Rural Haven Properties, LLC ("Company," "we," "us," or "our") operates Back40 (the "Service"), a real estate underwriting and deal-tracking software tool available at back40.ruralhaven.co. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. By creating an account or using the Service, you agree to the practices described here.
If you have questions about this policy or want to exercise any of the rights described below, contact us at RuralHavenProperties@gmail.com.
When you create an account, we collect your email address and a password (stored securely and hashed by our authentication provider — we never see or store your password in plain text). If you sign in via a magic link instead, we collect only the email address used.
Subscriptions are processed by Stripe, our payment processor. We do not collect or store your full card number, CVV, or other card details — Stripe handles that directly and is responsible for its own PCI-compliant security. We receive and store limited billing metadata from Stripe, such as your subscription plan, status (trialing, active, canceled, etc.), and trial end date, so we can determine what access to grant your account.
The core of the Service is letting you enter and save information about real estate deals you're evaluating — property addresses, purchase prices, repair estimates, comparable sales, financing assumptions, and similar figures — plus a lightweight CRM where you can save contacts (agents, sellers, buyers, lenders, contractors) including their name, phone number, email, and any notes you add. This is data you choose to enter; we store it so you can retrieve and work with it across sessions and devices.
If you choose to connect Airtable or Google Sheets from Settings, we store the credentials/identifiers needed to make that connection (for example, an Airtable personal access token, base ID, and table ID, or a Google Apps Script webhook URL) so the Service can sync your saved deals to your own external account on your behalf. We only use these credentials to perform the sync you've configured — nothing else.
Like most web applications, our hosting and security providers automatically log some technical information when you use the Service — your IP address, browser type, device type, and general usage/error logs — for security, troubleshooting, and reliability purposes.
The Service uses a small number of essential cookies/local storage entries to keep you signed in between visits (managed by our authentication provider). We don't use third-party advertising trackers. Loading the page also requests fonts from Google Fonts, which may log the request on Google's end per Google's own privacy policy.
We use the information described above to:
We do not use your deal or contact data to train third-party AI models, and we do not sell your personal information to advertisers or data brokers.
We share information only as needed to operate the Service:
We do not sell your personal information, as that term is defined under applicable privacy law.
We retain your account and deal data for as long as your account is active, and for a reasonable period afterward in case you reactivate or need to export your data, and to meet legal, accounting, or security obligations. You can request deletion of your account and associated data at any time (see Section 6) — we'll delete it within a reasonable timeframe except where we're required or permitted to retain certain records by law.
We use industry-standard safeguards to protect your information, including encrypted connections (HTTPS) for all traffic to and from the Service and row-level security policies on our database so that your data is only accessible to your own account. That said, no method of transmission or storage is 100% secure, and we can't guarantee absolute security. If you become aware of a security issue affecting your account, please contact us immediately.
Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you, and to opt out of certain uses of it. To exercise any of these, email RuralHavenProperties@gmail.com — we'll respond within a reasonable time and verify your identity before making changes to your account data.
California residents: under the CCPA/CPRA, you have the right to know what personal information we've collected about you, to request its deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information (we don't sell or share personal information as those terms are defined by California law, so there is nothing to opt out of). We won't discriminate against you for exercising any of these rights.
Marketing communications: we don't currently send marketing email separate from account/billing notices. If that changes, any marketing email will include an unsubscribe option.
Because the Service is a real estate deal and contact tracker, you may enter information about people other than yourself — for example, a listing agent's name and phone number, or a seller's contact details. You are responsible for having a lawful basis to store and use that information (for example, because you're actively working with them as part of your real estate business) and for complying with any applicable laws (such as telemarketing/text-messaging consent rules) when you use the Service's call, text, or email features to reach out to them. We process this data solely on your behalf, as your data processor, to provide the CRM functionality you've chosen to use.
The Service is a business tool intended for real estate investors and professionals and is not directed to, and should not be used by, anyone under 18. We do not knowingly collect personal information from children.
The Service is operated from, and your information is stored in, the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your home country.
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you by email or through the Service. Continuing to use the Service after a change becomes effective means you accept the updated policy.
Questions, requests, or concerns about this Privacy Policy or your data can be sent to: