Plain-English Summary
Short version: Arete uses your purchase/license information, email address, home details, optional inspection-report text, and generated report data to create and deliver your home review. We do not sell personal information, rent it, act as a data broker, or use it for cross-context behavioral advertising.
Arete Home Review is part of the Arete product series from FiguredUp, a product of OnRepeat Ventures LLC. In this policy, "Arete," "we," "us," and "our" refer to OnRepeat Ventures LLC operating Arete Home Review.
This policy applies to aretehomereview.com, the Arete Home Review intake at intake.aretehomereview.com, the generated PDF report, the private living report page, and related transactional or seasonal emails.
Arete is operated by an Illinois company and is currently designed and marketed for U.S. homeowners and home buyers. We do not intentionally market the product outside the United States, but we have not technically blocked non-U.S. purchases. If you use Arete from outside the United States, your information will be processed in the United States and by the vendors listed below.
Some privacy laws apply only when a business meets specific thresholds, handles specific types of data, or markets into specific places. Even where a law does not strictly apply, we try to use practical baseline rights: access, correction, deletion, portability where feasible, opt-out of optional emails, and clear disclosure of vendors and retention.
The Current Workflow
Gumroad is part of the purchase flow. Arete does not collect payment-card numbers in the intake form. After checkout, Gumroad gives you a license key and the private intake link. Arete verifies the license key with Gumroad before generating a report.
What We Collect
| Category | Examples | Source |
|---|---|---|
| Contact and delivery data | Email address, report delivery status, support messages if you reply. | You provide it in the intake or by email. |
| Purchase/license data | License key, Gumroad product verification response, whether a purchase appears refunded, disputed, charged back, or cancelled. | You provide the key; Gumroad verifies it. |
| Home profile and intake answers | Home type, age range, city, climate, systems, maintenance history, known leaks, roof/foundation details, appliances, and optional listing details. | You submit it through the intake. |
| Inspection or listing report text | Text extracted from an optional inspection PDF or real-estate listing PDF. The original PDF file is read in your browser and is not intentionally uploaded as a file to Arete. | You choose to upload a PDF; local PDF.js extracts text in your browser. |
| Generated report data | Structured report JSON, PDF report, living report metadata, report ID, download link, created/completed timestamps. | Created by Arete using your submitted information and Anthropic Claude. |
| Seasonal reminder data | Email, climate, city, report ID, last reminder season, subscription created date. | Only if you opt in to season-aware reminders. |
| Technical and security data | IP address, browser/network request metadata, rate-limit counters, server logs, error messages, and basic diagnostic data. | Collected automatically by Arete's hosting stack and service providers. |
| Local browser storage | In-progress intake answers and living report check-off state. Inspection PDF text is not saved to localStorage. | Stored locally in your browser. |
Please do not include sensitive personal information unless it is genuinely needed for the report. You can redact your address, names, account numbers, photos of people, medical information, government IDs, financial account details, or unrelated private information from an inspection report before uploading it.
How We Use Information
- To verify your Gumroad purchase/license key.
- To generate the AI-assisted home review, PDF report, and private living report.
- To email your report, report links, and service messages.
- To enforce rate limits, reduce abuse, prevent duplicate license use, and protect the service.
- To provide optional season-aware reminder emails if you opt in.
- To respond to support, privacy, security, legal, tax, or compliance needs.
Where applicable law requires a legal basis for processing, the main bases are performance of a contract, consent, legitimate interests in security and service operation, and legal obligations. Optional seasonal reminders are consent-based, and every reminder includes an unsubscribe link.
Arete does not use your report data to make automated decisions with legal or similarly significant effects. The report is informational homeowner guidance only. It is not a home inspection, engineering opinion, insurance decision, lending decision, legal advice, real estate negotiation advice, or financial advice.
Technology Vendors and Their Policies
The current report stack uses the vendors below. Their policies may change over time, so the linked policies are the controlling vendor documents for their services.
| Vendor | Role in Arete | Data involved | Policy links |
|---|---|---|---|
| Gumroad | Checkout, product content page, and license-key verification. | Purchase/account information, license key, payment-related data handled by Gumroad and its processors. | Privacy Policy |
| Vercel | Website hosting, serverless functions, request logs, private Blob storage, cron jobs, and security headers. | Submitted intake data in transit, generated report data, private PDF files, IP/log/diagnostic data. | Privacy Notice DPA |
| Anthropic | AI model provider for the structured report analysis. | Sanitized form inputs, extracted inspection text, and the generated output needed to create the report. | Commercial Terms DPA Privacy Policy |
| Upstash Redis | Temporary job state, living report data, license claims, rate-limit counters, and seasonal reminder records. | Report JSON, metadata, report IDs, email/license claim records, reminder opt-in data, and rate-limit keys. | Privacy Policy PDF DPA PDF |
| Resend | Transactional email delivery and optional seasonal reminder emails. | Email address, report email content, PDF attachment, report/download links, unsubscribe link, delivery metadata. | Privacy Policy DPA |
| Google Fonts | Web font delivery on the public pages. | When fonts load from Google, your browser sends standard request data such as IP address, requested URL, user agent, and referrer. | Google Fonts Privacy FAQ Google Privacy Policy |
| Local libraries | PDF.js and Alpine.js are served from Arete's own site for PDF text extraction and intake interactivity. | These local scripts do not receive your data as outside services. | Served locally from Arete. |
Anthropic's commercial/API terms state that customers retain rights to inputs and own outputs, and that Anthropic may not train models on Customer Content from the Services. Arete relies on that commercial/API relationship for the report-generation path, not on the consumer Claude.ai flow.
