Privacy Policy · Real Estate OS

Effective: [DATE] · Last updated: [DATE]
Real Estate OS ("Real Estate OS," "we," "us"). Contact: [PRIVACY EMAIL]

1. Scope

This policy covers the Real Estate OS website, applications, connectors, and the MCP server at mcp.realestateos.com (together, the "Service"). It applies to information about you as a customer and to information we process on your behalf from systems you connect.

Two different roles matter here. For information about you as a customer — account details, billing, support — we act as a controller. For the data inside the systems you connect (your CRM records, contacts, calls, documents), we act as a processor handling it on your instructions. You remain responsible for that data and for having the right to share it with us.

2. Information we collect

Account and billing

Name, email address, business name, and phone number
Authentication details for signing in
Billing information, processed by our payment provider — we do not store full card numbers

Connection credentials

When you authorize a connector, we store the credentials needed to keep it working: OAuth access and refresh tokens, or API keys you provide. These are stored encrypted and used only to make requests you or your instructions initiate.

Data from connected systems

Depending on which connectors you enable, the Service reads and may write:

CRM records — contacts, leads, pipeline stages, notes, tags, custom fields
Communications — call metadata (time, duration, outcome, phone numbers), call recordings where enabled, message and email history, notes
Calendar and tasks — appointments, availability, task lists
Documents and spreadsheets — files you specifically connect, such as trackers and scorecards
Transactions — deal records, property details, and associated custom fields

We read from your source systems at request time rather than maintaining a full duplicate copy. We do store operational records: identifier mappings between systems, synchronization logs, and call recordings where you have enabled recording.

Usage information

Standard technical logs — IP address, browser type, timestamps, and pages or endpoints accessed — used for security, debugging, and reliability.

3. How we use information

To operate the Service and the connectors you enable
To synchronize records between the systems you connect
To respond to requests you make, including requests made through an AI assistant you have connected
To provide support and diagnose problems
To secure the Service and investigate misuse
To bill you and communicate about your account

We do not sell your data. We do not use the contents of your connected systems to train AI models, and we do not share that content for advertising.

4. AI assistants

The Service can be connected to an AI assistant, such as Claude, through the Model Context Protocol. When you connect one:

The assistant can access only the connectors you have authorized
Data is retrieved when a request requires it, not copied wholesale in advance
Your interaction with the assistant is governed by that provider's own terms and privacy policy, which are separate from this one
Revoking a connector removes the assistant's access to it

5. Call recordings

Recording is off unless you enable it, and enabling it makes you responsible for complying with the recording and consent laws that apply to your calls. Requirements vary by state, and some states require every party to consent. If you call across state lines, confirm your disclosure practice before recording at volume. See Section 5 of the Terms of Service.

Where you enable recording, audio files are stored in private object storage and served through links that expire. Recordings are retained per your account's retention setting and deleted on request.

6. Service providers

We use the following categories of subprocessor. Each receives only what it needs:

Purpose	What they process
Cloud infrastructure and storage	Application hosting, encrypted data at rest, call recordings
Database	Account records, connection credentials, sync logs, identifier mappings
Payment processing	Billing details and subscription status
Email and SMS delivery	Notifications and alerts you configure
AI assistant providers	Only the data returned in response to your requests

A current list of named subprocessors is available on request. We will make reasonable efforts to notify customers of material changes.

7. Sharing

We share information only:

With the subprocessors above, under contract
With systems you have connected, to carry out the actions you request
When required by law, subpoena, or valid legal process
To protect the rights, safety, or property of Real Estate OS, our customers, or others
In connection with a merger, acquisition, or sale of assets, with notice to you

8. Retention

Connection credentials — until you disconnect that connector or close your account
Sync logs and mappings — retained for operational and troubleshooting purposes, then purged on a rolling basis
Call recordings — retained per your account's configured retention period
Account and billing records — as long as required for legal and tax purposes

Data in your connected systems remains in those systems and is governed by their providers' policies, not this one.

9. Security

Credentials are encrypted at rest; data is encrypted in transit
Access to production systems is limited to personnel who need it
Connector access is scoped to what each integration requires
You can revoke any connector at any time, which cuts access immediately

No system is perfectly secure. If a breach affects your data, we will notify you as required by applicable law.

10. Your choices and rights

Disconnect — revoke any connector from the Hub at any time
Access — request a copy of the personal information we hold about you
Correction — ask us to correct inaccurate account information
Deletion — request deletion of your account and associated stored data
Export — request your data in a portable format

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the GDPR. Contact us at [PRIVACY EMAIL] and we will respond within the period required by law. For data we process on a customer's behalf, we will refer your request to that customer.

11. Consumers whose information is in a customer's CRM

If you are a homebuyer, seller, or other consumer whose information appears in a Real Estate OS customer's system, that customer — not Real Estate OS — controls your information. Contact them directly. If you contact us, we will forward your request to them.

12. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect information from children.

13. International transfers

The Service is operated from the United States. If you access it from elsewhere, your information will be transferred to and processed in the United States.

14. Changes

We may update this policy. Material changes will be announced through the Service or by email, and the "last updated" date above will change. Continuing to use the Service after a change means you accept the updated policy.

15. Contact

Questions about this policy or your data:
[PRIVACY EMAIL]
[BUSINESS NAME]
[BUSINESS ADDRESS]