Privacy Policy

Effective Date: February 16, 2026 · Last Updated: July 26, 2026

1. Introduction

This Privacy Policy describes how Upstate Nooks LLC, doing business as MTR Analytics ("we," "us," or "our"), collects, uses, stores, shares, and protects your personal information when you use our website, platform, and related services (collectively, the "Service"). MTR Analytics is a software-as-a-service platform for mid-term rental (30+ day stays) market analysis, property listing optimization, and investment research.

We are committed to protecting your privacy. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

If you do not agree with the practices described in this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address
Password (stored in hashed form; we do not store plaintext passwords)
First name and last name
Display name (optional)
Communication and notification preferences
Subscription plan and billing information (payment card details are processed by our payment processor and are not stored on our servers)

We may require email verification before you can fully access the Service. If we offer a third-party sign-in option in the future, we would receive basic profile information (such as your name and email address) from that provider in accordance with the permissions you grant.

2.2 Information Collected Before You Create an Account

You can browse parts of our website and use certain entry flows (such as searching for a market or viewing a limited preview) without creating an account. In those cases we may still collect:

Technical and security data described in Section 2.10
Advertising and conversion-measurement data described in Section 2.11
Product analytics and session-replay data described in Section 2.12
Location or search inputs you voluntarily submit (for example, a city, ZIP code, or address you enter to look up a market), which we use to route you to the relevant preview or analysis experience

2.3 Property Listing Information

When you create or manage property listings, we collect:

Property address (street, city, state, ZIP code)
Property details (bedrooms, bathrooms, beds, guest capacity, listing type, property type)
Amenities and property features
Financial information about your property (rent, fees, deposits, minimum stay)
Nearby points of interest associated with your property address

2.4 Property Images

When you upload photographs of your property, we collect and store those image files. Uploaded images may contain embedded metadata (such as location or camera information). We recommend removing sensitive metadata from photographs before uploading.

2.5 Property Analysis Data

When you analyze a specific property, we collect:

Property address and details (bedrooms, bathrooms, square footage, year built, property type)
Financial inputs (purchase price, down payment, loan terms, property tax, insurance, utilities, maintenance, HOA fees, furnishing costs, and other investment parameters)
Saved analyses, deal pipeline entries, default assumptions, and user notes
Shareable analysis links and exported documents you choose to create

2.6 Property Search Data

When you search for properties listed for sale, we collect your search parameters, including geographic area, bedroom and bathroom counts, price range, and property type filters.

2.7 Saved Comparables

When you save lists or sets of comparable properties, we collect the names you provide and the comparable properties you select.

2.8 Search and Usage Data

When you use the platform, we collect your search queries, the geographic areas you researched, the features you use, and timestamps. When you are signed in, this activity is associated with your user account.

2.9 Feedback

If you submit feedback or contact us, we collect the information you provide, such as your message and the page you were on when you submitted it.

2.10 Technical and Security Data

When you access the Service, we automatically collect standard technical information, including IP address, browser type, operating system, pages visited, and timestamps. We use security, abuse-prevention, and error-monitoring services that process limited technical data (such as IP address, device information, and diagnostic details) to keep the Service secure, stable, and free of automated abuse. We also use advertising and conversion-measurement technologies (Section 2.11) and product analytics and session-replay technologies (Section 2.12), which are further described in Section 8.

2.11 Advertising and Conversion Measurement Data

We use Meta's advertising and measurement tools — including browser-based measurement tags and server-side conversion events — to measure the effectiveness of our advertising, understand how visitors arrive at and use the Service, and reach people who may be interested in MTR Analytics. Through these tools we collect and share with Meta Platforms, Inc.:

Events describing your activity on the Service, such as pages viewed, searches run, features used, account sign-ups, checkouts initiated, and completed purchases, along with related details (for example, the plan or subscription value).
Online identifiers stored in first-party cookies set by Meta's measurement tools (including the _fbp and _fbc cookies) and click identifiers passed in advertising links.
Technical data such as your IP address, browser user-agent, and the page URL where an event occurred.
Hashed (irreversibly encoded) identifiers used to match activity to a Meta account, such as your email address, name, and a pseudonymous account identifier. This information is converted into a non-readable form using industry-standard cryptographic hashing before it is transmitted.

