Privacy Policy

Real Extent (the "Service") is provided by Aura Technologies LLC ("Aura Technologies LLC", "we", "us", "our"). This Privacy Policy explains how we handle personal information when you visit our websites, create an account, or use the Service, and when you fill in a form that a Real Extent user shares with you, such as an open house sign-in sheet or a booking page.

For your account, profile, and billing information, we decide how it is used, so we are its "controller". For information about the people you work with that you bring into the Service, such as leads, clients, and contacts, you (or your brokerage) are the controller, and we are your "processor" or "service provider": we handle it only to provide the Service to you. Our Data Processing Addendum covers that role.

Contact us at contact@aura-technologies.co.

Information you give us:

• Account details: your name, email address, time zone, and either a password (we store only a scrambled form we can't reverse, called a hash) or your Google sign-in identifier.
• Profile and preferences: your photo, brokerage, phone number, market, areas served, specialties, website, email signature, writing preferences, and your assistant's name, look, and permission settings.
• Workspace content: contacts and leads, notes (including voice notes, which arrive as text), tasks, deals and their dates, listings, showings and feedback, price estimates and the comparable sales you add, knowledge entries, the assistant's memory, chats with the assistant you choose to keep, and approval requests.
• Files you upload: purchase contracts, which we read once to find dates and don't store; MLS exports, of which we keep only the sales rows the price estimate needs; and contact files (CSV or vCard), which are read in your browser, so only the people you pick are sent to us.
• Messages you send us, such as support requests and feedback.

Information from accounts you connect (sections 3 to 5 explain each one): details of your email (sender, recipients, subject, date, folder or label, conversation identifiers, and a short preview of about 160 characters), the assistant's summary and sorting of each email, the full text of emails when a task needs it, calendar events, the text of documents you search or add to Knowledge, and address book entries you choose to import.

Information collected automatically: your browser type, stored with your sign-in session; the pages you open and actions you take; error reports; and a small set of product events, sent to our analytics provider with your user ID: sign-up, finishing setup, connecting an account, approving or rejecting a draft, turning on an automation, and starting or cancelling a subscription. Our servers process your IP address to deliver the Service. We store it only in scrambled (hashed) form in anti-spam counters that are deleted within 24 hours.

Information from others: Stripe tells us whether payments succeeded and the state of your subscription. A workspace owner or admin may give us your name and email to invite you. Visitors to your open house, booking, contact, and feedback pages, and the lead sources you connect to your lead address, send us information about themselves for you (section 8).

If you sign in with Google, we receive your name, email address, and profile picture. If you connect a Google account, we ask only for the access each feature needs. Google's consent screen shows exactly what you are granting, and you can decline any part of it. We use:

• Gmail (read and compose): to read and sort your messages, recognize leads and people waiting for a reply, summarize conversations, notice replies you sent from Gmail so follow-ups stop, find promises you made in sent mail, save draft replies in your Gmail, and send the messages you approve or have set to send automatically.
• Google Calendar (events): to read your events so the assistant can find open times, and to create or update events, such as showings and bookings, with a Google Meet link when you want one.
• Google Drive (read only): to search and read the files you ask about or add to Knowledge. We can't change or delete your Drive files.
• Google Contacts (read only): only if you choose to import contacts, to show you your address book so you can pick who to add.

Limited Use. Real Extent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

In particular: we use Google user data only to provide and improve the features you use in the Service. We transfer it to others only as needed to provide those features (for example, to our AI provider, which processes it for us under contract), to comply with the law, to protect security, or as part of a merger, acquisition, or sale of assets with notice to you. We don't use or transfer it for advertising, we don't sell it, and we don't use it to decide anyone's creditworthiness or for lending. Nobody at our company reads it unless you ask us to for specific messages (for example, in a support request), it is needed to investigate security or abuse, it is needed to comply with the law, or it has been aggregated and anonymized for internal operations. We don't use Google user data to develop, improve, or train generalized AI or machine-learning models.

Storage and deletion. Google access tokens are encrypted (AES-256-GCM). We store the email details listed in section 2, but not full email bodies. Bodies are read from Gmail when a task needs them. For documents you add to Knowledge, we store excerpts of their text and numerical representations of that text (embeddings) so the assistant can find relevant passages. When you disconnect Google on the Integrations page, we revoke our access with Google and delete the tokens right away. Details already saved in your workspace stay until you delete them, ask us to, or close your account. You can also remove our access at https://myaccount.google.com/permissions.

If you connect a Microsoft account (Microsoft 365 or Outlook.com), we ask only for the access the features need. Microsoft's consent screen shows exactly what you are granting. We use:

• Outlook mail (read, write, and send): the same email features described for Gmail above.
• Outlook Calendar: to read your events to find open times, and to create or update events, with a Microsoft Teams link on work accounts when you want one.
• OneDrive (read only): to search and read files you ask about or add to Knowledge. We can't change or delete your files.
• Outlook contacts (read only): only if you choose to import contacts.

