Privacy Policy

Last Updated: October 20, 2026

What changed on October 20, 2026: We added the "arrival note" in Section 7.2. When you arrive, we note which of our public pages you landed on and what kind of site sent you (for example, a search engine). The note stays in your browser tab, holds nothing about you, and goes with a free check or a purchase only so we can count which pages help homeowners.

---

Table of Contents

1. Introduction
2. Definitions
3. Information We Collect
4. How We Use Your Information
5. How We Share Your Information
6. What We Do Not Do
7. Cookies & Tracking Technologies
8. Data Retention
9. Your California Privacy Rights (CCPA/CPRA)
10. Data Security
11. Children's Privacy
12. International Users
13. Changes to This Privacy Policy
14. Contact Us

---

1. Introduction

Welcome to Overassessed (operated by Spaghetti Labs, LLC, a California limited liability company). This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit our website at overassessed.co (the "Website") and use our services (collectively, the "Service").

Throughout this Privacy Policy, "Overassessed," "we," "us," and "our" refer to Spaghetti Labs, LLC and the Overassessed service. "You" and "your" refer to the individual accessing or using the Service.

We believe in being transparent about how we handle your information. This policy is written in plain language so you can understand exactly what data we collect, why we collect it, and what we do with it. If anything is unclear, please contact us at hello@overassessed.co.

---

2. Definitions

• "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under the California Consumer Privacy Act (CCPA).
• "Property Data" means assessed values, property characteristics, comparable sales information, and related real estate data derived from public records and third-party data providers. Under the CCPA, publicly available information from government records — including public real estate and property records — is generally excluded from the definition of Personal Information.
• "Generated Content" means any analysis, reports, narratives, comparable sales evidence, market value estimates, filing guides, PDF documents, or other materials produced by the Service for a user.
• "Service" means the Overassessed website, tools, features, and all related functionality.

---

3. Information We Collect

3.1. Information You Provide Directly

Property Address

• What: The street address you enter to look up a property.
• Why: To query property data from our data providers and generate your analysis.
• Retention: The property records we retrieve for an address are cached for up to 90 days, so a repeat check doesn't buy the same data again. Each free check's result — the address you entered, the property record, and the estimate we showed you — is kept for up to one year from your last change to it, so you can come back to your result and buy without re-running the check, and so we can see how the free check is used. A free check isn't linked to your email address unless you save the result or make a purchase.

Email Address

• What: Your email address, provided when you join the county waitlist, save a property analysis result for later, make a purchase, or request delivery of a filing guide.
• Why: To send you:
• Transactional emails (purchase confirmations, filing guide delivery, a reminder the week before a filing deadline you haven't marked filed, a reminder when next year's check opens, and account-related notices). Every reminder has an unsubscribe link.
• Waitlist notifications when your county becomes supported by the Service
• Property analysis follow-up emails — including a copy of your saved result, a short explanation of how California property tax appeals work, and your county's deadline reminder — sent only if you affirmatively submitted your email through the "save your result" form. The full sequence is three emails over approximately two weeks. You may unsubscribe from these emails at any time via the unsubscribe link in every email.
• Retention: It depends on why you gave it to us — see the table in Section 8. Unsubscribing stops our emails right away, but it doesn't delete the record behind them; to have that deleted, ask us (see Section 9.2). Purchase-related email records are retained for 7 years for legal and tax record-keeping purposes. If you unsubscribe, we keep your email address on a do-not-email list so your opt-out keeps working.

Payment Information

• What: Credit card number, billing address, and other payment method details.
• How it's handled: Payment information is collected and processed entirely by Stripe, Inc., our payment processor. We do not receive, process, or store your credit card number or full payment method details. We receive only transaction confirmation data from Stripe, including the amount charged, date, product purchased, and a transaction identifier.
• Retention: Transaction confirmation data is retained for 7 years for legal and tax record-keeping requirements.

Feedback You Choose to Give

• What: Your answers to optional questions on your purchase pages and in follow-up emails — for example, a star rating, that you filed, how the county decided your appeal, or which AI assistant (if any) helped you.
• Why: To improve the Service, send the follow-ups you'd expect after filing, and understand how homeowners find and use us.
• Retention: Kept for up to one year, and removed with your purchase if you ask us to delete your data.

3.2. Information We Collect Automatically

When you visit the Website, we automatically collect certain information about your device and how you interact with the Service:

IP Address

• What: Your Internet Protocol address.
• Why: Used for rate limiting (preventing abuse of the free property lookup), approximate geolocation (to confirm you are accessing the Service from a supported area), and security monitoring.
• Retention: Retained in server logs for up to 90 days.