Meta uses this information to measure and attribute advertising, to build and serve audiences (including custom audiences and "lookalike" audiences of people similar to our existing users), and to optimize ad delivery. Meta processes this data under its own terms and policies. We do not receive your readable personal information back from Meta through these tools. You can control or opt out of these technologies as described in Section 8, Section 10, and Section 11.

2.12 Product Analytics and Session Replay

We use PostHog, Inc. ("PostHog") as a product-analytics and session-replay provider to understand how people use the Service, diagnose issues, and improve product experience. Through PostHog we collect and process:

Usage events, including pages viewed, navigation within the Service, clicks and other interactions, form submissions, and custom product events (for example, account sign-up or sign-in, checkout initiation, listing creation, deal tracking actions, and property analysis runs), along with related event properties.
Identifiers, such as a pseudonymous analytics identifier stored in your browser, and — when you are signed in — your account user ID and email address so we can associate usage with a known user.
Technical data, such as IP address, browser and device information, referring URL, and the page URL where an event occurred.
Session recordings (session replay), which capture a visual reconstruction of your interactions with the Service (for example, clicks, scrolls, and page transitions) so we can review how features are used and where users encounter problems. Recordings may include on-screen content from the pages you view. We configure masking for sensitive input fields where supported, but you should not enter secrets (such as passwords or payment card numbers) into non-payment fields.

PostHog acts as a service provider / processor on our behalf and is permitted to use this data only to provide analytics and session-replay services to us. PostHog processes data under its own terms and privacy practices. We do not use PostHog to sell your personal information or to serve third-party advertising. You can request deletion or ask us to stop associating analytics with your account as described in Section 10.

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service: To create and manage your account, store and display your property listings, deliver analysis results, and operate preview and search experiences
AI-powered analysis: To process relevant data through our AI provider for listing optimization, property analysis, market analysis, regulation analysis, and related insights (see Section 4)
Market analytics: To compile rental market metrics, comparables, and trends from publicly available listings and other market datasets, and to match them to the geographic areas you research
Location services: To resolve addresses and places, display maps, identify nearby points of interest, and calculate distances
Property data retrieval: To obtain for-sale listings, rent estimates, property valuations, and property records for the addresses and areas you analyze
Billing and subscriptions: To process payments, manage your subscription, and apply plan entitlements
Communications: To send service and account communications, including verification emails and alerts when a requested analysis is ready
Authentication and security: To verify your identity, prevent automated abuse, enforce access controls, and protect the Service
Service improvement: To monitor reliability, understand product usage (including through product analytics and session replay described in Section 2.12), diagnose issues, and improve the Service
Advertising and measurement: To measure and improve our advertising, attribute sign-ups and subscriptions to campaigns, and reach potential new users, including by sharing limited and hashed identifiers with our advertising partner as described in Sections 2.11 and 6

We do not sell your personal information for money. We do use advertising and measurement technologies that may be considered a "sale" or "share" of personal information under certain U.S. state privacy laws, as described in Sections 2.11, 6, 8, and 11. You can opt out as described in Section 10 and Section 11.

4. Artificial Intelligence and Automated Processing

MTR Analytics uses a third-party AI provider's commercial services to power certain analysis features.

4.1 Our AI Provider's Role and Commitments

Our AI provider acts as a data processor on our behalf, governed by its commercial terms and a data processing addendum. Key protections include:

Under the provider's commercial terms, it may not train its models on data submitted through its commercial API. Your data is not used to train or improve its generally available AI models.
You retain all rights to your inputs.
API inputs and outputs are retained by the provider for a limited period for abuse monitoring and then deleted. We have not opted into any voluntary data-sharing or model-training programs with the provider.

4.2 What Data Is Sent to Our AI Provider

Only two features send property-specific information to our AI provider: the Listing Optimizer (your listing details and photos, analyzed for quality and improvement recommendations) and the Property Analyzer (a subject property's address and financial summary, analyzed for investment strengths and risks).

All other AI-assisted features send only geographic identifiers (such as ZIP codes, cities, and states) together with aggregated, non-personal market data. We never send your account credentials or payment information to our AI provider. Results for shared geographic areas may be cached and reused across users to improve performance and reduce processing.

