Privacy Policy

Effective Date: February 16, 2026 · Last Updated: February 22, 2026

1. Introduction

This Privacy Policy describes how Upstate Nooks LLC, doing business as MTR Analytics ("we," "us," or "our"), collects, uses, stores, shares, and protects your personal information when you use our website, platform, and related services (collectively, the "Service"). MTR Analytics is a software-as-a-service platform for mid-term rental (30+ day stays) market analysis, property listing optimization, and investment research.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

If you do not agree with the practices described in this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address
Password (hashed and stored securely; we never have access to plaintext passwords)
First name and last name
Display name (optional)
Marketing communication preferences
Subscription plan and billing information (payment details are processed directly by Stripe, Inc. and are not stored on our servers)

If you authenticate via Google OAuth, we receive your name and email address from Google in accordance with the permissions you grant.

2.2 Property Listing Information

When you create or manage property listings, we collect:

Property address (street, city, state, ZIP code)
Property details (bedrooms, bathrooms, beds, guest capacity, listing type, property type)
Amenities and property features
Financial information about your property (rent, fees, deposits, minimum stay)
Nearby points of interest (retrieved automatically based on your property address)

2.3 Property Images

When you upload photographs of your property, we collect and store those image files. Uploaded images may contain embedded metadata (such as EXIF data including GPS coordinates and camera information). We recommend removing sensitive metadata from photographs before uploading.

2.4 Deal Analyzer Data

When you use the Deal Analyzer, we collect:

Property address and details (bedrooms, bathrooms, square footage, year built, property type)
Financial inputs (purchase price, down payment, loan terms, property tax, insurance, utilities, maintenance, HOA fees, furnishing costs, and other investment parameters)
Saved deals and user notes
Shareable deal analysis links (accessible via unique URLs)

2.5 Deal Finder Data

When you use the Deal Finder to search for properties listed for sale, we collect your search parameters including geographic area, bedroom and bathroom counts, price range, and property type filters.

2.6 Saved Comp Lists

When you save lists of comparable properties, we collect the list names you provide and the comparable properties you select.

2.7 Search and Usage Data

When you use our analysis tools, we collect your search queries, the geographic areas you searched (ZIP codes, cities, states), saved comparable property lists, and timestamps. This data is associated with your user account.

2.8 Technical Data

When you access the Service, we automatically collect standard server log information including IP address, browser type, operating system, pages visited, and timestamps. We do not use any third-party analytics, advertising, or tracking scripts.

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service: To create and manage your account, store and display your property listings, and deliver analysis results
AI-powered analysis: To send relevant data to our AI provider (Anthropic) for listing optimization, deal analysis, market analysis, regulation analysis, and market insights (see Section 4)
Market data retrieval: To query third-party rental market data providers using geographic identifiers
Geocoding and location services: To convert addresses into coordinates, identify nearby points of interest, and calculate distances
Property data retrieval: To query third-party property data providers for sale listings, rent estimates, and property valuations
Billing and subscriptions: To process payments, manage your subscription, and track usage against plan limits
Authentication and security: To verify your identity and enforce access controls
Service improvement: To analyze aggregated, de-identified usage patterns

We do not sell your personal information. We do not use your personal information for advertising or profiling.

4. Artificial Intelligence and Automated Processing

MTR Analytics uses AI services provided by Anthropic, PBC through their commercial API to power our analysis features.

4.1 Anthropic's Role and Commitments

Anthropic acts as a data processor on our behalf, governed by their Commercial Terms of Service and Data Processing Addendum (DPA). Key protections include:

Under Anthropic's Commercial Terms (Section B), Anthropic may not train its models on data submitted through its commercial API. Your data is not used to train or improve Anthropic's AI models.
You retain all rights to your inputs.
Anthropic retains API inputs and outputs for up to 30 days, after which the data is deleted. We have not opted into any voluntary data-sharing or training programs.

4.2 What Data Is Sent to Anthropic

Listing Optimizer: When you request an analysis of your property listing, we send your property details (address, description, amenities, pricing), property images, and image quality metrics to Anthropic's API, including its Vision API for image analysis. Anthropic returns optimization recommendations, quality scores, and suggested improvements.

Deal Recommender: When you analyze a property deal, we send the property address, financial metrics (purchase price, estimated revenue, cap rate, cash flow), market context, demand driver proximity, and regulatory risk to Anthropic. Anthropic returns investment strengths and risks to help inform your decision. Along with the Listing Optimizer, this is one of two features that send property-specific data.

Demand Driver Generator: When we identify demand drivers for a market, we send geographic identifiers (city, state, ZIP code, coordinates) to Anthropic. No property addresses, personal information, or images are sent.

Market Analysis Tools: Our Opportunity Finder, Regulation Analyzer, and Market Takeaway Generator send only geographic identifiers (ZIP codes, cities, states) and aggregated market data to Anthropic. No property addresses, personal information, or images are sent for these features. The results are cached and shared across all users searching the same area.

