Valis Chrome Extension — Privacy

When you open a commercial real estate listing on a supported listings site, the extension reads the publicly visible listing facts on that page and sends them to Valis to compute a deal score, which it shows you in an overlay on the page. That is its single purpose.

Your account credentials. Signing in through the extension popup sends your email and password directly to our authentication provider (Supabase) over an encrypted connection. Your password is never stored — anywhere. The session tokens and your email address returned by sign-in are stored locally on your device.

Listing data from pages you visit. On supported listing pages, the extension extracts publicly visible listing facts — property name, address, property type, price, NOI, cap rate, occupancy, square footage, units, year built, lot size, lease terms, and the listing URL — and sends them, with your session token, to our scoring API to compute the score you see. Search-results pages send a smaller set per listing card: name, price, NOI, cap rate, and the listing URL.

Usage events. Each successful score records one analytics event on our servers containing your account id, your plan tier, and two flags describing how the score's inputs were derived. These events contain no listing content, no URLs, and no personal information beyond your account id.

On your device (browser extension storage, never synced to your Google account): your session tokens, your account email, and your display and underwriting-assumption preferences.

On our servers: the usage events described above, and standard authentication records kept by our auth provider (such as last sign-in time). The scoring API computes and returns scores — it does not save the listings you view. Nothing you score through the extension is added to your saved deals unless you open it in the Valis app and save it yourself.

The extension talks to exactly two services, both over encrypted connections:

• Our authentication provider (Supabase) — for sign-in and session refresh.
• tryvalis.com — for scoring the listing data described above.

• No browsing history — the extension runs only on the listing pages it declares.
• No cookies, and no reading of the sites' own session data.
• No third-party analytics or tracking SDKs inside the extension.
• No selling or sharing of your data with third parties.
• No keystrokes, form contents, or page content beyond the listing facts above.

Signing out of the popup deletes your session tokens and email from extension storage. Uninstalling the extension deletes everything it stored on your device. Account deletion requests go through the Valis app.