Privacy Policy

Bricklight is a decision-support tool for home buyers. We help you pause before making an offer by translating a listing, your budget comfort, photos of the home, commute, and routine into a plain-language Reality Check. Bricklight is not a real-estate agent, lender, inspector, appraiser, or attorney.

To build a Reality Check, you may give us:

• Listing details — listing URLs, MLS numbers, and the home address or general area you're considering.
• Budget comfort — household income range, down payment, monthly payment you'd feel calm at, and the payment that would feel tight.
• Payment estimates — quoted interest rate, taxes, insurance, HOA, PMI, and any lender estimates you paste in.
• Photos and documents — listing photos, inspection reports, disclosures, or your own walkthrough photos.
• Commute locations — work, school, gym, family addresses you'd drive to from this home.
• Home preferences — yard, layout, school, walkability, noise tolerance, repair appetite.
• Family and lifestyle notes — household size, kids' ages, pets, work-from-home days, plans for the next 3–5 years. We use these only to weight what matters in the report.
• Account info — name, email, password (hashed), and any team members you invite.
• Support messages — anything you send to our inboxes.

Photos, PDFs, and notes you upload are stored in encrypted object storage and tied to your account. They are visible only to you and to anyone you explicitly share a report link with. We do not sell, license, or train third-party models on your uploads.

Generated reports — the Reality Check, Monthly Reality Stack, Photo Review, and question lists — are stored under your account so you can revisit them. You can delete any individual report at any time from its page.

Bricklight uses large language models and computer-vision models to help summarize listings, flag photo concerns, draft questions for your agent or lender, and translate jargon. AI processing happens through enterprise API endpoints that do not retain your data for training.

AI outputs are suggestions, not facts. We label confidence on each finding and always show what the model saw. You decide what to act on. If a finding is wrong, the "Reviewer's notes" control on each report lets you correct it — corrections stay private to your account.

Client-specific financial inputs are stripped of PII before prompt-tuning. Raw buyer data is not fed into public LLM training sets.

Bricklight performs no automatic offer submission, document signing, or purchase decisioning. A human must finalize a Reality Report before PDF export.

Payments are handled by Stripe. We never see or store full card numbers. Stripe shares with us the last four digits, card brand, billing country, and the success/failure of each charge so we can show your receipts and handle refunds. See Stripe's privacy notice for how they process payment data.

We use a small number of first-party cookies for sign-in, CSRF protection, and remembering whether you've dismissed the cookie banner. We use a privacy-respecting analytics tool that records aggregate page views and click events — never keystrokes, never form contents, never your uploads. You can opt out from the footer cookie link without losing access.

Bricklight connects with a small set of data sources to fill in property details and travel times. These are vendor API relationships, not partnerships or endorsements.

• Yardi / Entrata — connector. Data in: property tax ids and hoa fee schedules. Data out: none, read-only. Auth and security: OAuth 2.0 scoped to property details.
• Google Maps Platform — live api. Data in: origin and destination coordinates. Data out: transit time and route variance. Auth and security: API key restricted by IP/referrer.
• Zillow API — live api. Data in: property metadata and historical listings. Data out: none, read-only. Auth and security: Standard REST hooks.

If API latency exceeds 3000ms, Bricklight prompts manual entry for the specific fee or distance from the listing sheet.

By default every report is private. When you create a share link, you choose one of three permission levels: view-only, view + comment, or full edit. Share links can be revoked at any time and automatically expire after 60 days unless you extend them. We log who opened a share link (timestamp, coarse location) so you can see if a report was viewed.

We don't share your information with agents, lenders, or partners unless you explicitly forward a report to them.

You can delete any individual report, photo, or commute address from the relevant page — deletion is immediate and removes the item from backups within 30 days. To delete your entire account, email privacy@bricklight.co from the address on the account. We verify the request, delete account data within 14 days, and confirm in writing. Records we must keep for tax or fraud-prevention reasons (invoices, abuse logs) are retained for the legally required period and then deleted.

PII retention: purged 12 months after account inactivity unless the user exports the report to a permanent archive.

SOC 2 Type II attestation completed March 2025. Scope: data privacy and availability for the production environment.

Encryption: AES-256 at rest and TLS 1.3 in transit. Access follows RBAC roles — Admin, Agent, Buyer, Viewer — and MFA is enforced for Agent/Admin accounts through Auth0. We run access reviews, log admin actions, and run automated dependency scans. Suspected vulnerabilities can be reported to security@bricklight.co — we respond within three business days and don't pursue good-faith researchers.

Bricklight is for adults considering a home purchase. We do not knowingly collect information from anyone under 16. If you believe a child has created an account or uploaded content, email privacy@bricklight.co and we will delete it.

Bricklight is operated from the United States. If you use the product from the EU, UK, or another region with data-transfer rules, you consent to transferring your information to the United States for processing. For EU/UK residents we honor access, correction, portability, and deletion requests under GDPR — contact privacy@bricklight.co.

Privacy questions, data requests, or anything that doesn't feel right: privacy@bricklight.co.

Bricklight, LLC. · 240 Water St. Brooklyn, NY 11201, United States · +1 (347) 542-8624 · https://bricklight.co/

This policy is last updated May 2026. If we make a material change we'll email account holders at least 14 days before it takes effect and post a dated changelog at the top of this page. Continued use after the effective date means you accept the updated policy.