PRE-LAUNCH DRAFT · FOR LEGAL REVIEW · NOT EFFECTIVE
Privacy Policy
Draft status and contact
Prepared October 8, 2026 for review. How To Virtual Wholesale LLC operates ASTOR AI™. Contact deals@howtovirtualwholesale.com for privacy and security questions. This draft describes current local behavior and planned hosting; it does not claim that production processors, retention promises or rights procedures are already configured.
Information processed
The application processes account email, salted password hashes, hashed sessions and confirmation/recovery tokens, onboarding preferences, workspace buyers and contacts, property/deal records, evidence, classifications, outcomes, subscription identifiers and operational audit events. Customers must have authority to supply third-party data.
Purposes
Data supports authentication, account protection, private workspace operations, subscription administration, discovery verification, troubleshooting and audit. Scores use the documented intelligence rules. Outcome capture does not silently change scoring weights or establish legal, lending or funding approval.
Analytics and cookies
The application uses a session cookie for sign-in. Public analytics aggregate event counts by date. Private product analytics store workspace identifiers, feature names and times; cohort reports aggregate those events and do not copy buyer contacts, deal notes or scores into analytics. Prefetch may count as workspace activity. No advertising tracker or third-party paid analytics dependency is configured.
Recipients and processors
Customer workspaces are not shared with other customers. Hosting and transactional email providers still require approval and configuration; the proposed processors are Render and Resend. Stripe currently supplies a dedicated ASTOR sandbox. Before production use, publish the actual processor list, locations and applicable agreements. Legal obligations or verified security investigations may require limited disclosure under the final policy.
Security and storage
Current local data resides on the application host. The prepared deployment uses private persistent storage, encrypted backup archives and HTTPS. Passwords and bearer tokens are stored as hashes; sessions expire after seven days, reset links after thirty minutes and email confirmation links after twenty-four hours. Expiry ends authentication capability; it is not a promise that every stored audit/token record is immediately purged. No system is guaranteed immune from compromise.
Retention and requests — not yet approved
Operational records currently remain until deliberately removed by an authorized workflow. Final retention periods for active accounts, closed accounts, audit events, email-provider records and backups must be approved and implemented. You may contact us to request access, correction, export, deletion or information about processing. We must verify identity and applicable legal rights before acting. No automatic deletion schedule or untested response deadline is promised by this draft.
Geography and third-party rights
The initial discovery focus is Florida. Applicable privacy obligations depend on customer geography, business activity and data subjects. Counsel must assess relevant US state and international requirements, incident notification procedures and permitted source-data use. Public availability of a record does not remove all privacy or licence obligations.
Children, changes and approval
The proposed service is not directed to children. Approve an age/eligibility policy, business contact address, production processor disclosures, rights handling, retention and incident response before launch. Material policy changes must be communicated according to the approved policy and applicable law.