Privacy Policy

BrokerMargin is operated by Scott Collington. You can reach us at hello@brokermargin.com with any question about this policy or your data.

We collect only what the product needs to work:

• Account data — your email address and an encrypted password hash, handled by our authentication provider. We never see your password.
• Brokerage data you enter or import — agent names, commission splits, compensation terms, gross commission income (GCI), and your overhead figures.
• What we do NOT take from your CSV files — the file itself never leaves your browser. It is read on your own machine, and only the resulting per-agent totals are sent to us. Individual transactions, addresses, sale prices and client details stay on your computer.
• Accounting data, if you connect QuickBooks — your chart of accounts and profit-and-loss report figures. See section 5.
• Subscription data, if you subscribe— the identifier Stripe gives your customer record, your subscription's status and its renewal date. We never receive or store your card number. See section 6.
• Error reports — if something breaks in your browser we record the error message, the page it happened on and your browser type, so it can be fixed. Failures only: we do not record what you click, where you scroll, or how you move through the site.
• Basic technical data — standard server logs kept by our hosting provider, such as IP address and request time, used for security and debugging.

We count page views so we can see which pages get used, using Vercel Analytics. It is aggregate and cookieless: it does not follow you between websites, does not build a profile of you, and does not identify you personally. We do not use advertising cookies, and the only cookies we set are the ones needed to keep you signed in.

The demo on our home page requires no account. Anything you type into it stays in your own browser's local storage and is never transmitted to us. Clearing your browser data erases it.

Your data is stored in a Postgres database hosted by Supabase, encrypted in transit and at rest. Every table carrying your data is protected by row-level security, meaning the database itself enforces that one account cannot read another account's rows.

We do not sell your data, rent it, or share it with third parties for their own purposes. We do not use your brokerage figures to train machine-learning models.

A very small number of people (currently, the operator named above) can access production systems for support and maintenance. We access your data only when necessary to operate the service or when you ask us to help with a problem.

If you choose to connect QuickBooks Online, we use Intuit's official OAuth flow. We never see or store your Intuit password. We store access and refresh tokens so the connection can be maintained, along with your company identifier.

We use your accounting data for exactly one purpose: to read your chart of accounts and your profit-and-loss figures so your overhead can be filled in automatically instead of typed by hand. We do not share it with anyone.

On "read-only", precisely:Intuit's accounting permission is not something an app can request in a read-only form — the consent screen you see grants broader access than we use. We enforce read-only in our own code instead. Every call we make to QuickBooks goes through a single function that issues only HTTP GET requests; there is no code path in this application capable of creating, altering or deleting anything in your QuickBooks file. We would rather explain that than claim a restriction Intuit doesn't actually offer.

You can disconnect QuickBooks at any time from within the app. Disconnecting revokes and deletes the stored tokens.

We rely on a small number of service providers, each of which processes data only on our instructions:

• Supabase — database and authentication.
• Vercel — application hosting and server logs.
• Resend — transactional email, such as account confirmation and password resets.
• Vercel Analytics — aggregate, cookieless page-view counts. No cross-site tracking and no personal profiles.
• Stripe— payment processing and subscription billing, if you subscribe. Your card details go to Stripe directly and are never seen or stored by us; we keep only Stripe's identifier for your customer record and the status of your subscription.
• Intuit — only if you choose to connect QuickBooks.

Some of the data you enter is about other people — the agents on your roster. You are responsible for having a lawful basis to process that information and for handling it appropriately within your brokerage. We process it solely to provide the service to you.

We keep your data for as long as your account is open. You can clear your roster and overhead from within the app at any time. If you want your account and all associated data deleted, email us at the address in section 1 and we will delete it, ordinarily within 30 days.

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. Contact us at the address above to exercise any of these rights.

We use encryption in transit, encryption at rest, row-level security in the database, and hashed passwords. No system is perfectly secure, but if we become aware of a breach affecting your data we will notify you promptly.

If we make a material change, we will update the date at the top of this page and, where the change meaningfully affects you, notify you by email.