Data & Personal Information Handling

1. How this is built, in plain terms

appraise-assist is a plugin for your AI assistant (Claude, from Anthropic, today; ChatGPT, from OpenAI, where supported). It is a tool library: a set of scripted steps, rules, playbooks, checklists and small programs that your assistant calls, one at a time, on a guided path we call "the wheel." Ruby Appraisals runs no AI model of its own — the conversation, the judgment calls, and the narrative drafting happen in your own account with your own AI provider.

Our server, mcp.appraise-assist.com, runs each scripted step. To run a given step, it receives only the files and data that step needs, in one of three ways:

1. A file your AI assistant attaches. Your assistant passes our tool the file it needs for that call — for example, ChatGPT supplying a temporary download link we fetch for that step.
2. Your own Google Drive workfile folder, if you connect one. If you choose to connect a Drive folder and grant us access, we read the inputs a step needs and write that step's results back into that folder — and nothing else in your Drive.
3. A small local helper you install. It sends a step's files from a folder on your own computer and saves the results back there.

We process those files only for the duration of the call. Temporary working copies are deleted when the call ends — we do not keep your workfiles, reports, MLS data, photos, outputs, or your private library/wiki afterward. Your own folder, on your computer or in your connected Drive, is the only place they are kept.

The request itself — which tool or step was called, and the short parameters your assistant sent with it, such as a workfile name — does reach our server. Folder names often contain property addresses, so please do not put personal information in file or folder names. Our request logs are designed not to record file contents, but we cannot control what your assistant chooses to include in a request.

Whatever you type to, paste into, or let your assistant read as part of a conversation is also processed by your AI provider (Anthropic or OpenAI) under your own account and that provider's own terms and privacy policy, including the contents of files your assistant opens on your machine. We do not control, and cannot see, that processing.

Put together: our server runs the deterministic steps and keeps nothing once a call ends, your AI provider carries the conversation, and your own computer or connected Drive folder is where your files permanently live.

2. What reaches our servers, and what we keep

We built this so that our server sees only what a given step needs, only for as long as the call lasts. Here is the honest split.

2.1 What our servers handle during a call

To run a step, our server receives the files that step needs — from a file your assistant attaches, your connected Google Drive folder, or your local helper — processes them, and returns the result. Temporary working copies are deleted when the call ends. We do not keep your workfiles, reports, MLS data, photos, outputs, or your private library/wiki afterward; your own folder (your computer, or your connected Drive) is the only place they are kept.

2.2 What our servers hold between calls

• Account sign-in. You sign in with Google. We receive the email address Google verifies for you; Google's own tokens are discarded once that email is verified. We then issue appraise-assist's own sign-in token to your AI assistant and store only a hashed (not plain-text) copy of it.
• Drive access, if you connect a folder. If you connect a Google Drive workfile folder, we hold the Google-issued access needed to read and write files in that folder on your behalf, during your calls.
• Beta and waitlist list. If you join our early-access list or waitlist, we keep your email address so we can reach you about your account.
• Request and security logs. Like any web service, we log requests to our tool-library service: your IP address, the time of the request, which tool or step was requested together with any short parameters your assistant sent (such as a workfile name), and any errors. This is for keeping the service running and secure. Our request logs are designed not to record file contents, but we cannot control what your assistant includes in a request — so please do not put personal information in file or folder names.
• Subscription status. Whether your subscription is active, past due, or canceled, so the service knows whether to respond to your account.
• Payment status, not payment details. Payments are processed by Stripe on Stripe's own hosted pages. We never see your full card number. We only see what Stripe tells us: that a payment succeeded, failed, or was refunded.

2.3 What our servers never keep

• Your MLS exports, CSVs, or data feeds, beyond the call that processes them.
• Your orders, workfiles, photos, or notes, beyond the call that processes them.
• Your draft or finished appraisal reports, or any export file (such as a .tdcx file), beyond the call that produces or uses them.
• Any private library or "wiki" you build from your own past reports (see Section 7).
• The content of your conversation with your AI assistant.

None of the items in 2.3 are stored by us or kept by us once a call ends. They live and stay in your own folder — on your computer, or in the Drive folder you chose to connect.

