Privacy Notice

Who we are

Underwrite is operated by LUCE CONSULTING - FZCO, a free zone company licensed by the Dubai Integrated Economic Zones Authority (licence 65547), Dubai Silicon Oasis, Dubai, United Arab Emirates. It is responsible for the personal data described in this notice.

What we collect

When you create an account we collect: email, name, and authentication metadata via Clerk. When you subscribe, billing details are handled entirely by Stripe — we do not store card data. If your account has a free trial, we keep the date it ends with your account. If you answer “Where did you hear about us?” after signing up, we keep your answer (one of a fixed list) with your account. We log basic request metadata (timestamp, route, anonymized IP) for security and abuse prevention. We count page visits with Vercel Web Analytics: the page visited, the referring site, the country and the type of device, in aggregate, without cookies and without identifying you.

We also use PostHog, on servers in the European Union, to understand how visitors move through the site: the pages viewed and their order, the buttons clicked, the referring site, the country and the type of device. It sets no cookies and stores nothing on your device: PostHog tells visits apart with a code made on its servers, never with your name, email or account, and it discards IP addresses. We do not record visits, and staff visits are not counted.

We also count a few actions on the site in the same anonymous way, without cookies: for example, which ready-made question was used, whether an answer was shared, and the optional “Who is asking?” choice under an answer (such as “I rent” or “Investing”). When ChatGPT or Claude uses Underwrite’s tools, we count each call in PostHog the same way: the tool and the platform, never the question. These counts are never linked to your question or to you. When you create an account, we also record which of our pages you signed up from, with your account.

When you use Ask Underwrite, we store your question and our answer, with a one-way code made from your IP address (or your account if you are signed in), to check our answers and improve the service. We keep them for 12 months, then delete them; you can ask us to delete yours sooner. The same applies to questions asked through the Underwrite app in ChatGPT or Claude: we keep the question the assistant sends us and our answer, never your conversation or your account with them.

When a search finds no building or community, the words you searched are sent to Mapbox to find where the place is, so we can point you to its area. We keep those words and what was found, without your IP address or account, to see which buildings people look for that have no page yet.

How we use it

To authenticate you, deliver the subscribed service, communicate essential service messages, prevent abuse, and improve the product. We do not sell personal data and do not use it for cross-site advertising.

Sub-processors

Clerk (authentication), Stripe (billing), Neon (database hosting), Upstash (caching), DigitalOcean Spaces (asset CDN), Vercel (hosting and page-visit counts), PostHog (how the site is used, without cookies, on EU servers), Mapbox (the maps, and finding where a searched place is when no building matches), Anthropic (the language model that writes Ask Underwrite's answers, the answers of the in-app assistant on the app's pages, which receives the messages you type to it, and the building summaries, written from published building data only).

Your rights

Data export: signed-in users can download a JSON export of their account record at GET /api/user/export. The export covers Underwrite's primary database. Authentication data is held by Clerk and billing records by Stripe — request export from those providers separately.

Erasure: signed-in users can delete their account under Account, Security, "Manage security settings", or by sending POST /api/user/delete with body {"confirm":"DELETE_MY_DATA"}. Everything you made goes with the account: your watchlist, notes, shared report links, mandates, memos and Ask questions. Invoices already issued are kept by Stripe, our payment processor, as UAE record-keeping requires.

For other requests (access in a different format, correction, objection) email privacy@underwrite.ae. We respond within 30 days.

Cookies

We use only essential cookies: the Clerk session, Stripe checkout, one that remembers that you hid the message about your free trial, and, when you ask Ask Underwrite without signing in, one (uw_ask) holding a random number that counts your questions for the daily limit. Page visits and how the site is used are counted without cookies (Vercel Web Analytics and PostHog). No advertising trackers are set.