Last Updated: May 2026
1. Introduction
Acreon ("we," "our," or "us") operates the Acreon platform, an AI-powered location intelligence service for commercial real estate research. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Name (if provided)
- Authentication credentials
2.2 User Content
When you use our service, we collect:
- Projects you create
- Points of Interest (POIs) you add to your maps
- AI chat conversations and research queries
- Uploaded files and file metadata
- Parsed or extracted file content
- AI-generated file descriptions
- Word documents, including imported .docx files and editor snapshots
- Discussion/forum topics and replies tied to their authors
- AI agent preference memory, including preferences you approve for future assistant behavior
- Excel template data, including templates, configuration, bindings, manifests, attachments, run inputs, run outputs, validation reports, and generated artifacts
- Sale research artifacts, including official property record snapshots, web-search source results, confidence assessments, and generated or user-edited comp notes
- Map interactions and preferences
2.3 Usage Data
We automatically collect:
- Browser type and version
- Device information
- IP address
- Pages visited and features used
- Time and date of access
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process your research queries and generate insights
- Use product data to parse, preview, describe, analyze, and transform uploaded files and templates
- Use product data to provide AI chat, file Q&A, template execution, and generated reports
- Personalize assistant behavior using AI agent preference memory you approve or manage in settings
- Use product data to debug, monitor, secure, and improve AI workflows, including tool execution and model-response quality
- Store and sync your projects across devices
- Respond to your inquiries and provide support
- Send service-related communications
- Comply with legal obligations
3.1 Lawful Bases for Processing
For users in the EEA or UK, we rely on the following lawful bases under GDPR Article 6 for the processing activities described in this Privacy Policy:
| Processing activity | Lawful basis |
|---|---|
| Account creation, authentication, service access, support, and service-related communications | Contract performance (GDPR Art. 6(1)(b)) |
| Projects, maps, AI chat, file Q&A, template execution, generated reports, uploaded files, extracted content, and generated artifacts | Contract performance (GDPR Art. 6(1)(b)) |
| Debugging, monitoring, security, abuse prevention, service reliability, and AI workflow quality | Legitimate interests (GDPR Art. 6(1)(f)) |
| Aggregated or anonymized insights where personal data is processed before anonymization | Legitimate interests (GDPR Art. 6(1)(f)) |
| Optional features, AI agent preference memory you approve, or non-essential cookies that ask for consent | Consent (GDPR Art. 6(1)(a)) |
| Legal, tax, accounting, security, and compliance obligations | Legal obligation (GDPR Art. 6(1)(c)) |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to legitimate-interest processing where applicable.
3.2 Aggregated and Anonymized Data
We may use aggregated, anonymized data derived from your use of the Service to generate insights, publish reports, and improve our products. This data cannot be used to identify you personally. Your individual projects, POIs, and research remain private and will not be sold. We share feature data with processors and service providers only as described in this Privacy Policy.
Examples of aggregated data usage include:
- Publishing industry reports (e.g., "40% of queries focus on Brooklyn")
- Identifying popular research trends
- Improving AI response quality based on usage patterns
4. Third-Party Services
We use the following third-party services to operate Acreon. Some services are used only when a related feature is enabled or when you choose to use that feature. Each service has its own privacy policy:
- Supabase processes account data, projects, POIs, chat/session records, uploaded files, file metadata, extracted content, template data, generated artifacts, and operational database records
- OpenAImay process prompts, conversation messages, uploaded or extracted content, file Q&A context, tool context, and model responses
- Google AI may process uploaded files, file metadata, extracted content, and generated file descriptions
- Mapbox - Maps, geocoding, address search, and place search
- Google Maps - Street View imagery and related map links when you use those features
- Stripe - Billing, payment, invoice, and subscription management
- Sentry - Error monitoring and performance tracking
- Vercel - Hosting and deployment
- Langfuse - When configured, Langfuse may receive AI workflow metadata for debugging, including conversation, message-run, session, map, user, mode, deployment, and cohort identifiers, plus timing, error, and trace metadata. Langfuse is configured not to receive full prompts, tool payloads, or final response bodies from the unified agent
- E2B may process uploaded files, extracted content, templates, run inputs, tool inputs, execution outputs, generated artifacts, and sandbox logs
- Upstash Redis - Rate limiting and concurrency controls
- Neon - Hosted PostgreSQL reference data used for public property and source-data queries
- Tavily - Web search for sale research when enabled
Your data may be processed by these services in accordance with their respective privacy policies. Relevant feature data may include user content, uploaded files, extracted text, prompts, responses, tool inputs, tool outputs, and operational metadata, including discussion/forum topics and replies tied to their authors.
