Privacy Policy

Datum Investment Solutions, LLC runs this site. This policy says what we collect, why, who else sees it, how long we keep it and what you can ask us to do about it.

We do not sell personal information, we do not share it for advertising, and there is no advertising or analytics on this site.

What we collect

When you make an account. Your name and email address. A password, which is never stored — what is stored is a one-way hash from which the password cannot be recovered. If you sign in with Google, we receive the identifier Google gives us for your account, along with your name and email address; we never receive your Google password.

If you join the community. A mobile number, so that a name on a post belongs to somebody, and the display name you choose. The number is used to send the one verification code and nothing else. It is not shown to other members and it is not used for marketing. The code itself is never stored — only a hash of it, salted with your account, and it expires.

As you use the site. The properties you put in a cart or on a shortlist, the financing assumptions you set on a model, and any contract or enquiry you start. This is the substance of the service rather than a side effect of it.

Automatically, on every request. Your internet address, your browser's user-agent string, the page you asked for and the time. This is how a sign-in can later be checked against "was that really them", and how a run of failed sign-ins is visible as an attack rather than as a number.

If you write to us. Whatever you put in the message.

Why we are allowed to

We process this to provide a service you asked for, to keep accounts secure, to meet our own legal and record-keeping obligations, and — for the security logging above — because we have a legitimate interest in the site not being broken into. Where the law where you live requires consent for something, we ask for it; the mobile number for the community is the one place that arises, and it is asked for at the moment it is needed.

Who else sees it

We use a small number of other companies to do specific jobs. Each gets only what that job needs:

• An email provider, to send password resets, invitations and notices.
• A text-message provider, to send the community verification code.
• Discourse, which runs the community forum, if you join it. It is told your display name, your email address and an identifier for your account, so that signing in here signs you in there.
• Google, only if you choose Google sign-in.
• The company that hosts our servers.

Beyond those: nobody, unless we are legally required to, or unless it is part of a transaction you are deliberately in — a contract you signed, shared with the agent handling it.

How long we keep it

• Your account — while it exists, and for as long afterwards as we are required to keep records of any transaction it was part of.
• Security and access records — 90 days, then deleted automatically.
• Sign-in sessions — 12 hours, then expired and removed.
• A verification code — ten minutes, as a hash, then useless.

What we do to keep it safe

Passwords are hashed with scrypt. Stored secrets — such as the credentials for the mail relay — are sealed with AES-256-GCM. Traffic to this site is encrypted in transit. Inside the database, every table that holds personal data is protected by row-level security, so what a given account can read is decided by the database itself rather than by the code asking it — which means a mistake in a screen cannot turn into somebody seeing another person's records.

No system is beyond being broken into, and we do not claim otherwise.

What you can ask for

You can ask us to show you what we hold about you, to correct it, to delete it, to stop a particular use of it, or to send you a copy. You can withdraw consent where you gave it — replying STOP to a text message is enough for that one — and you can complain to your data protection authority if you are somewhere that has one.

We will not treat you differently for asking. Write to us, and we will answer.

Children

This site is for adults buying investment property. It is not directed at anyone under 18, and we do not knowingly collect anything from a child. If you believe we have, tell us and we will delete it.

Changes

If this policy changes in a way that matters, we will say so on this page and move the date at the foot of it. Carrying on using the site after that is how you accept the change.

Asking us about this

• Email: no-reply@datum-is.com
• Telephone: 888-842-4000
• Post: Datum Investment Solutions, LLC, 30211 Avenida de las Banderas, Suite 200, Rancho Santa Margarita, cA 92688