We keep your data private by default.

This Privacy Policy describes how PLS, LLC, doing business as Waterfalls ("Waterfalls," "we," "us," "our"), collects, uses, and protects personal information through the Waterfalls website and related services (the "Service"). Elevation Capital Group is the legal entity responsible for the Service; "Waterfalls" is a trade name (d/b/a) under which the Service operates.

For data-protection inquiries, contact privacy@wtrfalls.com.

Account data. Email, display name, handle, and the authentication provider you used to sign in (Google, Apple, LinkedIn, Microsoft, or magic link). We receive a stable user ID from the provider and nothing else from your provider profile unless you manually enter it.

Product activity. Scenarios you save, funds you watchlist, sponsors and providers you follow, threads and comments you post, PPMs you upload, and community votes. This is what makes the product useful to you across sessions.

LP positions (optional).If you attach a position to a fund (your commitment amount, class, investment date, notes), we store it against your account so we can render "your share" math on the fund cascade and on your dashboard. Positions are covered by Postgres row-level security — only the row's owner can read or modify it. Positions never appear in any feed, leaderboard, or public profile, and we do not notify the sponsor that you've attached one.

Billing data. If you subscribe to Analyst or Institutional, Stripe handles all payment details. We store only your Stripe customer ID, subscription ID, current tier, and tier expiry — never card numbers or full billing addresses.

Analytics. We use Plausible, a privacy-first analytics product that does not set cookies, does not track you across sites, and does not collect personal data. We see aggregate page views and custom events ("Save Scenario", "Upload PPM"), never individual browsing history.

Technical data. Standard server logs (IP address, user agent, timestamps) are retained for up to 30 days for security and abuse prevention. Anonymous PPM uploads are rate-limited by IP; no other IP-level tracking is stored permanently.

To run the product.Rendering your dashboard, storing scenarios, sending notification and digest emails you've opted into, processing payments.

To grow the shared index. When you upload a PPM, we extract fund economics and — after admin review — publish the structured data so every user benefits. Your name is credited as the contributor unless you disable attribution in settings. The original PDF file stays in our private storage; we do not republish it.

To send account email. Transactional email only — sign-in links, tier changes, upload review results, payment issues. The optional daily digest covers the watchlist and follows you explicitly set. We do not use email for marketing campaigns.

For safety and abuse prevention. Rate limiting, spam detection, responding to reports. We never use these logs for behavioral profiling.

For anonymized aggregate research.We may compute and publish aggregate statistics across the platform — for example, "median preferred return across 2024-vintage multifamily funds," "fee load distribution by asset class," or "how often real-estate sponsors name a Big-4 auditor." These reports use k-anonymized aggregates (we suppress any cell covering fewer than five distinct users or funds) and never attribute a number to you, your position, your scenarios, or any identifiable third party. If we want to credit or quote you by name in a report, we will ask first — every time.

• ✕We don't sell user data, scenarios, watchlists, or positions to sponsors, brokers, placement agents, or any third party.
• ✕We don't share individual LP positions. Nothing at the row level ever leaves the platform — only anonymized aggregates, and only at a cohort size that cannot be reverse-engineered back to a person.
• ✕We don't tell the fund sponsor that you've attached a position, watchlisted their fund, or run a scenario on it.
• ✕We don't run ads or let third parties track you across the web.
• ✕We don't share your scenarios with anyone unless you explicitly generate a share link.
• ✕We don't use your content to train external AI models.
• ✕We don't receive referral fees from sponsors whose funds you view or model.

We share data only with the infrastructure partners that make the product run, and only the minimum each one needs:

• →Supabase. Our database, authentication, and file storage provider. Hosts your account row, scenarios, and uploaded PPMs.
• →Vercel. Serves the application. Standard request logs apply.
• →Stripe. Handles all payments. They see payment details; we only see customer and subscription identifiers.
• →Resend. Delivers transactional email (welcome, digest, payment failure). Sees your email address and the message we send.
• →Plausible. Aggregate, cookieless analytics. Sees page paths and event names, not personal data.