5. Data Retention
- Active accounts: Data is retained while your account remains active
- Deleted accounts: Acreon deletes product database records and supported account-owned storage objects during account deletion; backup, security, legal, billing, and processor logs may be retained only as needed for those purposes
- Files, templates, and generated artifacts: Uploaded files, parsed or extracted content, Excel templates and configurations, and generated files are retained while needed to provide the relevant product feature or while related projects, sessions, or files remain in your account
- AI traces: AI conversation and tool traces are retained for product operation, debugging, security, quality monitoring, and compliance purposes, subject to configured telemetry-provider retention controls
- Chat-scoped records: Chat-scoped files and traces are deleted when the product deletes the related chat sessions, subject to backup, security, and legal retention needs
- Anonymized data: May be retained indefinitely for analytics and research purposes
6. Your Rights
Depending on your location, you may have the following rights under GDPR, CCPA, or other privacy laws:
6.1 Access
You can request a copy of the personal data we hold about you, including your projects and POIs, by contacting support@acreon.ai.
6.2 Deletion
You can request deletion of your account and associated data. This will permanently remove your projects and personal information.
6.3 Rectification
You can ask us to correct inaccurate or incomplete personal data associated with your account.
6.4 Restriction
Where applicable, you can ask us to restrict processing of your personal data while we review a request or objection.
6.5 Objection
Where applicable, you can object to certain processing based on legitimate interests or other grounds provided by law.
You can turn off preference memory and delete saved assistant preferences in Memory settings.
6.6 Data Portability / Export
Some product views let you download map images, CSV data, generated files, or reports. To request a complete export of your personal data, contact support@acreon.ai.
6.7 Opt-Out
Acreon does not currently send marketing communications or use non-essential analytics cookies. You can decline non-essential cookies in the cookie banner and control cookies through your browser settings. To exercise other opt-out rights, contact support@acreon.ai.
6.8 EEA/UK Complaints
EEA/UK users may lodge a complaint with their local data protection supervisory authority if they believe our processing of personal data violates applicable law.
6.9 CCPA Rights (California Residents)
California residents have additional rights including:
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of the sale of personal information
- Right to non-discrimination for exercising privacy rights
We do not sell personal information. We may share personal information with processors and service providers as described above, and we may use aggregated, anonymized data that cannot identify individual users.
7. Data Security
We implement industry-standard security measures to protect your data, including:
- Encryption in transit (TLS/HTTPS)
- Encryption at rest for stored data
- Row-level security in our database
- Regular security audits and monitoring
While we strive to protect your data, no method of transmission or storage is 100% secure. You use our service at your own risk.
8. Cookies
We use cookies and similar technologies for:
- Essential cookies: Required for authentication and core functionality
No tracking or analytics cookies are used.
You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features.
9. Children's Privacy
Acreon is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.
10. International Data Transfers
Your data may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place for such transfers in compliance with applicable laws.
For EEA and UK users, those safeguards may include adequacy decisions or regulations where available, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, processor data protection terms, transfer risk assessments, and technical and organizational measures such as encryption in transit and at rest.
You may request more information about the transfer mechanism that applies to your personal data by contacting support@acreon.ai.
EEA/UK users can contact us at support@acreon.ai. Acreon is based in the United States. If Acreon appoints or is required to designate an EEA or UK representative in the future, we will update this Privacy Policy with representative contact details.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of Acreon after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
Email: support@acreon.ai
This Privacy Policy is provided for informational purposes. We recommend consulting with a legal professional for compliance with specific regulations in your jurisdiction.