Privacy Policy

Information we collect

• Account and sign-in. Your email address and name, handled through Firebase Authentication (Google). If you sign in with Google or Apple, we receive the basic profile you authorize. We never see or store your password.
• Diligence and product data. The properties, parcels, tax-sale lists, budgets, bid plans, watchlists, and notes you create or that our engine generates for your account, stored in our Neon Postgres database and isolated to your account.
• Billing. Subscription status and payment records. Card details are handled by Stripe; we do not receive or store full card numbers.
• Usage and diagnostics. Product-usage events (PostHog) and error/crash diagnostics (Sentry) that help us keep the app working. Aggregate performance metrics and logs are monitored privately (Grafana Cloud).
• Requests you send us. If you use the request-access or contact forms, the email and message you provide (with a Cloudflare Turnstile bot check).
• Auction-day capture (mobile). Auction outcomes you record in the field, synced to your account.
• Surplus / overage-recovery service (only if you use it). To pursue tax-sale or foreclosure surplus on your behalf we collect identity and contact information, government-ID verification (through Stripe Identity), and electronically signed engagement, limited power-of-attorney, and disclosure documents (through SignWell). We also handle public-records (FOIA) correspondence related to your claim. Funds are never held by Vesper; disbursement is handled through a partner attorney’s trust (IOLTA) account, and we record only the metadata of that handoff.

How we use information

We use your information to provide and improve the service: to run the diligence engine and deliver your ranked results, to authenticate you, to process subscriptions, to communicate with you, to keep the product reliable and secure, and, if you engage the overage-recovery service, to prepare and pursue your claim. We do not sell your personal information.

Service providers

We rely on a small set of vetted providers who process data on our behalf under their own terms:

• Google / Firebase: authentication.
• Neon: Postgres database (your account data).
• Vercel: application and site hosting.
• Cloudflare: DNS, CDN, object storage (R2), bot defense, and inbound email routing.
• Stripe: billing, and Stripe Identity for ID verification in the overage service.
• Anthropic: the Claude API, which processes property and public-record data to generate diligence analysis. Data sent to the API is not used to train models.
• SignWell: electronic signature of engagement and disclosure documents.
• Amazon Web Services (SES): transactional and public-records email.
• Ably: realtime sync for auction-day capture.
• PostHog (product analytics), Sentry (errors), Grafana Cloud (logs and metrics).
• Mailing and skip-trace vendors: used only in the overage service to reach owners of unclaimed funds.
• A partner attorney: for the legal handling and trust-account disbursement of any recovered funds.

Cookies and analytics

The public marketing site uses no behavioral tracking and no cookies beyond what a bot-check widget needs. The signed-in application uses a session cookie to keep you logged in and product analytics (PostHog) to understand how features are used. We do not run third-party advertising trackers.

Security and retention

Data is encrypted in transit and at rest, and each account’s data is isolated at the database level (row-level security) so one customer cannot read another’s. We keep information for as long as your account is active or as needed to provide the service and meet legal, tax, and record-keeping obligations, then delete or anonymize it. Overage-claim records may be retained longer where law requires.

Your choices and rights

You can access and update your account information in the app, and you can ask us to correct or delete your personal information by contacting us. Depending on where you live, you may have additional rights over your personal information; we honor applicable requests. Vesper is intended for business and investment use by adults and is not directed to children under 18.

Changes and contact

We may update this policy as the product evolves; we will change the date above and, for material changes, notify account holders. Questions or requests: privacy@vesperapp.io. See also our Terms of Service.