Privacy at Homesly

1. Who we are and what this covers

Homesly is a Home Intelligence Platform that maintains a permanent, transferable, intelligent record of every system, appliance, repair, and maintenance event tied to a specific property address. This Privacy Policy describes what data we collect about you and your property, how we use it, who we share it with, and what choices and rights you have.

This Policy applies to our consumer web app, commercial portal, mobile applications, APIs, and communications. It does not apply to third-party services we integrate with — each has its own privacy policy.

Homesly is available only to United States residents who are 18 years of age or older.

2. The data we collect

2.1 Data you give us

• Account: name, email, phone (optional), hashed password, date of birth (age-gate only), profile photo, consent timestamps.
• Property: address, lat/lng, type, year built, square footage, beds/baths, construction, roof, foundation, HOA scope.
• Appliances: manufacturer, model, serial number, install year, photos, warranty documents, notes.
• Service records: type, date, contractor, description, cost, uploaded invoices, warranty terms.
• Tasks and behavior: completions, snoozes, declared DIY level.
• Property imagery you upload.
• Family members you invite.
• Contractor requests (job, availability, preferences).
• Payment information — tokenized via Stripe; we do not store full card numbers.

2.2 Data we collect automatically

• Device + connection: IP, user agent, OS, approximate city-level location, time zone.
• Usage: pages viewed, actions taken, search queries, errors, performance.
• Communications engagement: opens, clicks, deliverability outcomes.
• Audit logs: significant account events with timestamp, IP, user agent.

2.3 Data from third parties you authorize

• Smart-home platforms (Google Home/Nest, Alexa, Apple HomeKit via bridge, Home Assistant, Ecobee, Honeywell, Rachio, Tempest, Homey) — read-only device data only.
• Calendar services (Google Calendar, Apple Calendar via CalDAV) — for contractor scheduling only.
• Email services (Gmail or Outlook) for invoice ingestion — Pro tier, only if you connect.
• Public property records (county assessor, address validation).
• Weather data (Open-Meteo, NOAA, AirNow) — we send only your lat/lng.
• Neighborhood & reference data for the “Around” (community) view — we look up public datasets that describe the area around your home: the FCC National Broadband Map (internet providers and advertised speeds), the FBI Crime Data Explorer (state-level crime statistics), the U.S. Census American Community Survey (neighborhood demographics), the National Center for Education Statistics (NCES) and GreatSchools (nearby schools), TransitLand and Walk Score (transit stops and walkability), and the National Renewable Energy Laboratory (NREL)(the serving electric utility). To perform these lookups we send your home’s approximate location (latitude/longitude) to these providers. We do not send your name, street address, or account details, and each provider has its own privacy policy.
• Single sign-on identity providers (Google, Apple) — name, email, profile picture.

3. Sensitive data classes — special handling

We give special handling to: financial information(home value, equity, projected expenses — treated under the GLBA Safeguards Rule), your home address (never displayed in commercial products, only revealed to contractors after you select them), photographs you upload (never used to train AI models), your date of birth(used only to verify you’re 18+), smart-home device tokens (envelope-encrypted), and children’s data (we do not knowingly collect any data from anyone under 18).

4. How we use your data

To provide the service, improve it, communicate with you, comply with law, and — only with your explicit consent — enable commercial data products.

4-bis. Artificial intelligence and automated processing

Homesly uses AI in several places. This section discloses all of them in compliance with California SB 942, Utah SB 149, Colorado SB 24-205, and equivalent state laws.

Where we use AI today

• Appliance serial-plate identification — Claude (Anthropic) reads text from photos you upload. Your photos are not used to train the model.
• Homesly-Do task enrichment— Claude generates plain-English “why it matters” copy, DIY summaries, and YouTube search hints from appliance metadata (no PII, no street address).
• Insight engine — replacement forecasts, efficiency analysis, seasonal prep briefs, weather alerts, financial planning, home-value impact estimates. Generated by Claude from anonymized property and appliance summaries.
• Photo lawn / landscape assessment (Pro tier) — Claude vision scores coverage, dry patches, color health.
• Invoice extraction (Pro tier, opt-in) — Claude identifies invoices in your connected Gmail or Outlook and extracts fields you confirm.
• Robo-scheduling agent (Phase 3)— Bland.ai conducts the scheduling call with the contractor’s business; first name only, city + state only.
• Contractor matching algorithm— internal rule-based scoring; no LLM.
• Adaptive personalization— we infer your DIY level and seasonal responsiveness from your behavior; internal statistical model, no LLM.

