable, incorporated into our agreements with the relevant service providers.

You may request more information about these transfers and a copy of the relevant safeguards by contacting us at privacy@holdwise.co.

10. State-Specific Privacy Rights

10.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, disclose, and sell
• The right to request deletion of your personal information
• The right to opt out of the sale or sharing of your personal information (we do not sell personal information or share it for cross-context behavioral advertising)
• The right to non-discrimination for exercising your privacy rights
• The right to correct inaccurate personal information
• The right to limit use of sensitive personal information

To exercise these rights, contact us at privacy@holdwise.co.

10.1.1 Categories of Personal Information We Collect (CCPA)

In the preceding 12 months we have collected the following categories of personal information as defined by the CCPA. We do not sell any category, and we do not share any category for cross-context behavioral advertising.

CCPA category	Collected	Examples	Sources	Business purpose	Disclosed to (categories of third parties)
Identifiers	Yes	Name, email, account ID, IP address	You; your administrator; automatic collection	Provide and secure the Service	Cloud, email, analytics, and security providers
Commercial information	Yes	Subscription tier, transaction history	You; payment processor	Billing and account management	Payment processor
Internet or network activity	Yes	Pages visited, features used, log data	Automatic collection	Improve and secure the Service	Cloud and analytics providers
Geolocation data	Yes	Approximate location inferred from IP address; property locations you enter	Automatic collection; you	Feature delivery and mapping	Mapping provider
Audio or electronic information	Yes	Onboarding voice recordings and transcripts	You	Build your preference profile	Transcription and AI providers
Professional or investment information	Yes	Investment criteria, deal room role	You	Personalization and collaboration	Within your deal room
Inferences	Yes	Preference and recommendation profiles	Derived from the above	Personalization	Not disclosed externally
Sensitive personal information	Yes	Account log-in credentials	You	Authentication and security	Cloud and security providers

10.2 Other U.S. States

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights. Please contact us at privacy@holdwise.co to exercise your rights under applicable state law.

11. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this document. If we make material changes, we will provide notice through the Service (for example, by displaying a banner in the application or sending an email). Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of those changes.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Privacy inquiries: privacy@holdwise.co
• Legal inquiries: legal@holdwise.co
• Mail: HoldWise, Inc. A mailing address is available on request at legal@holdwise.co.

We aim to respond to all privacy-related inquiries within 30 days.