Privacy

• Your account — email and password. The password is stored only as a hash; we cannot read it.
• Your profile and qualifications — budget, move-in date, hard requirements, and whether you have a given qualification: SSN or not, visa type, pay stubs or not. We do not store numbers and we do not store your actual income — there is no field on the form to type them into.
• What you've done — saved places, progress markers, conversations, commute points. This is the part that is still there when you sign in on another device.
• Activity log — counts and records of things like how many emails went out and how many calls the AI made. What you can see under "My activity" is all of it.
• Contacts you give us — your old landlord's email or phone, the names of the providers you want cancelled, and the phone number you let us transfer a call to. Used only to write and send the letters and calls you approve; deleted with "Delete my data".
• Before you sign up — from the moment you open the map, we record what you do on the page (messages you type, listings you open, circles you draw, the sign-in prompt appearing, which onboarding step you reach), together with your IP address, browser user-agent, device type and the page you were on. Each visitor gets a random ID that lives only in that browser; clearing site data discards it. If you later create an account, that earlier activity is attached to it. Two things are never recorded: anything typed into a password field, and the application dossier used by fill-along (it never leaves your browser). Under California law your IP address and device information are personal information; the rights below apply to them too.

• We don't sell or trade your data. Listings come from public posts — Craigslist, Zillow and Chinese-language community boards; all we do is organise, annotate and cite them. We don't resell them.
• No paid ranking. Banks, carriers and landlords cannot buy a position. Ranking follows your profile and verifiable facts, and you can open up the reason for any ranking.
• No cut on anything regulated. You sign a lease or open a card, we don't take a cent more. A partner you chose may pay us a referral fee (planned; none today) — you never pay more, and it never changes the ranking.

• Emails sent on your behalf go out through your own Gmail, and only after you explicitly authorise it. When you revoke, we actually revoke the token with Google rather than just clearing our own copy — and if Google refuses, we tell you so.
• Every AI phone call has a confirmation step before it dials, showing who is being called and what will be said. The agent identifies itself as an AI on the call.
• Connecting an AI assistant (ChatGPT, Claude, Muse or any other MCP client): once you sign in and approve it, that assistant can read what our tools return for your account — where your move stands, your tasks and their drafts, and your qualifications compared line by line against a listing — and can answer a field, put a task off or prepare a draft. It cannot send, call, submit or pay: those buttons stay yours in Put Roots. We receive only what the assistant passes to a tool, not your conversation with it. Each call is logged with the assistant's name, the tool and the time; you can see the connection and cut it off on your permissions page. Without signing in, an assistant only gets the public sample listings and the no-SSN options, and we log the tool name and the caller's browser identifier.
• Every authorisation, use and revocation is logged, and you can read that log at any time.

Delete my data — the button is right here: profile, saved places, commute points, projects, activity log, any corrections you filed, and what you did before signing up all go, and your Gmail authorisation is revoked with them. The deletion itself leaves one record with a timestamp and no content — otherwise there would be no way to answer "was it deleted?"

Delete my data

Sign in and the delete button appears here.

Delete my account — everything above, plus the account itself: your email and sign-in are removed, and any Put Roots subscription stops renewing. Nothing is kept.

Delete my account

Payments run through Stripe. Card numbers never reach us and we don't store them. Your statement will show deciqAI — Put Roots is a product of Deciqai Inc. That name is us, not a fraudulent charge.

Auto-renewal, one-click cancellation and the refund policy are on the pricing page.

We honour all of these whether or not you are a California resident:

• Application dossier (fill-along) — legal name, birth date, address, employer and income live in your own browser only and are never uploaded to our server; clearing site data clears it. SSN and ID numbers are never stored. The only things we send it from your profile are email, visa type, move-in date and pets. It is plain browser storage: installed extensions and other users of the same computer can read it — clear it after applying on a shared machine. One exception: if you ask the agent to fill an application for you (the "Agent fills the application" button), your dossier is sent to our server to run that one fill — held only in memory for that session and never written to our database; our server does the typing, so the values are not sent to the AI model; the step screenshots have input values masked and are deleted when the session expires; SSN and ID numbers are never sent even then.
• Know and access — "What we store" above is the complete list. Write to us for an export.
• Correct — every field in your profile is yours to edit.
• Delete — My profile → Delete my data, right now, without waiting for us to reply.
• Export — write to us and we'll hand you your profile, saved places, progress and conversations as a file.
• Limit the use of sensitive information — immigration status, visa type and financial qualifications are sensitive. We use them only to work out whether you meet a given requirement, and nothing else. You can also leave them blank: the product still works, the matching is just coarser.
• No sale, no sharing — we have never sold your information or shared it for cross-context behavioural advertising. See Do Not Sell or Share, the link California requires us to keep in the footer.

To exercise any of them, write to admin@deciqai.com from the email address on your account — that is the intake for data requests. We will not give you worse service or a worse price for exercising them.

They process data on our instructions to run the product. We are not selling your data to them.

• Amazon Web Services — servers, database, and the model behind the conversation (Bedrock). Your account data and conversations live here.
• Google — sign-in with Google; sending mail through your own Gmail once you authorise it; maps and commute times (the commute addresses you enter are sent there to compute routes).
• Retell — AI phone calls. It dials only after you confirm that specific call, and the person on the other end is told they are speaking with an AI.
• Stripe — payments. Card numbers never reach us.
• Querit — web search. Your question becomes a short English search query; your account details are not sent with it.

If this list changes, we change this page.

• Emails carry a fixed footer: that they were sent by Put Roots on behalf of a prospective tenant, how to opt out, and our postal address (CAN-SPAM).
• Calls follow the TCPA. Calls we make for you are recorded and transcribed, and shown only to you; the other side is told at the start of the call that it is being recorded (California requires both parties to consent).
• When we walk a website for you (cancelling a service, changing an address, ordering broadband), it runs in a temporary browser of ours: the login lasts for that one task only and is destroyed when it ends, each step's screenshot is shown only to you. If you take over that browser from our page to log in or pass a captcha, what you type is forwarded straight into it and never stored or logged; the step screenshots kept on the task show the page as it looked, so a password field shows dots but a username typed in plain view is in the picture. We stop before any login, captcha, payment, signature or submit button — those are yours.