We handle Microsoft data the same way as Google data: no advertising, no sale, no human reading except in the cases listed for Google data, and no use to train AI models. Access tokens are encrypted. When you disconnect, we delete the tokens right away. Microsoft doesn't offer a way for us to revoke them, so you can also remove our access at https://account.microsoft.com/privacy/app-access, or at https://myapps.microsoft.com for work accounts.

You can also connect email from other providers (such as Yahoo, iCloud, AOL, AT&T, Xfinity, Zoho, Fastmail, or your own domain) over the standard IMAP and SMTP protocols, and calendars over CalDAV or a private calendar link. These use an app password you create at your provider. We use it only to read your inbox and sent mail, save drafts, send the messages you approve or have set to send automatically, and read and update your calendar.

App passwords and private calendar links are encrypted (AES-256-GCM) and never shown again after you save them. Connections are always encrypted in transit. To find your provider's settings, we may look up your email domain's public DNS records, the settings your domain publishes, and Mozilla's public database of mail settings. These lookups include only the domain, never your full address or password. Mail from these accounts is handled the same way as Google and Microsoft mail. When you disconnect, we delete the saved password or link right away, and you can also delete the app password at your provider.

You can connect messaging accounts: WhatsApp Business (through Meta's WhatsApp Business Platform), an Instagram business or creator account, a Facebook Page (including leads from your Facebook lead ads), a Quo (OpenPhone) number, your Telegram account through Chat Automation, and Google Voice texts forwarded to your connected Gmail. You can also turn on our website chat. We use these connections only to receive the messages people send you, show them in Messages, add new leads, prepare replies, and send the replies you approve or have set to send automatically.

Messaging services don't let us read past conversations again later, so we store the text of these messages (not photos or files, only that one was sent) in your workspace. Access tokens, API keys, and webhook keys are encrypted (AES-256-GCM). When you disconnect a messaging account, we stop receiving its messages, ask the service to stop sending them where it allows, and delete its tokens and keys right away. Conversations already saved stay until you ask us to delete them or close your account.

The website chat keeps a random ID in the visitor's browser so they see their conversation again, and stores what visitors write and any contact details they choose to leave.

We use personal information to:

• provide the Service: sort email, draft and send replies, follow up, schedule, keep your CRM, deals, and listings up to date, prepare briefings, and run the automations you turn on;
• personalize the assistant to your preferences, writing style, and business;
• enforce your permission settings, keep the activity log of what the assistant did, honor opt-outs, and apply sending limits;
• send the alerts you choose, such as phone alerts and Slack messages;
• process payments and manage your subscription;
• communicate with you about your account, security, billing, and changes to the Service, and answer your requests;
• keep the Service secure, prevent spam, fraud, and abuse (including payment disputes and misuse of refunds), and fix problems;
• understand how features are used, using the product events and statistics described above, but not the contents of your emails or documents, so we can improve the Service;
• comply with the law, enforce our Terms, and handle legal claims.

If we send you product news, you can unsubscribe at any time using the link in the email. You will still get messages about your account.

To do its work, the Service sends the information a task needs to Anthropic, which provides Claude models through its commercial API and processes the information for us. For example: the sender, subject, and up to a few thousand characters of an email when sorting it; a conversation when drafting a reply, including messages from accounts you connect; your messages to the assistant; the text of a contract when finding its dates; excerpts of documents you ask about; and the notes and details about a contact that a task needs.

We also use OpenAI's embeddings API to help search your documents and the assistant's saved memories. The text being indexed and the text used to search it are sent to OpenAI to produce numerical representations that help find relevant information.

Anthropic and OpenAI do not use commercial API inputs and outputs to train their models by default. We don't use your content to train any AI model, ours or anyone else's. See Anthropic's commercial data policy and OpenAI's API data controls.

Anthropic generally deletes API inputs and outputs within 30 days. OpenAI generally retains API abuse-monitoring logs for up to 30 days. Longer retention can apply for legal requirements, safety or policy enforcement, or specific service terms. See Anthropic's retention policy and OpenAI's API data controls for the applicable exceptions. These periods describe provider retention, not how long your workspace keeps conversations and documents, which is explained below.

When your plan's AI allowance runs out, or for some routine sorting, the Service can use built-in rules on our servers instead of making an assistant-model request. Search indexing is a separate process and may still use OpenAI embeddings.

Lead scores, "needs a reply" sorting, and suggested next steps help you decide what to do first. They don't make decisions that have legal or similarly significant effects on anyone. You decide what happens. AI output can be wrong; see our AI Disclaimer.