5. Property Images

Your property images are stored with our cloud infrastructure provider. When you request a listing analysis, your images may be sent to our AI provider for quality assessment and are not retained by the provider beyond its standard limited retention period.

When you delete a listing or remove images, the associated records and files are deleted. If you need to confirm deletion of specific image files, contact us at privacy@mtranalytics.com.

6. Service Providers

We rely on trusted service providers to operate the Service. Each acts as a processor on our behalf and is permitted to use the data we share only to provide their service to us. We do not sell personal information for money. The categories of providers we use are:

Cloud infrastructure and authentication: Hosting of our database, user authentication, and file storage for the data described in this policy.
Artificial intelligence: Generating the analyses described in Section 4, subject to the data-use restrictions stated there.
Payment processing: Securely processing subscription payments. We receive your email and subscription status but never store your full payment card details.
Mapping, geocoding, and location data: Resolving addresses and places, displaying maps and imagery, and identifying nearby points of interest. We share addresses and geographic coordinates as needed for these features.
Property and market data: Providing for-sale listings, property records, valuations, rent estimates, and rental market datasets used to power the Service.
Email delivery: Sending service and notification emails to your address.
Security, abuse prevention, and error monitoring: Preventing automated abuse and detecting errors, using limited technical data such as IP address and diagnostics.
Product analytics and session replay: Understanding how the Service is used, diagnosing product issues, and improving features. We share the usage events, identifiers, technical data, and session recordings described in Section 2.12 with our analytics provider, PostHog, Inc.
Advertising and conversion measurement: Measuring advertising effectiveness, building and reaching audiences, and optimizing ad delivery. We share the activity events and hashed identifiers described in Section 2.11 with our advertising partner, Meta Platforms, Inc.
Optional partner services: When you choose to use an optional feature, such as requesting a landlord insurance estimate, we share only the information needed for that request (for example, a property address).
Public government data sources: Public demographic and economic datasets are incorporated using geographic identifiers; no personal data is shared with these sources.

Each provider maintains its own privacy practices. We select providers that offer appropriate data protection commitments and limit them to processing data solely on our instructions. To request the current list of our key sub-processors, contact us at privacy@mtranalytics.com.

7. Data Retention

Account information: Retained while your account is active. Deleted within 30 days of an account deletion request.
Property listings, images, and analysis results: Retained until you delete the listing or request account deletion.
Market analyses: Cached for a limited period, then regenerated on demand. Not associated with individual users.
Property analyses, saved deals, and comparables: Retained until you request deletion.
Search history and feedback: Retained unless you request deletion.
Subscription and billing data: Retained while your account is active and as required for tax and legal compliance.
Usage and diagnostic data: Retained for service operation, security, and reliability.
Product analytics and session recordings: Retained in our analytics provider according to our configured retention settings and the provider's practices, and deleted or dissociated upon a valid deletion request where technically feasible.
AI provider data: Retained by our AI provider for a limited period, then deleted in accordance with the provider's commercial terms.

To request deletion of any of your data, contact us at privacy@mtranalytics.com.

8. Cookies and Local Storage

We use a small number of essential, first-party cookies to operate the Service, including cookies that maintain your authenticated session and record your subscription status so we can route you correctly. These cookies are necessary for the Service to function.

Our security and abuse-prevention providers may set their own cookies or process device information to distinguish legitimate users from automated traffic during sign-up and sign-in.

We also store limited preferences (such as your light/dark theme and certain interface settings) in your browser's local or session storage.

We use advertising and measurement cookies set by Meta's tools (such as the _fbp and _fbc cookies) to measure advertising effectiveness and support the audiences described in Section 2.11.

We also use first-party cookies, local storage, or similar technologies for product analytics and session replay (via PostHog), including a pseudonymous distinct identifier used to recognize your browser across visits and associate events and session recordings described in Section 2.12. Analytics traffic may be routed through our own domain (a reverse proxy) so that requests appear as first-party network calls.

