Privacy Policy

1Who we are

CMA Studio is published by Dissonance LLC, a Colorado limited liability company (entity ID 20261959661), 1500 N Grant St, Ste R, Denver, CO 80203, USA. Company details are on our company page. Dissonance LLC is the controller of the personal data described here.

Questions, requests, or complaints: ian@cmastudio.app.

CMA Studio is a business tool sold to licensed real estate professionals. It is not directed at consumers and not directed at anyone under 18.

2What never reaches our servers

There are three deliberate exceptions. Each is optional, each is disclosed in the studio at the point of use, and none of them is the export workflow above:

• Market context by ZIP code. To show neighbourhood market statistics we call our own endpoint with the subject property's ZIP code only, which proxies to RentCast. No address, no comparables, no seller information. Responses are cached by ZIP.
• The MLS search. If you use the MLS search, the subject property's street address and your search filters are sent to our server. The address is used to find its map location, so that distance to each comparable can be calculated, and the resolved location is cached so the same address is not looked up twice. Address lookup uses the United States Census Bureau geocoder. Your seller's details are never sent, and the finished report is still generated on your device.
• The public record for a home that is not listed. When the MLS search finds no listing for the address you typed, which is the usual case for a home you are about to price, the subject property's street address is sent to RentCast, a public-records service, to fetch the home's beds, baths, square footage, lot size, year built, property type and county. Only those fields reach your browser; the owner's name, sale history, prices and tax figures in that record are discarded on our server and never stored. We keep the fields we show for 30 days so the same address is not looked up twice. If nothing comes back you simply type the details, exactly as before.

On the MLS search path we hold a replica of the OneKey MLS feed, licensed through MLS Grid, on our own server, because their API supports replication only and cannot be queried by location. That replica stores a deliberately minimised field set: the property and price attributes needed to compute a comparative market analysis. Owner names, listing- and buyer-agent contact details, and showing instructions are excluded at the request layer and are never stored. Closed sales are kept for 24 months; a listing that leaves the feed is excluded from every search and its photos are deleted. Listing photos are copied to our server, as the licence requires, and are shown only inside a CMA.

On that path we also keep an access log, because the MLS data licence requires us to be able to show which records were reached and when. Each entry records the date and time, whether it was an address lookup or a comparables search, the subject address you searched, the search settings you chose, and how many results came back. It records no comparables, no seller details, no IP address and no email. Entries are deleted automatically after 12 months.

3What we do collect

Your email address

You give us an email address to unlock free presentations or to buy a plan. We store it two ways, on purpose:

• as an irreversible hash in the usage ledger that counts how many presentations an account has generated. The ledger cannot be read back into an email address;
• as plaintext in a separate private record, and in our email provider's contact record, so we can actually email you.

So that rebuilding the same home within 7 days does not use up another presentation, the studio also sends the usage ledger a one-way fingerprint of the subject address, made with a random value that is created in your browser and never leaves it, so we cannot turn it back into an address or match the same home across browsers.

Where email verification is enabled, the verification code itself is stored hashed, expires within minutes, and is deleted after use.

Payment information

Payments are processed by Stripe. Card numbers are entered on Stripe's own checkout page. We never receive, see, or store your card details. Stripe holds a customer record containing your email address and the billing address it collects for tax purposes, and tells us only that a payment succeeded and which plan it was for.

Website usage

We use Vercel Web Analytics on our pages. It is aggregated and cookieless: it does not set tracking cookies, does not build a profile of you, and does not follow you to other sites. Reports you download are excluded from analytics entirely, so an offline report file reports nothing to anyone.

Alongside page views we count which steps of the studio get reached — comps loaded, package created, report downloaded, checkout opened — so we can see where the product loses people. These counts carry no property address, no comparable, no price, and nothing about your seller. The list of what an event is permitted to contain is enforced in code rather than by habit: anything not on it is discarded before sending.

If you arrive from one of our ads, the campaign name from the link is kept in your browser for that visit only, so we can tell which ad brought you. It is discarded when you close the tab, and it identifies the ad, never you.

Referral links, and the one cookie we do set

We run an affiliate programme, so some people reach us through a referral link shared by someone else. If and only if you arrive that way, we set a cookie recording which partner referred you, so that they can be credited if you later subscribe. That cookie holds a short partner code. It does not hold your name, your email, or anything about what you do on the site, and it is not used to build a profile or to advertise to you elsewhere.

If you did not arrive from a referral link, this cookie is never set. It expires after 90 days. When you check out, the partner code is passed to Stripe alongside the payment so the referral can be credited; nothing else about you travels with it.

The referral link itself is handled by our own service at go.cmastudio.app, which we operate. Your click is not handed to a third-party advertising network.

Your browser's own storage

CMA Studio saves your branding, your in-progress work, and your recent packages in your browser's own storage so you do not lose them on refresh. Your packages, including the comparables and the subject address inside them, are kept on your device and nowhere else. We cannot read them. Clearing your browser storage deletes them, and you can delete any individual package from the "Your packages" list at any time.

The map of comparable properties

On the MLS path the studio can show your subject property and its comparables on a map. The map itself is ours. We host the map files at tiles.cmastudio.app, so your browser asks us for them and no mapping company is contacted, sent the property's location, or told anything about your search. The map images are built from OpenStreetMap data, which we credit on every map. The picture that appears in the finished report is generated on your device and embedded in the file, so the report still works offline and nothing about it is uploaded.

Things you send us directly

If you email us or reply to one of our emails, we keep that correspondence so we can answer you and follow up.

4Why we use it

• To provide the service: metering free and paid usage, granting access to what you bought, and letting you back into your account. This is necessary to perform our contract with you.
• To email you about the product: verification codes and purchase confirmations are transactional and are sent because you asked for the service. Product tips and updates are sent on the basis of your consent, and every one of them can be unsubscribed from in one click.
• To keep the service working and honest: preventing abuse of the free tier, debugging failures, and understanding in aggregate which pages people use.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not train machine-learning models on your data.

5Who processes data on our behalf

We use a small number of service providers. Each receives only what it needs to do its job.

These providers are located in the United States. If you are outside the US, using CMA Studio involves transferring your data there.

6How long we keep it

• Usage and entitlement records are kept for as long as your account exists, because they are the record of what you paid for and what you have used.
• Your email address is kept until you ask us to delete it or unsubscribe and request removal.
• Payment records are retained by Stripe and by us for as long as tax and accounting law requires, which is generally seven years.
• Comparable property data and finished reports have no retention period here, because we never received them.

7Your rights

You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, or stop using it for product email. Email ian@cmastudio.app and we will respond within 30 days. We will not charge you for it and we will not treat you differently for asking.

Depending on where you live you may have additional rights, including under the California Consumer Privacy Act or the UK and EU GDPR, and the right to complain to your local data protection authority. Deleting your account data also deletes the record of any free presentations you have already used.

Marketing email carries an unsubscribe link in every message. Transactional email, such as a verification code or a receipt, is part of the service and cannot be unsubscribed from while you have an account.

8Security, and its limits

Traffic is served over HTTPS. Stored usage records are held in private storage that is not publicly readable, email addresses used for metering are hashed, and payment credentials never touch our systems at all. Access to production systems is limited to the company's sole member.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data we will tell you and the relevant regulator as the law requires.

9Changes to this policy

If we change how we handle your data in a way that materially affects you, we will update the date at the top of this page and email registered users before the change takes effect. Continuing to use CMA Studio after that means you accept the updated policy.