Device and Browser Information

• What: Browser type and version, operating system, device type, screen resolution, and language preferences.
• Why: To ensure the Website displays and functions correctly across different devices, and for aggregated analytics.

Usage Data

• What: Pages visited, features used, time spent on pages, click patterns, and navigation paths within the Service.
• Why: To understand how users interact with the Service, identify issues, and improve the product experience.

Cookies and Similar Technologies

• See Section 7 for detailed information about cookies and tracking technologies.

3.3. Information from Third-Party Sources

Property Data from Data Providers

• When you enter a property address, we query our licensed property data providers to retrieve property records, assessed values, property characteristics, and comparable sales data.
• This data is derived from public records — county assessor records, recorded deeds, and other government data sources.
• We query this data on your behalf in response to your specific request. We do not purchase bulk consumer data or maintain a database of personal profiles.

Address Verification from Google

• When you type an address, we use Google Places API to provide address autocomplete suggestions and verify the address and county.

3.4. AI-Generated Content

When you purchase a Data Package or Filing Guide:

• Your property data (address, assessed value, property characteristics, and comparable sales data) is sent to our AI model provider to generate the AI-powered analysis, market value estimate, and narrative content.
• Per our AI provider's API terms, data sent via the API is not used to train their AI models.
• The Generated Content (your analysis, narrative, and filing guide) is stored so you can re-access and re-download your purchase (see Section 8 for retention periods).

---

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1. Providing the Service — to perform property lookups, generate analysis and filing guides, and deliver purchased products.

4.2. Processing Payments — to facilitate transactions through Stripe and maintain purchase records.

4.3. Delivering Products — to send you your Data Package, Filing Guide, and PDF evidence package via the Website and email.

4.4. Transactional Communications — to send purchase confirmations, delivery notifications, and other communications directly related to your use of the Service.

4.5. Waitlist Management — to notify you when your county becomes supported by the Service.

4.5a. Saved-Result Follow-Up Communications — if you submit your email through the "save your result" form on the results page, we use your email to send a copy of your result, a short explanation of how California property tax appeals work, and your county's deadline reminder. These are commercial communications. You may unsubscribe at any time via the unsubscribe link in every email. We do not send these communications to individuals who have not affirmatively provided their email for this purpose.

4.6. Service Improvement — to analyze usage patterns, identify bugs or issues, and improve the Service's features and user experience.

4.7. Security and Fraud Prevention — to implement rate limiting, detect abuse, protect against fraudulent transactions, and maintain the security of the Service.

4.8. Legal Compliance — to comply with applicable laws, regulations, and legal obligations, including tax record-keeping requirements.

4.9. Marketing and Advertising — to run digital marketing campaigns and measure their effectiveness. We may use aggregated, non-personally-identifiable data to understand the effectiveness of marketing efforts. See Section 7 for details on marketing cookies and how to opt out.

---

5. How We Share Your Information

We disclose Personal Information to service providers and contractors who process information on our behalf for business purposes, pursuant to written agreements that restrict their use of the data. These disclosures are not "sales" or "sharing" as defined under the CCPA/CPRA.

We share your information only with the third-party service providers necessary to operate the Service. We are transparent about each one:

5.1. Stripe (Payment Processing)

• What we share: Stripe collects your payment method details directly. We share your email address, the address of the property your purchase is for, and transaction details (the product, price, and any discount) with Stripe to process payments and keep a record of each purchase. If your browser tab has an arrival note (Section 7.2), the page you arrived on and the kind of site that sent you go with the purchase details too.
• Why: To securely process your purchases.
• Their policies: Subject to Stripe's Privacy Policy and Stripe's Terms of Service. Stripe is PCI-DSS compliant.

5.2. Property Data Providers

• What we share: The property address you enter.
• Why: To retrieve property records, assessed values, property characteristics, and comparable sales data from public records.
• Note: Our providers process public record data — county assessor records, recorded deeds, and other government data sources. The property address you enter is used solely to query the relevant property records.

5.3. AI Model Provider (AI Analysis)

• What we share: Property data, including address, assessed value, property characteristics, and comparable sales data.
• Why: To generate the AI-powered comparable sales analysis, market value estimate, and narrative content included in Data Packages and Filing Guides.
• Data handling: Per our provider's API terms, data sent via the API is not used to train their AI models.