You can limit or block these technologies by adjusting your browser cookie settings or device controls, by using your Meta ad preferences and the controls described in Section 10 and Section 11, or through industry opt-out pages such as the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org). We do not currently respond to browser "Do Not Track" signals in a standardized way, so these controls are the most reliable way to opt out. Where required by law, we will honor Global Privacy Control (GPC) signals as described in Section 11.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption of data in transit, secure password hashing, access controls, and account-scoped access restrictions so that each user's data is accessible only within that user's account.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

10. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information, including your account, listings, images, search history, and analysis results. Upon a valid request, we will delete your data within 30 days, subject to legal retention requirements.
Export / portability: Request your data in a structured, machine-readable format.
Opt out of sale or sharing: Opt out of the sale or sharing of personal information for cross-context behavioral advertising, as described in Section 11.
Marketing opt-out: Opt out of marketing communications as described below.

To request account deletion or exercise any of these choices, contact us at privacy@mtranalytics.com.

We will respond within the time required by applicable law (and in any event within 45 days, or sooner where a shorter period applies). We may verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf where permitted by law.

Marketing Communications

You can opt out of marketing communications at any time by updating your preferences in account settings, using the unsubscribe link in any email, or contacting us at privacy@mtranalytics.com.

Advertising Opt-Out

We share limited and hashed identifiers and activity events with our advertising partner for conversion measurement and audience building, as described in Sections 2.11, 6, and 8. You may limit or opt out of these technologies at any time by:

Adjusting your cookie or tracking settings in your browser or device;
Using your advertising preferences within your Meta account;
Using industry opt-out tools at optout.aboutads.info and optout.networkadvertising.org; or
Contacting us at privacy@mtranalytics.com with the subject line "Do Not Sell or Share My Personal Information."

Product Analytics and Session Replay Choices

You may request that we delete analytics data associated with your account or stop associating future product analytics and session recordings with your identified account by emailing privacy@mtranalytics.com with the subject line "Analytics Opt-Out." You can also limit analytics cookies and local storage through your browser settings, though some Service features may still generate server-side or essential logs described elsewhere in this Policy.

11. U.S. State Privacy Rights

If you are a resident of California or another U.S. state that provides similar privacy rights (including, where applicable, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws), you may have additional rights regarding your personal information.

11.1 Categories of Personal Information

Depending on how you use the Service, we may collect the following categories of personal information: identifiers (such as name, email address, and IP address); commercial information (such as subscription status and purchases); internet or electronic activity information (such as browsing, search activity, product-analytics events, and session recordings on the Service); geolocation-related information you provide (such as addresses or ZIP codes you search); visual information (such as property photos you upload and on-screen content captured in session recordings); and inferences drawn from the foregoing for advertising measurement, audience building, and product improvement.

We do not knowingly collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose sensitive personal information for purposes that require a right to limit under California law, other than as permitted to provide the Service.

11.2 Sale and Sharing for Advertising

We do not sell personal information for money. We do share personal information with Meta Platforms, Inc. for cross-context behavioral advertising and advertising measurement, as described in Section 2.11. Under California law and certain other state laws, that activity may be considered a "sale" or "share" of personal information.

To opt out of the sale or sharing of your personal information for these purposes, email privacy@mtranalytics.com with the subject line "Do Not Sell or Share My Personal Information," or use the advertising controls described in Section 10. Where required by applicable law, we will treat a legally recognized opt-out preference signal, such as the Global Privacy Control (GPC), as a valid request to opt out of sale or sharing for the browser or device that sends the signal.

11.3 Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

11.4 Shine the Light

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes in a manner that would require a separate "Shine the Light" notice beyond this Policy. To make a request, contact privacy@mtranalytics.com.

12. International Users

The Service is operated from the United States and is intended primarily for users in the United States. If you access the Service from outside the United States, you understand that your information may be processed and stored in the United States and in other countries where our service providers operate, which may have data-protection laws that differ from those in your country of residence.

13. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at privacy@mtranalytics.com.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable laws. When we make material changes, we will update the date at the top of this page and notify registered users via email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy, privacy inquiries, Do Not Sell or Share requests, or account deletion, contact us at:

Upstate Nooks LLC, d/b/a MTR Analytics
Email: privacy@mtranalytics.com

We will respond to all legitimate requests within the time required by applicable law.

This Privacy Policy was last reviewed and updated on July 26, 2026.