Privacy Policy

Casaroo helps home buyers understand a home's condition. Doing that involves your photos of someone's home, so we hold ourselves to a simple rule: extract the facts, then delete the photos. This policy explains what we collect, what we keep, what we delete, and your choices, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Casaroo, operated from Ontario, Canada, is responsible for personal information under its control. Our privacy contact is hello@getcasaroo.com.

1. The short version

We collect the minimum we need: your email, the listing details and scores you generate, your walkthrough findings, and basic usage analytics. We never keep your photos: each one is de-identified, read once to extract the findings, then deleted. We keep the information we read from them (things like "60 amp fuse panel" or "asphalt roof, roughly 18 years"), never the images. We do not sell your personal information. Any condition dataset we build is de-identified and area-level. You can ask to access, correct, or delete your information at any time.

2. What we collect

Walkthrough photos (the in-person Walkthrough). Photos you take of a home's systems and finishes: electrical panel, furnace, water heater, roofline, plumbing, and similar. These are the most sensitive thing we touch and get the strictest handling (section 3).

Findings extracted from photos. The structured facts our AI reads out of your photos before the photos are deleted: system conditions, estimated ages, flags, two-axis scores, station coverage, punch-list items. This derived data is what we keep.

Location. Each photo record stores only the forward sortation area (the first three characters of a postal code) and a city name. If you type a property address when starting a walkthrough, that address is stored with your walkthrough record so your Review is labeled usefully, and it stays in your own private record until you delete it. It is never attached to photo records and never part of any licensed dataset.

Your notes. The optional "anything worrying you" text you type during a walkthrough. Free text can contain anything you choose to write, so include only what you are comfortable with us processing and retaining with your walkthrough.

Account and contact information. An email address if you sign up, join the waitlist, or ask for a report by email, plus sign-in identifiers. Guest walkthroughs run under an anonymous session identifier created on your device.

Listing Scorer inputs. Listing URLs, specs you enter (price, year, size, beds and baths), and listing photos or screenshots you upload. Listing photos are processed transiently to produce your score and are never stored; we retain the specs, scores, and flags.

Payments. Paid features are processed by Stripe. Card details go to Stripe (PCI DSS Level 1); we keep only non-sensitive references such as the transaction record and card brand.

Usage analytics. Product analytics (pages, feature events, referrer and campaign source) via PostHog, plus technical logs needed to run and secure the Service.

We do not intentionally collect sensitive categories such as health information, financial account numbers, or government identifiers. Please do not submit them.

3. The photo lifecycle: extract, then delete

1. De-identification before saving. When you add a photo it is downscaled and re-encoded on your device, which removes EXIF metadata including GPS location. Our system detects likely personal information in the frame (faces and bodies, documents and mail, screens, license plates, house numbers) and those regions are irreversibly pixelated on your device before the photo is saved.
2. An honest note on detection. To find those regions, a copy of the photo is sent to our AI provider for detection before pixelation. That copy is processed transiently to return the regions and is not stored.
3. Default-deny caution. If detection fails or is not confident, the entire photo is pixelated rather than risking an unscrubbed detail getting through.
4. Private storage, briefly. The scrubbed photo is uploaded to a private storage bucket that is not publicly readable, so the AI can read all your photos together when generating your Review. Each record carries the consent version you accepted, what the photo was of, and coarse location only.
5. Read once, then deleted. When your Casaroo Review is generated, the findings are extracted and every photo file from that walkthrough is deleted from storage, with the deletion time recorded. What remains is derived data only. You can also remove any photo yourself during a walkthrough. If you start a walkthrough and never finish it, email us and we will delete its photos.

Kept versus discarded. We keep facts: findings, labels, scores, capture metadata, coarse location. We discard pixels: the scrubbed uploads are deleted after extraction, and originals never leave your device except the transient detection copy described above.

4. Consent, and how to withdraw it

We ask for consent at the moment it matters, not buried in legal pages:

1. At walkthrough start you check a box confirming the walkthrough is educational, that you were lawfully present and permitted to photograph, and that Casaroo may process your photos as described here, including keeping the extracted findings. The exact version of the consent text you accepted is stored with your walkthrough and every photo record.
2. Photo retention would be a separate opt-in. Today, no photo files are kept after extraction, ever. If we ever offer to keep de-identified photos to improve Casaroo's models, that will be a separate checkbox naming that purpose, off by default, and never bundled into the main consent.
3. Derived data. We use retained derived data (findings, labels, scores, coarse location) to operate and improve Casaroo, including the prompts, calibrations, and models behind it.
4. Email. Report and waitlist emails cover what you signed up for, and every non-essential email includes an unsubscribe that works.

Withdrawal. You can withdraw consent at any time by emailing us. Withdrawal stops future collection and use of your identifiable information and we will delete it (section 7). Withdrawal cannot recall de-identified data already merged into aggregate datasets.

5. How we use information, including AI

We use information to provide the Service (findings, scores, Reviews), run the extract-then-delete pipeline, improve Casaroo using derived and de-identified data, communicate with you, process payments, prevent abuse, and meet legal obligations. We do not sell personal information and we do not use it for advertising.

Automated processing. Scores and flags are produced by AI (currently Google's Gemini model, reached through our infrastructure provider's AI gateway). Your photos and specs are sent to the model solely to generate your result. Casaroo's output is informational triage, not a home inspection or professional advice, and you can always reach a human by email.

The condition dataset. Casaroo's long-term value includes a de-identified, area-level dataset of home condition facts and scores: never images, never identities, never exact addresses. If that dataset is ever licensed to others (for example insurers or valuation providers), what is licensed is de-identified, aggregated condition data only. Your email, account, address, and anything identifying you stay out of it.

6. Who processes data for us

Service providers process personal information on our instructions under contract: Lovable Cloud and Supabase (hosting, database, storage), Google (Gemini API, transient AI processing of photos and text), Stripe (payments), our email delivery provider (transactional and, with consent, product email), and PostHog (product analytics).

Cross-border transfer. Some of these providers process and store information in the United States, where it may be subject to lawful access by authorities there. PIPEDA permits transfers to processors under contractual safeguards providing comparable protection, with transparency to you; this section is that notice.

7. Retention

Walkthrough photos are deleted when your Review is generated, and on request for unfinished walkthroughs. Listing photos are never stored. Findings, scores, and walkthrough records are kept while your walkthrough or account exists; on a deletion request they are removed or retained only in de-identified form. Email and lead records are kept until you unsubscribe or ask us to delete them, and are then purged within 30 days except records that payment or tax law requires us to keep. Analytics and technical logs are kept only as long as needed to analyze, improve, and secure the product.

8. Safeguards

Private, access-controlled storage buckets; row-level security on database tables; encryption in transit; de-identification before storage; and a design in which the strongest safeguard is structural: after extraction there is no photo left to breach. No method is perfectly secure. We will notify affected individuals and the Office of the Privacy Commissioner of Canada of any breach creating a real risk of significant harm, as PIPEDA requires.

9. Your rights

Under PIPEDA you may request access to your personal information and an account of how it has been used and disclosed, ask us to correct it, withdraw consent, and request deletion subject to legal retention requirements. Email hello@getcasaroo.com and we will respond within 30 days. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of BC and Alberta may also have recourse to their provincial privacy commissioners where provincial private-sector law applies.

10. Children

Casaroo is for adults and is not directed to children. We do not knowingly collect children's information, and the de-identification step treats any person in a photo, including children, as something to pixelate before storage.

11. Changes

Updates will be posted here with a new date, with in-app or email notice for material changes.

12. Contact

Privacy contact: hello@getcasaroo.com, Casaroo, Ontario, Canada.