Real Extent users are real estate professionals. When they use the Service, we handle information about the people they work with: leads, clients, and contacts; people who sign in at an open house, book a time on a booking page, or fill in a contact form; other agents who leave showing feedback; people who email them; and people who message them on WhatsApp, Instagram, Facebook, Telegram, by text, or through their website chat.

This can include names, contact details, what people wrote, property preferences and timelines, whether they already work with an agent, appointment details, and feedback. The agent decides how it is used, and we handle it only to provide the Service to that agent.

If you are one of these people and want to see, correct, or delete your information, please contact the agent first. If you contact us, we will pass your request to the agent or help them answer it, and we will act on it ourselves where the law requires. If you ask an agent to stop emailing you, or reply STOP to a text or message, the assistant stops its follow-ups to you.

To stop spam on these forms, we keep a scrambled (hashed) form of the visitor's IP address in counters that are deleted within 24 hours.

We use cookies and browser storage to run the Service, remember your choices, and measure how visitors find and start using Real Extent. We do not use advertising cookies or track you across unrelated websites. A small first-party script reports public-page visits, signup-link clicks, template copy and download actions, print requests, demo plays, and setup-inquiry link clicks to our server. It does not report information entered into the free tools. Analytics provider requests run on our servers.

• Sign-in cookie (__Host-rai_session): keeps you signed in. It lasts 30 days and renews while you use the Service.
• Connection cookies (rai_oauth_state, rai_oauth_ms_state): protect your Google or Microsoft connection from forgery. They last 10 minutes.
• Acquisition cookie (rai_acquisition): remembers a random visitor ID, your original public landing-page path, the referring website hostname, and campaign labels for up to 30 days. We use it to connect public-page actions to signup, completed assistant setup with a real mailbox, the first useful task, and subscription payments and renewals. The cookie is removed when you sign up; the attribution is then stored with your account. We do not store full referral URLs, search terms, or arbitrary query parameters. Do Not Track and Global Privacy Control signals disable this acquisition tracking.
• Chat list cookie (rai-chats): remembers whether you folded the chat list. It is set only when you click, and lasts one year.
• Browser storage: rai-guides (you turned page tips off), rai-live-sync (so only one tab checks for new mail at a time), theme (light or dark mode), and, for website chat visitors, rai-chat-… (a random ID so they see their conversation again).

You can delete cookies in your browser settings, which signs you out, and use Do Not Track or Global Privacy Control to disable acquisition tracking. Essential sign-in and connection cookies still support the features you request.

If you use voice notes, speech is turned into text by your browser or device, which may use its maker's speech service (for example, Google for Chrome or Apple for Safari). We receive only the text.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share it only as follows.

Service providers that process it for us under contracts limiting what they may do with it:

• Anthropic (United States): Claude models for the assistant's classification, drafting, extraction, and reasoning features.
• OpenAI (United States): text embeddings for searching documents and saved memories.
• Google LLC (United States): Google Cloud and Firebase, our database (Cloud Firestore, stored in the United States) and related cloud services.
• Vercel Inc. (United States): hosting and running the application.
• Stripe, Inc. (United States): payments and billing. Stripe collects your card details directly; we never receive your full card number.
• Resend (United States): sending password reset and team invitation emails.
• PostHog, Inc. (United States): product usage and acquisition events, linked to a random visitor ID before signup and your user ID afterward.
• Browser push services run by Google, Apple, Mozilla, and Microsoft: delivering the phone and browser alerts you turn on. An alert's title and short message pass through them.

At your direction: the email, calendar, file, and messaging providers you connect (such as Meta for WhatsApp, Instagram, and Facebook; Quo; and Telegram), which receive what you or your assistant sends through them; people you email, invite, or share a page with; and services you connect, such as a Slack channel that receives your alerts.

Your workspace: members of a team workspace see its shared information, as described in section 4 of our Terms: contacts and leads, deals and listings, the activity log, and details of emails synced into the workspace. Your connected accounts and chats with the assistant stay private to you.

Legal and safety: when the law requires it (such as a valid court order); to protect the rights, safety, or property of our users, the public, or us; to enforce our Terms; and to prevent fraud, including answering payment disputes with the records our Terms describe.

Business transfers: as part of a merger, acquisition, financing, or sale of assets. We will tell you, and the new owner must protect your information as this policy describes.

Aggregated or de-identified information that can't reasonably identify you or anyone else. We won't try to re-identify it.

We are based in the United States, and the Service stores and processes data in the United States. If you are outside the United States, your information is transferred to the United States, where privacy laws may differ from those where you live.

When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK and Swiss additions), or on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, together with safeguards such as encryption. You can ask us for a copy of the relevant safeguards.

