Privacy notice
1. Who we are
Capley is deal-document review software for commercial real estate. Capley is a product of Tretter Holding LLC, a Colorado limited liability company. In this notice, “Capley”, “we” and “us” mean Tretter Holding LLC.
This notice covers the website at capleycre.com and the Capley app.
Capley is pre-launch. The app isn’t open to the public yet. Where this notice describes how the app will handle data, it says “will”.
2. What we collect
On this website. When you send one of our four forms (early access, book a demo, request a trial, contact), we collect what you enter.
All four forms: your name, work email and company.
Early access, demo and trial: your role (investor, broker or other).
Early access and trial: the property types you work on, your typical deals per year, your team size, how you heard about Capley (optional), and whether you want product updates (optional).
Demo: anything you add in the optional message.
Contact: the topic you choose and your optional message.
We also record the time you sent the form and a keyed hash of your IP address. We keep the hash, never the IP address itself, and use it to limit how often a form can be sent from one place. Your cookie choice is kept in a cookie on your device (see section 6).
Please don’t send deal documents through the website forms.
The website runs no analytics and no advertising tags.
In the app, once it opens.
Account details: your name, email, sign-in sessions, workspace, role and usage.
Billing details: customer and subscription records and invoices, held by our payments provider.
Deal content: the documents you upload and the text we extract from them. Deal documents such as rent rolls and leases often name tenants and other people.
Analysis results: findings, extracted terms, short quotations from your documents, deal names, counterparties and file names.
Logs: app logs use hashed IDs in place of names.
3. Forms and booking processors
Forms. The forms run on our own code, hosted by our network provider. Requests are stored in our network provider’s database. We don’t use a third-party form service.
When a request is stored, we send one notification email to our team’s inbox, with your email as the reply-to address. The email contains what you entered in the form. That inbox is hosted by our email provider.
Requests that look automated are discarded. We don’t store them and we don’t email them.
The forms need JavaScript.
Booking. We don’t use a booking tool. The demo form collects your request, and someone on our team replies by email to find a time. Demos are on a video call, through our video-call provider. If we add a booking tool, we’ll update this section before it goes live.
4. How we use it
We use what you send through the website to reply to you; arrange a demo; review a trial request (we review each one by hand); contact you as we open early access; send product updates, only if you asked for them (see section 5); and protect the forms from abuse.
In the app, we will use your information to run the analyses you ask for, run your account and workspace, bill you, keep the service secure, and give support.
Your documents will never be used to train models, ours or anyone else’s.
We don’t build profiles of the individuals named in your documents.
We don’t sell your personal information, and we don’t use it for targeted advertising.
5. Marketing email: consent and opt-out
The early access and trial forms include an optional box: “Send me occasional product updates”. It is unticked unless you tick it. We send product updates only to people who tick it.
We don’t send product updates yet. When we do, every one will carry an unsubscribe link. You can also ask us to stop at any time by emailing [email protected] or through the contact form.
Replies to a request you sent, and messages about an account you hold, aren’t marketing email.
6. Cookies and analytics
The site sets no cookies until you choose. Analytics run only with your consent.
The banner. On your first visit, a banner offers Decline, Allow analytics and Settings. The site works the same either way.
Our necessary cookie. When you make a choice, the site stores it in a cookie named “capley_consent” on your device. It holds only “granted” or “denied”, is set by capleycre.com, and lasts 180 days. It is always on once you’ve chosen, because it remembers your choice.
Our network provider’s cookie. Our network provider may set one strictly necessary security cookie on capleycre.com.
Analytics. None. The site loads no analytics tool. If we ever add one, we’ll name it on this page before it’s turned on, and it will load only for visitors who chose Allow analytics.
Changing your mind. Use “Cookie settings” at the bottom of any page. If you withdraw consent, the site stops analytics and removes the analytics cookies it can reach.
7. Global Privacy Control
Global Privacy Control (GPC) is a browser setting that asks sites not to sell or share your personal information.
We honor it. If your browser sends a GPC signal, the site treats it as Decline, and analytics never load.