5. Property Images

Your property images are stored in cloud storage provided by Supabase, Inc. When you request a listing analysis, your images are sent to Anthropic's Vision API for quality assessment. Anthropic does not permanently store these images beyond its standard retention period of up to 30 days.

When you delete a listing or remove images, the associated records and files are deleted. If you need to confirm deletion of specific image files, contact us at jimmy@mtranalytics.com.

6. Third-Party Service Providers

We share data with the following third-party service providers to operate the Service. We do not sell data to any third party.

6.1 Anthropic, PBC — AI Analysis

Data shared: Property listing details and images (Listing Optimizer); property address and financial metrics (Deal Recommender); geographic identifiers and aggregated market data (all other analysis tools)
Data use restriction: May not train models on data submitted through its commercial API
Retention: Up to 30 days
Privacy: anthropic.com/legal/privacy

6.2 AirROI — Rental Market Data

Data shared: Geographic search queries and bedroom count filters. No user account information or property addresses.

6.3 Mapbox, Inc. — Geocoding and Maps

Data shared: Property addresses (for geocoding), geographic coordinates (for nearby places and directions)
Privacy: mapbox.com/legal/privacy

6.4 U.S. Government Data Sources — Census Bureau and Bureau of Labor Statistics

Purpose: The U.S. Census Bureau provides demographic data (population, income, education). The Bureau of Labor Statistics provides employment and economic data (unemployment rates, employment counts, consumer price index).
Data shared: ZIP codes, county identifiers, and geographic area codes only. These are public U.S. government APIs. No user personal data is shared.

6.5 Geoapify GmbH — Location Services

Data shared: Geographic coordinates and category filters. No user account information or property addresses.
Privacy: geoapify.com/privacy-policy

6.6 Supabase, Inc. — Infrastructure

Data shared: All user data described in this policy is hosted on Supabase infrastructure (database, authentication, file storage)
Data use restriction: Acts as a data processor; does not access or use your data for its own purposes
Privacy: supabase.com/privacy

6.7 Rentcast, Inc. — Property Data

Data shared: Property addresses, bedroom/bathroom filters, and geographic search parameters. Provides sale listings, rent estimates, property valuations, and property records.
Privacy: rentcast.io/privacy

6.8 Stripe, Inc. — Payment Processing

Data shared: Email address and payment method details. Payment information is processed directly by Stripe and is not stored on our servers.
Privacy: stripe.com/privacy

6.9 Google LLC — Google Places API

Data shared: Geographic coordinates and place search queries for resolving demand driver locations. No user account information or property addresses.
Privacy: policies.google.com/privacy

7. Data Retention

Account information: Retained while your account is active. Deleted within 30 days of an account deletion request.
Property listings, images, and analysis results: Retained until you delete the listing or request account deletion.
Market analyses: Cached for 30 days, then regenerated on demand. Not associated with individual users.
Deal analyses and saved deals: Retained until you request deletion.
Search history: Retained unless you request deletion.
Subscription and billing data: Retained while your account is active and as required for tax and legal compliance.
Usage data: Retained for billing and service limit enforcement.
Anthropic API data: Retained by Anthropic for up to 30 days, then deleted.

To request deletion of any of your data, contact us at jimmy@mtranalytics.com.

8. Cookies and Local Storage

We use a single first-party cookie (authToken) to maintain your authenticated session. This cookie expires after 30 days and is essential for the Service to function.

We store your theme preference (light or dark mode) in your browser's local storage.

We do not use third-party cookies. We do not use any analytics, advertising, or cross-site tracking tools.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption of data in transit, secure password hashing, access controls, and user-level data isolation at the database layer. Each user's data is scoped to their account and inaccessible to other users.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

10. Your Rights and Choices

MTR Analytics complies with the General Data Protection Regulation (GDPR) and applicable data protection laws. Depending on your jurisdiction, you have the following rights:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data, including your account, listings, images, search history, and analysis results. Upon a valid request, we will delete your data within 30 days.
Data portability: Request your data in a structured, machine-readable format.
Restriction: Request that we restrict processing of your data in certain circumstances.
Objection: Object to processing of your data for certain purposes, including direct marketing.
Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To request account deletion or exercise any of your rights, contact us at jimmy@mtranalytics.com.

We will respond within 30 days. We may verify your identity before processing your request. If unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

Marketing Communications

You can opt out of marketing communications at any time by updating your preferences in account settings, using the unsubscribe link in any email, or contacting us at jimmy@mtranalytics.com.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at jimmy@mtranalytics.com.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable laws. When we make material changes, we will update the date at the top of this page and notify registered users via email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy, data protection inquiries, or account deletion, contact us at:

Upstate Nooks LLC, d/b/a MTR Analytics
Email: jimmy@mtranalytics.com

We will respond to all legitimate requests within 30 days.

This Privacy Policy was last reviewed and updated on February 22, 2026.