Privacy Policy

1Who we are

CMA Studio is published by Dissonance LLC, a Colorado limited liability company (entity ID 20261959661), 1500 N Grant St, Ste R, Denver, CO 80203, USA. Company details are on our company page. Dissonance LLC is the controller of the personal data described here.

Questions, requests, or complaints: ian@cmastudio.app.

CMA Studio is a business tool sold to licensed real estate professionals. It is not directed at consumers and not directed at anyone under 18.

2What never reaches our servers

There are two deliberate exceptions, and both are narrow:

• Market context by ZIP code. To show neighbourhood market statistics we call our own endpoint with the subject property's ZIP code only, which proxies to RentCast. No address, no comparables, no seller information. Responses are cached by ZIP.
• The labelled beta MLS search. If you use the clearly marked beta control that searches a vendor-supplied sample dataset, the ZIP code and the search filters you enter are sent to our server so it can query that vendor. This is disclosed in the studio at the point of use. It is optional, it is not the normal workflow, and it is not live MLS data.

3What we do collect

Your email address

You give us an email address to unlock free presentations or to buy a plan. We store it two ways, on purpose:

• as an irreversible hash in the usage ledger that counts how many presentations an account has generated. The ledger cannot be read back into an email address;
• as plaintext in a separate private record, and in our email provider's contact record, so we can actually email you.

Where email verification is enabled, the verification code itself is stored hashed, expires within minutes, and is deleted after use.

Payment information

Payments are processed by Stripe. Card numbers are entered on Stripe's own checkout page. We never receive, see, or store your card details. Stripe holds a customer record containing your email address and the billing address it collects for tax purposes, and tells us only that a payment succeeded and which plan it was for.

Website usage

We use Vercel Web Analytics on our pages. It is aggregated and cookieless: it does not set tracking cookies, does not build a profile of you, and does not follow you to other sites. Reports you download are excluded from analytics entirely, so an offline report file reports nothing to anyone.

Your browser's own storage

CMA Studio saves your branding, your in-progress work, and your most recent report in your browser's local storage so you do not lose them on refresh. That data stays on your device. We cannot read it. Clearing your browser storage deletes it.

Things you send us directly

If you email us or reply to one of our emails, we keep that correspondence so we can answer you and follow up.

4Why we use it

• To provide the service: metering free and paid usage, granting access to what you bought, and letting you back into your account. This is necessary to perform our contract with you.
• To email you about the product: verification codes and purchase confirmations are transactional and are sent because you asked for the service. Product tips and updates are sent on the basis of your consent, and every one of them can be unsubscribed from in one click.
• To keep the service working and honest: preventing abuse of the free tier, debugging failures, and understanding in aggregate which pages people use.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not train machine-learning models on your data.

5Who processes data on our behalf

We use a small number of service providers. Each receives only what it needs to do its job.

These providers are located in the United States. If you are outside the US, using CMA Studio involves transferring your data there.

6How long we keep it

• Usage and entitlement records are kept for as long as your account exists, because they are the record of what you paid for and what you have used.
• Your email address is kept until you ask us to delete it or unsubscribe and request removal.
• Payment records are retained by Stripe and by us for as long as tax and accounting law requires, which is generally seven years.
• Comparable property data and finished reports have no retention period here, because we never received them.

7Your rights

You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, or stop using it for product email. Email ian@cmastudio.app and we will respond within 30 days. We will not charge you for it and we will not treat you differently for asking.

Depending on where you live you may have additional rights, including under the California Consumer Privacy Act or the UK and EU GDPR, and the right to complain to your local data protection authority. Deleting your account data also deletes the record of any free presentations you have already used.

Marketing email carries an unsubscribe link in every message. Transactional email, such as a verification code or a receipt, is part of the service and cannot be unsubscribed from while you have an account.

8Security, and its limits

Traffic is served over HTTPS. Stored usage records are held in private storage that is not publicly readable, email addresses used for metering are hashed, and payment credentials never touch our systems at all. Access to production systems is limited to the company's sole member.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data we will tell you and the relevant regulator as the law requires.

9Changes to this policy

If we change how we handle your data in a way that materially affects you, we will update the date at the top of this page and email registered users before the change takes effect. Continuing to use CMA Studio after that means you accept the updated policy.