5.4. Google (Address Autocomplete and Maps)

• What we share: Address input text (for autocomplete) and property/comparable sale coordinates (for map imagery).
• Why: To provide address autocomplete and generate map images included in the PDF evidence package.
• Their policies: Subject to Google's Privacy Policy.

5.5. Email Delivery Provider

• What we share: Your email address and transactional email content.
• Why: To deliver purchase confirmations, filing guides, and waitlist notifications.

5.6. Vercel (Hosting)

• What they collect: Server logs containing IP addresses, request data, and standard web server information.
• Why: The Service is hosted on Vercel's infrastructure. Server logs are maintained per Vercel's data retention policies.

5.7. Analytics Providers

• What they collect: Usage data, device information, and cookies as described in Section 7.
• Why: To understand how users interact with the Service and improve the product.
• Current providers:
• Vercel Analytics — privacy-focused analytics that collects aggregated, anonymous usage data including page views, referrers, and device/browser types. Subject to Vercel's Privacy Policy.
• Google Analytics — web analytics service provided by Google LLC. We use Google Analytics with Consent Mode v2, which means: (a) when you have not granted cookie consent, Google Analytics collects anonymized, aggregated data via cookieless pings — no cookies are set and no personally identifiable information is collected; (b) when you grant cookie consent, Google Analytics uses cookies (_ga, _ga_*) to collect information about how you use the Website, including pages visited, time on page, referral sources, and demographic/interest data. This data is transmitted to and stored by Google. Google may use this data in accordance with Google's Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Google Ads — we use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you complete a purchase, a conversion event is sent to Google Ads. This tracking respects your cookie consent preferences via Consent Mode v2 — without consent, only aggregated, modeled data is collected. Subject to Google's Privacy Policy.
• We may add additional analytics providers in the future to support marketing measurement and product optimization. Any additions will be reflected in updates to this Privacy Policy.

5.8. Categories of Personal Information Disclosed for Business Purposes

The following table summarizes the categories of Personal Information we disclose to service providers for business purposes:

5.9. Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or if we believe in good faith that disclosure is necessary to:

• Comply with applicable law or legal process
• Protect the rights, property, or safety of Spaghetti Labs, LLC, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues

5.10. AI Assistants You Choose

AI assistants are not our service providers, and we never send your information to one on our own. Information reaches an assistant only when you — or the assistant, at your direction — ask for it:

• An assistant code you create. If you create an access code on your guide page and give it to your AI assistant, the assistant can read that one guide: the property address and parcel number, the assessed value, our market value estimate and the opinion of value the analysis supports, the comparable sales, the values for your county's forms, your filing deadlines and instructions, the documents in your guide (such as the evidence packet and any pre-filled county form or draft letter), and whether you've marked the appeal filed. It never includes your email address or payment information. The code expires on its own after 180 days, and replacing it on your guide page shuts the old one off immediately. If your assistant reports a filing or an outcome back to us with the code, we store it the same way as if you had entered it on your guide page.
• An assistant that uses our website for you. An AI agent that browses our website on your behalf sees what you would see on those pages, including your free-check results.

These are disclosures you direct; we don't sell or share your information with AI assistants' providers. What an assistant's provider does with information you give it is governed by that provider's terms and privacy policy.

---

6. What We Do Not Do

To be clear about our practices:

6.1. We do not sell your Personal Information as defined under the CCPA/CPRA. We have not sold Personal Information in the preceding 12 months and do not intend to sell Personal Information.

6.2. We do not share your Personal Information for cross-context behavioral advertising as defined under the CPRA. Your information is never provided to third parties for their own marketing or cross-context behavioral advertising purposes.

6.3. We do NOT use your Personal Information for automated decision-making that produces legal effects. The AI analysis we provide is informational — you decide whether and how to use it. The AI does not make decisions about your property taxes or legal rights.

6.4. We do NOT build personal profiles for purposes unrelated to the Service. We do not aggregate your data with other sources to create consumer profiles.

6.5. We do not collect or process Sensitive Personal Information as defined under the CPRA, and we do not use Personal Information for purposes that would require a right to limit under the CPRA.

6.6. We follow data minimization principles and collect only the Personal Information reasonably necessary to provide the Service — specifically, your property address, email address, and payment transaction data processed by Stripe.

---

7. Cookies & Tracking Technologies

7.1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help the website recognize your device and remember certain information about your visit.