3. What personal information appraisal files can contain

Appraisal work is personal-information-heavy by nature. A typical file can contain, among other things:

• Borrower, buyer, and seller names.
• Lender, loan officer, and loan or case numbers.
• Property owner and occupant names.
• Contact details: phone numbers, email addresses, mailing addresses.
• Sale prices, loan amounts, and other financial figures tied to named people.
• Photographs that may show people, vehicles, mail, or other identifying details.

Because this information is woven into the files appraisers normally work with, it cannot always be cleanly separated from the data needed to do the appraisal.

4. Our scripted best-effort steps, and their limits

Before content from your files is shared with your AI assistant, our scripts include steps that try to find and remove or mask common personal-information patterns — names, contact details, loan numbers, and similar fields — where we can identify them.

Please read this plainly: this is best-effort only, and it is not a guarantee.

• Our scripts may miss personal information that is formatted unusually, embedded in free text, hidden in an image, or simply not in a pattern our scripts recognize.
• Different MLS systems, county records, PDFs, and file formats are not all alike, and our scripts cannot promise to catch every one of them, now or as those formats change.
• We do not promise or guarantee complete removal of personal information, and we do not promise or guarantee complete privacy or full anonymization of any file, report, or conversation.
• Scripted masking reduces exposure; it does not eliminate it. Treat it as a safety net, not a substitute for your own judgment about what you put into any tool.

5. Your responsibilities

Because the judgment calls happen in your own AI-assistant account and the inputs are your own files, you are the one in the best position — and the one responsible — for protecting what goes into it. Specifically, you agree to:

• Decide what to share. You control what your assistant reads, what you paste into a conversation, and what any tool is allowed to touch.
• Not share what you are not permitted to share. If a client agreement, a lender's requirements, or a law restricts what you can disclose or where it can go, that restriction is yours to follow regardless of what any tool in appraise-assist does or does not strip out.
• Check outputs before sending them anywhere. Review any draft, narrative, export file, or other output before you deliver it, email it, or otherwise send it on, including checking that no personal information you did not intend to share has slipped through.
• Follow USPAP confidentiality and your own client agreements. appraise-assist does not know, and cannot enforce, the confidentiality terms of your specific engagements. That stays on you, the same as it would with pen and paper.
• Configure your AI provider's own data settings. If you want to opt out of your conversations being used to train your AI provider's models, or want other privacy controls, set those directly with your AI provider (Anthropic or OpenAI) — we do not control, and cannot change, those settings on your behalf.

6. Third-party data sources our scripted steps may reach

Some scripted steps, running on our server as part of handling your call, connect to outside data sources on your behalf, such as:

• MLS data in the CSV export you provide — no live MLS login is used.
• County assessor public-record websites, using property identifiers only.
• A construction-cost data service we license, using property characteristics only (size, quality, year built) — no personal names are sent.
• Mapping/geocoding services.

Each of those sources has its own terms and its own privacy practices, which apply to the data pulled from them. See Third-Party Services for more detail.

7. Your private library or "wiki"

If you build a personal library, notes collection, or "wiki" from your own past reports to help your assistant learn how you work, that library stays in your own folder — on your computer or in your connected Drive — like your other files. If a step needs it, we read it during that call only; we do not host it or keep a copy afterward. It is yours, for your own use, the same way a personal reference binder would be.

8. Security incidents

If we discover that our systems have been breached in a way that affects your account data (such as your email address, hashed sign-in token, or Drive access), we will notify affected users without undue delay once we understand what happened, and within any period required by law (Colorado's breach-notification law, C.R.S. 6-1-716, sets 30 days). Because we do not hold your appraisal files or reports once a call ends, a breach of our systems should not expose those files — but we will still tell you promptly about anything that affects the account information we do hold.

9. What this page is not

This page describes how the architecture works and what we do and do not handle. It is not a promise that personal information will always be caught, not a guarantee of anonymization or complete privacy, and not a substitute for your own professional judgment, your client agreements, or your obligations under USPAP or any applicable privacy law. For how long we keep account and log data, see our Privacy Policy, Section 10. See also our Professional Responsibility & Disclaimer.

If you email us a file to get help with a support question, we use it only to answer that question, treat it as confidential, and delete it once your question is resolved — please do not email us appraisal files unless we ask you to.

10. How to contact us