What we never do with AI

• Approve or deny you for any product, service, insurance, credit, or housing decision
• Set prices specific to you
• Determine employment opportunities
• Profile you for government, immigration, or law-enforcement purposes
• Sell standalone “risk scores” that identify you

Your AI choices

• Disable AI-assisted appliance identification (rely on manual entry) in Settings → AI Preferences.
• Suppress AI-generated insights entirely; rule-based tasks remain.
• Request human-only support by emailing support@welcomehomesly.com with the subject line “Human only.”
• Object to AI vision processing of your photos in Settings.
• Request human review of any AI-generated recommendation by replying to it.

Training data position

We do not use your data to train foundation models, and our AI providers contractually do not use your data to train theirs. If we ever begin using anonymized Homesly data to fine-tune a model internally, we will give you 30 days’ notice and an opportunity to opt out.

AI labels

Surfaces where AI generated the content are labeled as such. Customer-service interactions handled by AI identify themselves at the start.

5. Who we share your data with

• Contractors you select— name, job details, home stats. Full street address only after the contractor accepts the lead.
• Family members you invite— the access you grant.
• Commercial partners (manufacturers, insurers, inspectors, real estate agents) — aggregated and anonymized data only, minimum 50 records per data cell. This is off by default: sharing stays off until you explicitly turn it on, category by category, in Settings → Data & Privacy. You can turn any category back off at any time, and confirm every category is off at once via welcomehomesly.com/dont-sell (no account required) or by sending a Global Privacy Control signal from your browser.
• Service providers that operate Homesly for us (Supabase, Cloudflare R2, Vercel, Railway, Stripe, Resend, Twilio, Sentry, PostHog, Anthropic) under written data-protection agreements.
• Law enforcement and regulators when required by law.
• An acquirer if Homesly is involved in a merger, acquisition, or sale.

What we sell, plainly stated.Homesly’s commercial-data business sells non-personal, anonymized, and aggregated information about devices, appliances, and home services to manufacturers, insurers, real estate professionals, and inspector partners. What we sell does notinclude your name, email, phone, street address, account credentials, photos, family members, or payment information. What we sell does include things like “in ZIP 55401, X furnaces from manufacturer Y between Z years old were replaced last year” — never tied to a specific household.

California “sale” disclosure: even though Homesly never sells personally identifiable information, our anonymized-aggregated commercial-data products may still be classified as a “sale” or “share” under CCPA / CPRA. The same opt-out rights apply under Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, and other state privacy laws as they come into force. You can opt out in Settings, via welcomehomesly.com/dont-sell (account not required), or by sending a Global Privacy Control signal from your browser. A verified opt-out takes effect within 30 days; most are honored within a few days.

5-bis. What transfers when you sell your home — and what does not

When you sell your home and the new owner claims it on Homesly, the property record transfers with the address. Your personal information does not.

What transfers with the address

• Property details (year built, sqft, beds/baths, construction)
• Every appliance (manufacturer, model, serial, install year, photos of the serial plate, expected lifespan, warranty data)
• Every service record (date, type, description, cost, warranty terms, contractor name where logged)
• Every weather event recorded for the address
• Every Homesly-Do task and its disposition
• Home Health Score and sub-scores
• Landscaping records and irrigation history
• Documents about the property (warranty PDFs, inspection reports, permits)

What is removed before the new owner gains access

• Your name, email, phone
• Your account credentials and login history
• Your payment and subscription information
• Your family members’ names and emails
• Your notification preferences and data-sharing toggles
• The fact that you, specifically, were the homeowner (records show “logged by previous owner” or the contractor’s name)
• Photos containing you, your family, or identifying features unrelated to the property itself
• Free-text notes with identifying information about you (we surface flagged notes to you before transfer so you can edit them)
• Audit logs of your actions

Your access converts to read-only historical viewunder “Past Homes.” You can still export your history at any time. Your right to delete your account still applies; deletion scrubs your personal information per Section 10, and the property-anchored historical records continue to belong to the address.