7.2. Types of Cookies We Use

Essential and Functional Cookies

• First-party cookies that make the Service work, protect it, or carry a referral. They contain no personal information, are never shared with advertising platforms, and are set without the consent banner for that reason
• Include session management, security tokens, and user preference cookies
• Cannot be disabled without impairing the Service
• Free-check cookie (oa_fc) — a random identifier that lets us apply the five-free-checks-a-day limit to your browser instead of to everyone on your network (an office, a campus, or an AI assistant's shared connection). It is sent only to our property lookup service, holds nothing about you, and is not used for analytics or advertising. It lasts up to about 13 months; if you delete it, your next check simply gets a new one
• Assistant referral cookie (oa_agent) — if an AI assistant sends you to Overassessed with a link (or a link tagged with the assistant's name), we set a first-party cookie naming the assistant — for example, "claude" — for up to 30 days, so we can count which assistants help homeowners find us. It names the assistant, not you, carries no discount, and nothing about you is shared with the assistant's maker
• Arrival note (oa_landing, browser session storage — not a cookie) — when you arrive, we note which of our public pages you landed on (for example, a county guide) and the kind of site that sent you ("a search engine," "an AI assistant," "another website" — never the full web address). It's kept in your browser's session storage, so it's gone when you close the tab, and it's never sent on its own. If you run a free check or make a purchase in that tab, the note goes with it, and we count checks and sales by page — in totals only. A purchase keeps its note with the purchase record. It holds no identifier and nothing about you, isn't shared with advertising platforms, and isn't used to follow you anywhere else. If your browser blocks storage, nothing is recorded and the Service works the same
• Referral cookie (oa_ref) — if you arrive through a partner referral link, we set a first-party cookie containing the partner's referral code (not your identity) for up to 30 days. It exists solely to deliver the discount that link promised you at checkout and to credit the referring partner if you make a purchase. It is functional, not analytics — it contains no personal information, is never shared with advertising platforms, and the referring partner never receives your name, address, or email. If you delete it, the Service works normally; you would simply lose the referral discount

Analytics Cookies

• Help us understand how users interact with the Service
• Measure page views, feature usage, and site performance
• Used to identify issues and improve the user experience
• Current providers: Vercel Analytics, Google Analytics, Google Ads (see Section 5.7 for details)
• We use Google Consent Mode v2: by default, analytics operates in a cookieless mode that sends aggregated, anonymous pings without setting cookies or identifying individual users. If you accept cookies via our consent banner, Google Analytics sets cookies including _ga and _ga_* to distinguish unique users and sessions (expiring after up to 2 years), and Google Ads may set cookies for conversion measurement
• You can opt out by declining cookies via the consent banner, enabling Global Privacy Control (Section 7.4), or installing the Google Analytics Opt-out Browser Add-on

Marketing and Advertising Cookies

• May be used to measure the effectiveness of digital marketing campaigns
• May enable retargeting — showing you relevant ads on other platforms based on your visit to our Website
• These cookies may be placed by third-party advertising platforms
• Google Ads conversion tracking measures purchase completions to evaluate advertising campaign performance. This tracking respects Consent Mode v2 — without cookie consent, only modeled, aggregate data is available to Google Ads
• Google Analytics may collect data that supports marketing measurement, such as referral sources and campaign parameters (UTM tags). Google may use this data in accordance with its own privacy policy
• If we introduce additional marketing or advertising cookies in the future, we will update this Privacy Policy and disclose the specific providers used

7.3. How to Manage Cookies

When you first visit our Website, you will see a consent banner that allows you to accept or decline analytics and advertising cookies. Your choice is saved in your browser's local storage and will be remembered on future visits. To change your preference, clear your browser's local storage for this site and the banner will appear again on your next visit.

You can also control cookies through your browser settings. Most browsers allow you to:

• View what cookies are set
• Delete individual or all cookies
• Block cookies from specific or all websites
• Block third-party cookies

Please note that disabling essential cookies may prevent the Service from functioning properly.

7.4. Global Privacy Control (GPC)

We respect Global Privacy Control (GPC) signals sent by your browser. If your browser sends a GPC signal, we will treat it as a request to opt out of the sale or sharing of Personal Information, as required by California law. Because we do not sell or share Personal Information for cross-context behavioral advertising (see Section 6), a GPC signal does not change the core functionality of the Service. However, we honor GPC signals and will restrict any analytics data collection that could constitute "sharing" under the CCPA/CPRA. If our practices change in the future, GPC signals will continue to be honored.

