CactusBetaSign in

Privacy Policy

Effective Date: April 17, 2026

1. Introduction

Cactus Real Estate Software Inc. (“Cactus,” “we,” “us,” or “our”) operates an AI-assisted commercial real estate underwriting platform (the “Services”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to visitors to our websites and to users of our applications.

If you are using the Services as part of an organization (for example, your employer or client), that organization is the “Customer” responsible for your use of the Services, and its administrator may have access to your account activity and content you create through the Services.

2. Information We Collect

2.1 Information you provide

  • Account information: name, email address, password (hashed), and profile image.
  • Onboarding information: professional role, asset classes you work with, typical deal volume, and other preferences you tell us during setup.
  • Organization information: organization name, members, roles, and invitations.
  • Billing information: your billing contact, plan, and a payment token from our payment processor. We do not store full card numbers on our servers.
  • Content you submit: chat messages, prompts, uploaded documents (such as offering memoranda, rent rolls, and operating statements), deal information, spreadsheets, and other materials you submit to the Services (“Customer Content”).
  • Communications: support requests, survey responses, and feedback you send us.

2.2 Information collected automatically

  • Usage data: pages viewed, features used, events (e.g., deal created, analysis run), approximate geolocation inferred from IP address, device type, browser, and operating system.
  • Log data: IP address, access times, referring URLs, and error traces.
  • Cookies and similar technologies: authenticated session cookies and identifiers used by our analytics and error monitoring vendors. See Section 8 for details.

2.3 Information from third parties

  • Single sign-on: if you sign in with Google, we receive your name, email, and profile image from Google.
  • Property and location data: we may retrieve property information, map imagery, and points of interest from third-party data providers when you enter an address.

3. How We Use Your Information

  • Provide, maintain, and improve the Services, including running AI analyses you request.
  • Authenticate you, keep your account secure, and detect and prevent fraud or abuse.
  • Bill you, process payments, and manage your subscription and credits.
  • Communicate with you about your account, service updates, and support.
  • Send product news and marketing (you may opt out at any time using the unsubscribe link in those emails).
  • Analyze usage to understand how the Services are used and to improve them.
  • Comply with legal obligations and enforce our agreements.

4. AI Processing and Customer Content

The Services use third-party large language models and document extraction services to analyze Customer Content. When you use an AI feature, the relevant prompts, document contents, and metadata are transmitted to one or more AI sub-processors (such as Google, Anthropic, or xAI) through our AI gateway.

No model training on Customer Content. We do not use Customer Content to train generally available foundation models, and our AI sub-processor contracts prohibit them from doing so as well. Customer Content is processed solely to produce the output you request and to operate the Services.

AI outputs may be inaccurate, incomplete, or inconsistent. See our Disclaimer for more detail.

5. How We Share Information

5.1 Sub-processors

We share information with vendors that help us operate the Services, including infrastructure, storage, AI, document parsing, analytics, error monitoring, email delivery, and payments. See our Sub-processor List for the current list.

5.2 Within your organization

If you access the Services through an organization, your organization’s administrators and, depending on role and permissions, other members may see your account information and the content you create within that organization’s workspace.

5.3 Legal and safety

We may disclose information if we believe in good faith that disclosure is necessary to comply with a law, regulation, or valid legal process, to protect the rights, property, or safety of Cactus, our users, or others, or to investigate fraud or abuse.

5.4 Business transfers

If Cactus is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to customary confidentiality protections.

5.5 With your consent

We share information for any other purpose disclosed to you at the time you provide it or with your consent.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Data Retention

We retain account, billing, and Customer Content for as long as your account is active and as needed to provide the Services. When an account is deleted, we delete or de-identify Customer Content within ninety (90) days, except for records we are required to retain for legal, accounting, or security reasons (for example, invoices and audit logs).

Prompts and document content sent to AI sub-processors for a given analysis are subject to those sub-processors’ retention practices, which are bounded by contract (typically zero to thirty days for abuse-monitoring purposes, after which the data is deleted).

7. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS) and at rest, role-based access controls, least-privilege access for employees, logging and monitoring, and regular review of our vendors. No system is perfectly secure, and we cannot guarantee the security of information transmitted to or stored by the Services.

8. Cookies and Tracking

We use the following categories of cookies and similar technologies:

  • Strictly necessary: authentication session cookies (via better-auth) and security cookies. These cannot be disabled without breaking the Services.
  • Analytics: identifiers used by PostHog to measure product usage and by Sentry to diagnose errors. These help us understand how the Services are used and fix problems.
  • Preferences: local storage entries we use to remember UI preferences such as your last sign-in method.

Most browsers let you refuse or delete cookies through their settings. Blocking strictly-necessary cookies will prevent you from signing in.

9. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of personal information we hold about you, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email support@trycactus.com.

California, Colorado, Virginia, and other U.S. states: if you are a resident of a state with a comprehensive privacy law, you may have the right to (i) know what personal information we collect and how it is used, (ii) request deletion or correction of personal information, (iii) receive a copy of your personal information in a portable format, and (iv) opt out of “sales” or “sharing” of personal information and of targeted advertising. As noted above, we do not sell or share personal information for targeted advertising. We will not discriminate against you for exercising your rights.

If you are a resident of the European Economic Area, the United Kingdom, or Switzerland and you access the Services, you may also have the right to lodge a complaint with your local data protection authority.

Authorized agents: you may designate an authorized agent to make a request on your behalf. We may ask the agent to demonstrate authority and ask you to verify your identity before we honor the request.

10. International Data Transfers

Cactus is based in the United States and our primary infrastructure is hosted in the United States. If you use the Services from outside the United States, your information will be transferred to and processed there. By using the Services you consent to that transfer.

11. Children’s Privacy

The Services are not directed to, and we do not knowingly collect information from, individuals under 18 years of age.

12. Data Processing Agreement

Customers who are subject to applicable data protection laws may request a Data Processing Agreement (DPA) by emailing support@trycactus.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Services and update the Effective Date above. Your continued use of the Services after the changes take effect constitutes acceptance of the updated policy.

14. Contact Us

Questions or requests regarding this Privacy Policy can be sent to support@trycactus.com or by mail to:

Cactus Real Estate Software Inc.
Attn: Privacy
8 The Green, Dover, DE 19901