Privacy Policy

Last updated October 4, 2026

Who we are

Pencil (pencil.broker) is a commercial real-estate data platform for professional firms. It brings together property, ownership, debt, zoning and risk records, and gives members a shared workspace and an AI assistant (the Copilot) to work with them. In this policy, "Pencil", "we" and "us" mean the operator of pencil.broker.

What we collect from you

• Account data: your name, work email and firm, and the profile details you choose to add, such as your title and onboarding answers.
• Sign-in: sign-in is handled by Supabase Auth. If you use an email link or a password, the password goes to Supabase and never to our servers. If you sign in with Google or Microsoft, we receive only your name, email address and basic profile information from that provider, never your password for it.
• Workspace content: what you create in Pencil, such as lists, deals, notes, Copilot chats and files you upload.
• Logs and cookies: basic request logs (the page or address requested, without search details), an audit record of who accessed which records, and your IP address for rate limiting and security. We set only the cookies a session needs: HttpOnly, Secure session cookies that keep you signed in (up to 7 days, or 24 hours for guest access). Your browser also keeps a few settings, and a guest's work, in its own local storage.

Information we receive from Google is used only to sign you in and identify your account, in line with the Google API Services User Data Policy, including its Limited Use requirements.

Property and public-record data

Pencil compiles public records (such as property appraiser rolls, recorded deeds and mortgages, corporate filings and environmental data) and data licensed from data providers about properties and their owners. Some of these records name people, for example an individual who owns a property or signs for a company.

Where Pencil shows owner contact details, they come from a licensed provider and every phone number and email is shown with its do-not-call and litigator flags. Members are responsible for following telemarketing and other contact laws.

If a record is about you, you can ask what we hold or ask us to correct it by writing to the address in Contact. Tell us the property or record and, if something is wrong, what it should say. We will review it and tell you what we changed and why. Corrections are shown beside the public record; we do not alter the official record itself, which stays with the agency that keeps it.

Sales conversations

Draft for owner and legal review. This section was added on October 4, 2026 and has not yet been reviewed by counsel.

When you use "Request Pilot Access" on our website, Pencil's assistant asks a few questions before a person from our team follows up. We collect your answers (such as your role, what you need, your markets and the tools you use today), the conversation itself, and the contact details you give us: name, company, work email and, if you choose, phone. We also record your IP address to limit abuse of the form.

We use this only to understand what you need and to contact you about Pencil. Our sales team can read it. We keep it while we are in touch with you about Pencil, and you can ask us to delete it at any time by writing to the address in Contact.

Messages you type in the chat are sent to a third-party AI model provider to write the assistant's replies. Do not include sensitive personal information in them.

How we use information

• To provide the service: sign-in, your workspace, search, records and the Copilot.
• To keep it secure: preventing abuse, enforcing limits, investigating problems and auditing access.
• To support you and to tell you about changes to the service.

We do not sell personal data. We do not use advertising or cross-site tracking cookies, and we do not run advertising analytics on Pencil.

Service providers

We share information only with providers that help us run Pencil, and only what they need:

• Hosting: Vercel serves the website, and our own servers run the application and store workspace content and records.
• Authentication: Supabase stores account and sign-in data. Google and Microsoft take part only when you choose to sign in with them.
• AI model providers: when you ask the Copilot a question, the question and the property records needed to answer it are sent to a third-party AI model provider to write the answer. A workspace can limit this to providers that have agreed by contract not to retain the data.
• AI model provider for the sales chat (draft): messages typed in the website's sales chat are sent to a third-party AI model provider to write the replies. The contact details you enter in the final form are not sent to it.
• Email delivery for pilot requests (draft): when you request pilot access, your name, company, contact details, answers and chat are emailed to Pencil's team through an email delivery provider, so we can reply to you.
• Map, imagery and property-data providers: when you view a property, these providers may receive its location or identifiers so we can show maps, imagery and records. We do not send them your name or email.

We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply.

Retention and deletion

We keep account data and workspace content while your account or workspace is active. Guest chats, uploaded files and Copilot memory are deleted after 24 hours. You or your workspace administrator can delete chats and other workspace content at any time, and you can ask us to delete your account by email. Security and audit records are kept as long as needed to protect the service and meet legal obligations.

Security

Pencil is served over HTTPS. Session cookies are HttpOnly and Secure, so page scripts cannot read them. Passwords never reach our servers. Access is role-based, service keys stay on our servers, and access to sensitive records is recorded in an audit log that cannot be edited. No system is perfectly secure; if we learn of a breach affecting you, we will tell you as the law requires.

Your rights

You can ask to access, correct, export or delete the personal information we hold about you, or object to how we use it. Depending on where you live, laws such as the California Consumer Privacy Act or the GDPR may give you further rights. We will not treat you differently for using them. To make a request, write to the address below; we may need to confirm your identity first.

Not a consumer reporting agency

Pencil is not a consumer reporting agency, and its data is not a consumer report under the Fair Credit Reporting Act (FCRA). It may not be used to decide anyone's eligibility for credit, employment, insurance or housing. Credit, employment, insurance-eligibility and tenant-screening decisions are not permitted uses.

Contact

Questions, requests and corrections: hello@pencil.broker.

If we change this policy, we will update the date above and, for material changes, tell members in Pencil.