7.5. Do Not Track

At this time, there is no universally accepted standard for how to respond to "Do Not Track" browser signals. We honor GPC signals as described above.

---

8. Data Retention

We retain your information only as long as necessary for the purposes described in this Privacy Policy, or as required by law. Here is a summary:

When the retention period expires, we delete or anonymize the data. If deletion is not immediately possible (for example, data stored in backups), we will securely isolate it and delete it when the backup cycle completes.

---

9. Your California Privacy Rights (CCPA/CPRA)

Although Spaghetti Labs, LLC may not yet meet all CCPA/CPRA applicability thresholds, we are committed to respecting your privacy rights as a California consumer. We voluntarily provide the following rights:

9.1. Right to Know

You have the right to request that we disclose:

• The categories of Personal Information we have collected about you
• The specific pieces of Personal Information we have collected about you
• The categories of sources from which we collected your Personal Information
• Our business purpose for collecting your Personal Information
• The categories of third parties with whom we share your Personal Information

9.2. Right to Delete

You have the right to request that we delete your Personal Information. Upon receiving a verified request, we will delete your Personal Information from our records, except where retention is required or permitted by law, including:

• Completing the transaction for which the information was collected
• Complying with legal obligations (e.g., tax record-keeping, and keeping your email address on our do-not-email list if you've unsubscribed, so your opt-out keeps working)
• Detecting security incidents or protecting against fraud
• Exercising or defending legal claims

9.3. Right to Correct

You have the right to request that we correct inaccurate Personal Information we maintain about you.

9.4. Right to Opt-Out of Sale or Sharing

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. If our practices change in the future, we will update this policy and provide a clear opt-out mechanism, including a "Do Not Sell or Share My Personal Information" link on the Website.

9.5. Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not:

• Deny you the Service
• Charge you different prices
• Provide a different level or quality of service
• Suggest that you will receive different treatment

9.6. How to Submit a Request

To exercise any of the rights described above:

• Email: Send your request to hello@overassessed.co
• Verification: We will verify your identity before processing your request. We may ask you to confirm information associated with your account or purchase, such as the email address or property address used.
• Response Time: We will respond to verified requests within 45 days of receipt. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason.
• Authorized Agents: You may designate an authorized agent to make a request on your behalf, subject to identity verification of both you and the agent.

9.7. Categories of Personal Information Collected

For transparency, the categories of Personal Information we have collected in the preceding 12 months include:

---

10. Data Security

We take reasonable measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

10.1. Encryption in Transit. All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.

10.2. Secure Payment Processing. All payment data is handled by Stripe, which is PCI-DSS Level 1 compliant — the highest level of payment security certification.

10.3. Access Controls. Access to user data and production systems is restricted to authorized personnel and protected by authentication.

10.4. API Key Management. Third-party API keys and secrets are stored securely in environment variables and are never exposed in client-side code or committed to source control.

10.5. Rate Limiting. We implement rate limiting on public-facing endpoints to prevent abuse.

No system is perfectly secure. While we strive to protect your information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security. If we become aware of a security breach that affects your Personal Information, we will notify you in accordance with applicable law.

---

11. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect Personal Information from children under 18. If you are under 18, please do not use the Service or provide any information to us.

If we learn that we have collected Personal Information from a child under the age of 13, we will take steps to delete that information as quickly as possible. If you believe we have inadvertently collected information from a child under 13, please contact us at hello@overassessed.co.

---

12. International Users

The Service is designed for California property owners and is operated from the United States. All data is processed and stored in the United States.

If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction.

By using the Service from outside the United States, you consent to the transfer of your information to the United States and acknowledge that you do so at your own discretion and are responsible for compliance with any applicable local laws.

---

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law.

• Material changes: We will notify you by posting a prominent notice on the Website and, where we have your email address, sending you an email notification before the changes take effect.
• Non-material changes: Minor updates (e.g., formatting or clarifications) take effect when posted.
• Last Updated date: The date at the top of this Privacy Policy will always reflect the most recent revision.
• Your options: If you disagree with changes to this Privacy Policy, you may stop using the Service and request deletion of your Personal Information. Continued use after the effective date of changes constitutes acceptance of the updated Privacy Policy.

---

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Spaghetti Labs, LLC 495 Jackson Street #1255 Oakland, CA 94607 United States

Email: hello@overassessed.co

For privacy-related requests (right to know, delete, correct, or opt-out), please email hello@overassessed.co with the subject line "Privacy Request."