Effective date: 8 October 2026

This Privacy Policy explains how LienDeed (liendeed.us), operated by NativeMind, a company registered in Thailand (tax ID 0505568015371) (“we”, “us”), collects, uses and protects personal data when you use our website, web apps, mobile apps, API, MCP server and data packages (the “Service”). Terms not defined here have the meaning given in our Terms of Service.

1. Who is responsible

NativeMind is the controller of the personal data described in this policy. For any privacy question or request, contact us at [email protected].

When a team owner invites you to a team, the team owner decides what is shared within the team; we process team data on behalf of the team to provide the Service.

2. Data we collect about our users

Account data. Your email address, a password (stored only as a one-way hash, never in readable form), your name if you provide it, and, if you sign in with Google or Apple, the identifier and email address those services share with us. Settings such as language, time zone, states and counties of interest and notification preferences.

Workspace data. Watchlists, saved searches, alerts, notes, course progress, simulator portfolios (play money only), team membership and roles, and activity within teams.

Subscription and billing data. Your plan, billing interval, trial and subscription status, data package orders, and the identifiers of your Stripe customer or App Store / Google Play purchase (passed to us through RevenueCat). Card details are entered directly with Stripe, Apple or Google; we do not see or store full card numbers.

AI assistant data. The messages you send to the assistant, its replies and the records it used.

Developer data. API keys (stored as a hash; shown in full only when created) and records of API and MCP calls.

Usage and device data. Searches, exports, API calls and assistant messages counted against plan limits; IP address, browser or app type and version, device and operating system, and timestamps in technical and security logs; push notification tokens if you enable push notifications.

Access logs for person-level data. When you open owner or contact information inside the apps, we record who accessed which record and when (see section 4).

Communications. Messages you send us, support requests and our replies.

We do not ask for special categories of personal data, and we ask you not to put them in the Service.

3. How we use data and our legal bases

Purpose	Legal basis (GDPR and similar laws)
Create and run your account, provide search, watchlists, alerts, teams, courses, the simulator, notifications and the API/MCP	Performance of our contract with you
Run the AI assistant and AI explanations at your request	Performance of contract
Manage subscriptions, trials, payments, invoices, data packages and promotions	Performance of contract; legal obligations (tax and accounting)
Enforce plan limits, prevent abuse, fraud and unauthorised access, log access to person-level data and keep the Service secure	Legitimate interests in operating a secure, lawful and fair service
Fix problems and improve the Service using aggregated or pseudonymised usage data	Legitimate interests
Send service, security and billing messages	Performance of contract; legitimate interests
Send optional news or product updates	Consent, which you can withdraw at any time
Show information from public property records (section 4)	Legitimate interests in providing tax lien and tax deed research, balanced against the rights of the people concerned
Comply with law and respond to lawful requests; establish or defend legal claims	Legal obligations; legitimate interests

We do not sell personal data and do not use it for third-party advertising. We do not use your content to train AI models. We do not make decisions that have legal or similarly significant effects on you solely by automated means.

4. Data from public records about property owners

The Service shows information compiled from public county and state records, such as parcels, assessments, tax bills, tax sales, auctions and certificates. Some of these records name property owners, taxpayers, certificate holders or bidders and contain their mailing addresses. We handle that data as follows:

• Public pages never show owner names or mailing addresses. Parcel pages visible without signing in are redacted.
• Owners cannot be looked up by name. Search by person name returns only investors in their investor role (certificate holders, bidders); a property owner can be reached only through a property record. Addresses of individual investors are not shown in investor search results.
• Access is limited and logged. Owner and contact information is available only inside the apps, to signed-in users on plans that include it, for lawful purposes stated in the Terms. Each access to person-level data is recorded, and we review the logs for misuse.
• Not for FCRA purposes. LienDeed is not a consumer reporting agency, and users may not use the data to decide on anyone’s eligibility for credit, employment, insurance or housing.
• Your requests. If you are a property owner or heir, you can ask what data we show about you, ask for corrections, or object to its use, by writing to [email protected] with the property address or parcel number. Information on redeeming a property is on our redemption help page. Where the data is a public record that the law allows us to show, we may keep showing it, but we will correct errors and consider each request.

5. Processors and other recipients

We share personal data only as needed with service providers that process it on our behalf under contracts requiring confidentiality and security:

• Cloudflare — network delivery, DNS, secure tunnel to our servers, protection against attacks and delivery of our emails (sees connection data such as IP addresses, and email addresses for emails);
• Stripe — web payments, subscriptions and data package purchases;
• RevenueCat — management of in-app subscriptions bought through Apple or Google;
• Apple (App Store) and Google (Google Play) — in-app purchases, under their own privacy policies;
• Google Firebase Cloud Messaging — delivery of push notifications;
• an AI model provider acting as a processor — generating the AI assistant’s responses and explanations from the messages and context you send it;
• Google and Apple — only if you choose to sign in with them.

Our database, authentication and file storage (self-hosted Supabase) run on servers operated by NativeMind, not by a third-party database provider.

We may also disclose data to professional advisers, to a successor in a merger or sale of the Service (with notice to you), or where required by law or to protect rights, safety and the integrity of the Service. Within a team, members and admins see the team’s shared workspace according to their roles.

6. Where data is stored and international transfers

The Service runs on servers operated by NativeMind, accessed through Cloudflare’s network. Our processors may handle data in other countries, including the United States. Where data is transferred outside the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK addendum) or the processor’s certification under an applicable data privacy framework. You can ask us for information about these safeguards.

7. Security

We protect data with measures appropriate to the risk, including encrypted connections (TLS), hashing of passwords, refresh tokens and API keys, access controls and least-privilege access, rotation of session tokens with reuse detection, audit logging of access to person-level data and regular backups. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

8. How long we keep data

• Account and workspace data: while your account exists. When you delete your account, it is kept for a 30-day grace period in which you can restore it, and then deleted or anonymised.
• AI assistant conversations: while your account exists, or until you delete them.
• Usage records and API logs: up to 12 months.
• Logs of access to person-level data: up to 24 months, to investigate misuse.
• Security and technical logs: up to 90 days, longer only when needed to investigate an incident.
• Billing records: as long as tax and accounting law requires (typically up to 10 years).
• Backups: deleted data disappears from backups when they expire, about five weeks after deletion.

9. Your rights

Depending on where you live, you have the right to:

• access your personal data and receive a copy (you can request an export in the app settings);
• correct inaccurate data (most of it you can edit yourself in the app settings);
• delete your data — you can delete your account at any time in the app settings;
• export your data in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• restrict processing in certain cases;
• withdraw consent where processing is based on consent, without affecting earlier processing;
• lodge a complaint with your local data protection authority.

To use these rights, write to [email protected] from the email address of your account (or, for data in public records, with the property details). We may need to verify your identity and will reply within one month (extendable where the law allows). Residents of California and other US states have equivalent rights to know, delete and correct, and the right not to be discriminated against for using them; we do not sell or share personal data for cross-context behavioural advertising.

10. Cookies and local storage

We use only the cookies and browser storage necessary to run the Service. See the Cookie Policy.

11. Children

The Service is not directed to children and may only be used by adults (see the Terms). We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. We will notify you of material changes by email or in the app before they take effect. The date at the top shows when it last changed.

13. Contact

Privacy: [email protected]. General questions: [email protected]. Billing: [email protected].