Retention
| Data | Current retention practice |
|---|---|
| Original inspection or listing PDF file | The original PDF is read in your browser for text extraction. We do not intentionally upload or keep the original PDF file. |
| Extracted inspection or listing text | Sent to the server and Anthropic only as needed to generate the report. We do not intentionally store the raw extracted text after generation completes. |
| Living report data and report access record | Stored in Upstash Redis with a 90-day expiry from generation. |
| Private PDF report | Stored in private Vercel Blob storage for the 90-day report window. A daily cleanup cron deletes generated report PDFs after the retention window; deletion may occur on the next daily cleanup run after day 90. |
| License claim record | Stored for 90 days so one purchase cannot be reused indefinitely. The same email may submit a revised report within the allowed revision window. |
| Rate-limit counters | Short windows: roughly 1 hour for IP counters, 24 hours for email counters, and 25 hours for the global daily counter. |
| Seasonal reminder subscription | Stored for up to 365 days and refreshed when reminders are sent, unless you unsubscribe earlier. |
| Local browser storage | Intake progress and report check-offs remain on your device until submitted, cleared, or removed by your browser. |
| Emails and support messages | Kept as needed for delivery, support, legal, tax, fraud-prevention, and business records. Your own email provider may retain copies in your mailbox. |
Backups, logs, provider records, and legally required records may persist longer where necessary, but they remain subject to access controls and applicable provider terms.
Your Privacy Rights
You may ask to access, correct, delete, or receive a copy of personal information associated with your email, report ID, or purchase/license record. You may also object to certain processing, withdraw consent for optional seasonal reminders, or ask us to explain our collection, use, disclosure, and retention practices. The exact rights and response timelines available to you depend on the law that applies to you and to Arete.
We do not sell personal information, share personal information for cross-context behavioral advertising, rent personal information, or act as a data broker. We do not intentionally collect biometric identifiers or biometric information; please do not upload photos of people, fingerprints, face scans, voiceprints, or similar biometric data in an inspection report.
We may need to verify your identity before acting on a request. We may also keep information where legally allowed or required for security, fraud prevention, tax/accounting records, dispute resolution, or compliance.
Send requests to reports@aretehomereview.com with the subject "Privacy Request." We aim to respond within the timeframe required by applicable law. If a request relates to Gumroad, Resend, Vercel, Anthropic, Upstash, or another vendor record that we cannot directly control, we will tell you and, where feasible, help route or support the request.
You can unsubscribe from seasonal reminder emails using the unsubscribe link in any reminder. Service emails, such as report delivery or support replies, are not marketing emails.
Sale, Sharing, Advertising, and Cookies
Arete does not sell personal information, rent personal information, act as a data broker, or share personal information for cross-context behavioral advertising. The Arete pages do not use advertising cookies in the current implementation.
Gumroad runs the checkout experience and may use cookies, analytics, payment processors, and advertising tools under its own policy when you are on Gumroad pages. Google Fonts may receive standard browser request data when fonts load.
Because we do not sell or share personal information for targeted advertising, we do not provide a separate "Do Not Sell or Share" opt-out link. If that practice changes, this policy and the site controls should change first.
Security
- Report IDs are randomly generated and act as private access links. Treat them like private documents and do not share them publicly.
- PDFs are stored using Vercel Blob private access, then served through an Arete download endpoint.
- A daily cleanup cron deletes generated report PDFs after the 90-day retention window.
- Living report data is returned with no-store cache headers.
- The intake validates and caps submitted fields, uses CORS allow-listing, and rate-limits submissions.
- License keys are not intentionally logged in full; diagnostic logs use only limited correlation details.
- Security headers restrict framing, content types, permissions, and cross-origin behavior.
No internet transmission or storage system is perfectly secure. If a security incident triggers legal notice duties, we will provide notices as required by applicable law. If you believe your report link, license key, or personal data has been exposed, contact us promptly.
Children
Arete Home Review is intended for homeowners and home buyers, not children. We do not knowingly collect personal information from children under 18. If you believe a child provided personal information, contact us and we will take appropriate steps.
International Transfers
Arete is operated from Illinois in the United States and uses service providers that may process information in the United States and other countries. Vendor data-processing terms may rely on mechanisms such as Standard Contractual Clauses, Data Privacy Framework participation, or similar safeguards where applicable.
Changes
We may update this policy when the product, workflow, vendors, retention practices, or legal requirements change. The effective date at the top of this page shows the current version date.
Contact
For privacy requests or questions, email reports@aretehomereview.com with the subject "Privacy Request."
This policy is a product-specific privacy notice, not legal advice. If you actively market or sell into highly regulated regions, have counsel review this policy, the vendor contracts, and the live implementation before launch.