We don’t sell or share your personal information.
8. Subprocessors
These providers process data for us. We list them by role.
| Provider | Role | Deal data |
|---|---|---|
| Amazon Web Services | Hosting, document storage, encryption keys, AI processing (Claude on Amazon Bedrock) | Documents: stored and processed in the US, with zero data retention |
| Database provider (US) | Accounts, deal records, analysis results | Findings and extracted terms, including short quotations from documents; not original documents |
| Sign-in provider | User accounts | No |
| Payments provider | Billing | No |
| Network provider | Website delivery and encryption in transit; hosts this website and stores website form requests | In transit only; not stored |
| Email provider | Notifications, and the team inbox that receives form requests | No deal content |
| Video-call provider | Demo calls | No |
| Analytics provider (None) | Site analytics, only with consent | No |
We’ll share the full list of named providers on request and in our data processing agreement, and we’ll give notice before adding one. Before a new subprocessor touches customer documents, we’ll give 30 days’ notice.
9. Data location
App data. Documents will be stored and analyzed on AWS in US regions. Analysis results will be stored with our database provider in the US. Documents and analysis will stay in the United States. Website and app traffic passes through our network provider’s global edge but isn’t stored there.
Analysis will run on Claude through Amazon Bedrock, inside the United States, with zero data retention. The model provider will not keep your documents or the analysis.
Our sign-in, email and payments providers receive account details only, not your documents. Account data is held in the United States, except where our subprocessor list says otherwise.
Website form requests. These are stored in our network provider’s database, in the United States.
10. Retention and deletion
Documents. Documents will be deleted 90 days after a deal is closed or killed, or sooner if you delete them. If an open deal has no activity for 180 days, we’ll remind your workspace admin, and then the 90-day clock starts. Every deletion produces a receipt.
Your workspace admin will be able to set a shorter period than 90 days. If you delete something yourself, it is deleted right away, with a receipt.
Analysis results. The 90-day clock covers documents and the files made from them. Findings, reports, marks and notes stay until you delete the deal or the workspace.
Logs. App logs are kept for 30 days.
Account details. Kept for 90 days after an account closes, then deleted.
Billing records. Kept for 7 years, for tax.
Backups. Deleted data leaves our backups within 30 days.
Website form requests. Kept for 24 months, then deleted. You can ask us to delete yours at any time.
Form rate-limit counters. Deleted after one day.
Cookie choice. The “capley_consent” cookie lasts 180 days.
11. Your rights, including US state rights
You can ask us to tell you what personal information we hold about you; give you a copy of it; correct it; delete it; or stop sending you product updates.
We honor these requests for everyone, not only where a state law requires it. Email [email protected] or use the contact form. We reply within 30 days. We check your identity by email before we act on a request. An authorized agent can make a request for you. If we refuse a request, you can appeal by replying to our answer.
We don’t sell or share your personal information and we don’t use it for targeted advertising, so there is nothing to opt out of today.
Documents your company uploads. If your company uploads documents that name you, such as a lease or rent roll, we will process them as that company’s service provider. If you send us a request about those documents, we’ll pass it to that company.
12. Security
This website. The site tells browsers to connect only over HTTPS. The site loads scripts only from capleycre.com. It runs no third-party scripts. Your IP address is stored only as a keyed hash. Each form accepts at most 5 requests per 10 minutes from one place, and form posts from other websites are refused.
The app, once it opens. Documents will be encrypted at rest with a key dedicated to Capley. Analysis will run on Claude through Amazon Bedrock, with zero data retention. During early access, our team will have no access to your documents. After early access, a document will be opened only to fix a support or security issue, only with your workspace admin’s approval, and every access will be logged.
No system is perfectly secure. If we confirm a breach of a customer’s data, we’ll tell the affected customers without undue delay, and within 72 hours of confirming it.
13. Changes
We’ll update this notice when our practices change, and change the “Last updated” date at the top. Before a material change, we’ll email account holders 30 days ahead.
14. Contact
For privacy requests and questions, email [email protected]. You can also use the contact form at capleycre.com/contact and choose “Something else”.