We do not otherwise share data. If we are ever required by a valid legal process, we will respond only to the specific request and notify the affected user unless prohibited by law.

Access. You can see everything we store about you on your dashboard, settings, and scenarios pages. Email us for a machine-readable export.

Correction. Edit your profile anytime at /settings.

Deletion. Self-serve account deletion isn't wired up yet — email hello@wtrfalls.com from the address on your account and we'll purge your rows within 5 business days. Published fund data derived from your uploads remains in the shared index (de-identified).

Share-link revocation.Any scenario you've shared can be unshared from its detail page; the link stops working immediately.

Email opt-out. Digest and notification email can be disabled from /settings. Transactional email (sign-in links, payment failures) can't be disabled while the account is active. Every marketing email also includes an unsubscribe link that takes effect immediately.

SMS opt-out. If you opted into SMS at account creation, reply STOP to any text message from us to cancel. Reply HELP to any text message for assistance. Message and data rates may apply. Message frequency varies. Opt-out via STOP takes effect immediately and applies only to the channel (other channels remain active).

Phone-call opt-out. Revoke phone-call consent from /settings or by emailing privacy@wtrfalls.com. Revocation applies to marketing calls; we may still call you about active support tickets you've opened or security issues affecting your account.

Consent for SMS, phone calls, and marketing email is not a condition of purchase or use of the Service.

SMS text messages (if opted in). By providing your mobile number and ticking the SMS consent checkbox during account creation, you expressly consent to receive text messages from Waterfalls, which may include security alerts, upload status, fund-watch notifications, and optional product updates. Message and data rates may apply. Message frequency varies. Reply STOP to cancel at any time; reply HELPfor help. Your mobile carrier is not liable for delayed or undelivered messages. We do not share your mobile number with third parties for their own marketing. Carriers supported: all major U.S. carriers including AT&T, Verizon, T-Mobile, and regional carriers.

Phone calls (if opted in). By providing your phone number and ticking the voice-call consent checkbox, you expressly consent to receive phone calls from Waterfalls or its authorized representatives about your account, support requests, and, if you opt in separately, marketing. Such calls may be made using an automatic telephone dialing system or artificial or prerecorded voice. Consent is not a condition of purchase.

Email marketing (if opted in). With your opt-in consent, we may send you product announcements, digest emails, and fund alerts relating to your watchlist. Every marketing email contains a visible unsubscribe link. Transactional emails (sign-in links, receipts, security notifications) are sent as necessary to operate the Service and are not classified as marketing.

We honor all opt-out requests within the time frames required by applicable law (immediately for SMS STOP commands; within 10 business days for CAN-SPAM email unsubscribe).

Our physical mailing address (CAN-SPAM requirement):

PLS, LLC d/b/a Waterfalls
[Street address — to be finalized]
[City, State ZIP — to be finalized]

We set a small number of first-party cookies and no third-party tracking cookies:

• →Auth session. Issued by Supabase when you sign in; required for the site to know who you are.
• →Anon upload token. A short-lived cookie that links anonymous PPM uploads to your session so we can credit them to your account on sign-up.

We also use sessionStorage briefly to dedupe analytics events (e.g. the upgrade success ping). Nothing persists beyond the tab.

Infrastructure is hosted in US regions (Vercel edge + AWS US-East via Supabase). Account and billing data persist for the life of your account; PPM uploads remain indefinitely unless you request removal. Analytics rollups are kept for 12 months. Server logs are kept for up to 30 days.

Waterfalls is built for professional investors and allocators evaluating private funds. We don't knowingly collect data from anyone under 18. If you believe a minor has signed up, email us and we'll delete the account.

If we change this policy in a way that meaningfully affects what we collect or who we share it with, we'll notify signed-in users by email before the change takes effect and post a summary in the signed-in release notes.