6. Your rights and choices

You have the right to know what we have, to receive a copy, to correct, to delete, to opt out of sale/sharing, to limit use of sensitive information, and to non-discrimination. The primary way to exercise these is Settings → Data & Privacy. Email privacy@welcomehomesly.com for help or to designate an authorized agent.

7. Marketing and other communications

Transactional messages cannot be disabled while your account is active, but you can change the channel for each category in Settings. Marketing messages require opt-in. SMS frequency is governed by the alerts you enable; reply STOP any time.

Robo-scheduling places calls only to contractor businesses (not consumers) during 8am–6pm local time, with permanent opt-out on contractor request.

8. Cookies and analytics

Strictly necessary (cannot be disabled), performance/analytics via PostHog US (IP-anonymized, no session replay by default), and functional. We do not use advertising cookies. We honor Global Privacy Control signals.

9. How we protect your data

TLS 1.2+, encryption at rest, Argon2id passwords, MFA for admins, least-privilege access, annual security review, GLBA Safeguards Rule compliance.

10. How long we keep your data

• Account data — until deletion, then scrubbed within 30 days.
• Property records — retained indefinitely, attached to the property address.
• Anonymized behavioral data — up to 7 years.
• Payment records — retention required by tax law (typically 7 years).
• Communication and audit logs — 24–36 months.
• Connected-integration tokens — destroyed at disconnect.

11. International users and data transfers

Homesly is offered only to US residents and processed in the US.

12. Third-party links and integrations

Linked or connected services have their own privacy policies. Read them.

13. Changes to this Policy

We update the “Last updated” date and, for material changes, notify you by email and in-app at least 30 days before they take effect.

14-bis. Commercial portal users — contractors, manufacturers, inspectors, insurers, real estate agents

If you have signed up for the Homesly commercial portal at homesly.pro, this section supplements the rest of this Policy.

What we collect from commercial users

• Your name, business email, business phone, title, role
• Your business’s legal name, EIN, address, and registered business type
• Professional license number, license state, and verification status (for licensed roles)
• Banking and tax identification for payments (tokenized via Stripe)
• Documents to support license / insurance verification (COI, business license, manufacturer authorizations)
• Behavioral data — leads viewed, leads quoted, jobs completed, ratings received, chat with homeowners

How commercial-user data is shared

• With homeowners who match with you— business name, authorized contact info, tier badge, aggregate Homesly rating, specific quote
• With Homesly’s service providers as described in Section 5.4
• With governmental authorities for tax reporting, license verification, and as required by law
• In a corporate transaction as described in Section 5.6

We do not sell commercial-user data.Commercial-user data is not part of the anonymized aggregated datasets we license to manufacturers, insurers, or real estate professionals — those datasets are about homes, not service professionals.

Your rights as a commercial user

Commercial users have the same CCPA / CPRA rights as consumer users, with two role-specific exceptions: (1) license-verification records are retained for the period required by law and our insurance-partner agreements (typically 7 years); (2) job and rating history is part of the homeowner’s property record — after you delete your commercial account, your business name on those records is anonymized to “former Homesly Partner.”

California “B2B exception” notwithstanding, Homesly applies CCPA / CPRA consumer rights to commercial-user data as a matter of policy — you can know, correct, delete, and opt out of sale just like a consumer user.

Outbound calls to commercial users

Robo-scheduling calls and Homesly representative calls run only 8 a.m.–6 p.m. local time. Opt-out is permanent on request.

15. Contact us

• Privacy rights: privacy@welcomehomesly.com
• Security incidents: security@welcomehomesly.com
• General support: support@welcomehomesly.com