• Your account and workspace content: while your account exists. If your subscription ends, we keep your workspace so you can come back, unless you ask us to delete it. If an account has had no sign-ins and no paid plan for 24 months, we may delete it after emailing you at least 30 days before.
• Email details, calendar events, and document text: while your account exists, or until you remove them. Removing a document from Knowledge deletes its saved text. Disconnecting a mailbox stops syncing but keeps the email details already saved, until you delete them, ask us to, or close your account. Disconnecting the calendar in use clears its events.
• Messages from connected messaging accounts and the website chat: while your account exists, or until you ask us to delete them. Disconnecting stops new messages but keeps the conversations already saved.
• Access tokens, app passwords, API keys, and private calendar links: until you disconnect the account, then deleted right away.
• Chats with the assistant: chats you don't keep are deleted after about a day without activity. Chats you keep stay until you delete them.
• Approval requests expire after 7 days if no one acts on them. A record stays in the activity log.
• Background tasks: deleted 14 days after they finish. Anti-spam counters: 24 hours. Sign-in sessions: until they expire or you sign out.
• Purchase contracts: not stored. MLS exports: only the rows the price estimate needs, until you delete the estimate.
• Billing records: as long as tax and accounting laws require, usually seven years.

When you ask us to delete your account, we delete or de-identify your personal information within 30 days, except what we must keep to comply with the law, resolve disputes, prevent fraud and abuse (for example, a record that an account was closed for abuse), or enforce our agreements. Copies in system logs and backups are overwritten on a rolling basis.

We protect information with technical and organizational safeguards, including: encryption in transit (TLS); encryption at rest by our database provider, plus our own AES-256-GCM encryption of access tokens, app passwords, private links, and webhook addresses; password hashing with scrypt; sign-in sessions stored only as hashes in secure, HttpOnly cookies; separation between workspaces; role-based permissions; rate limits; checks that stop the Service from being pointed at private networks; treating the contents of emails and documents as untrusted so they can't give the assistant orders; and an activity log of everything the assistant does.

No system is completely secure, and we can't guarantee absolute security. If a breach affects your personal information, we will notify you, and regulators, as the law requires.

If you think your account has been compromised, or you have found a security problem, email contact@aura-technologies.co with "Security" in the subject.

• Permission settings: choose Auto, Ask first, or Disabled for each action the assistant can take.
• Memory: see everything the assistant remembers, delete any item, or turn off memory categories.
• Connected accounts: disconnect any account on the Integrations page, and remove our access in your Google or Microsoft account settings.
• Phone alerts: turn them on or off for each device in Settings.
• Your records: edit your profile, and delete contacts, tasks, deals, listings, showings, price estimates, memories, knowledge items, and chats.
• Everything else: to get a copy of your data or have your account deleted, email contact@aura-technologies.co from your account's email address.

Depending on where you live, you may have the right to: know what personal information we have about you and get a copy, including in a portable format; correct it; delete it; object to or restrict some uses of it; withdraw consent you gave; and appeal our decision on your request. We honor these requests for all users wherever we reasonably can, even where the law doesn't require it.

To make a request, email contact@aura-technologies.co. To protect you, we may need to confirm your identity, usually by asking you to write from your account's email address. Someone you authorize can make a request for you with your signed permission, and we may still confirm it with you. We answer within one month (or 45 days where U.S. state law sets that period), and tell you if we need more time.

If we turn down your request, we will explain why. You can appeal by replying with "Appeal" in the subject, and we will answer within 45 days. If you are not satisfied, you can contact your state attorney general or your data protection authority.

We won't treat you differently for using your privacy rights.

If the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to you, Aura Technologies LLC is the controller of your account information, and we rely on these legal bases:

• Contract: to provide the Service you signed up for, including your account, connections, assistant, and billing.
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, understand how features are used, improve the Service, and handle legal claims. We balance these interests against your rights, and you can object.
• Legal obligation: to keep billing records and respond to lawful requests.
• Consent: for phone alerts and anything else we ask your permission for. You can withdraw consent at any time.

Besides the rights in section 15, you can complain to a data protection authority, such as the one where you live or work (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner). We'd appreciate the chance to help first.

We need your account information to provide the Service. Without it, we can't open your account. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

This section gives the notices required by the California Consumer Privacy Act and similar laws in other states (such as Colorado, Connecticut, Oregon, Texas, Utah, and Virginia). In the past 12 months, we collected these categories of personal information, from the sources and for the purposes described in sections 2 to 7, and disclosed each of them to the service providers listed in section 10 for business purposes:

• Identifiers: name, email address, phone number, account ID, and IP address.
• Customer records: contact details and payment status.
• Commercial information: your plan and billing history.
• Internet activity: product events, pages and actions in the Service, and browser type.
• Professional information: brokerage, market, specialties, and areas served.
• Inferences: writing preferences the assistant learns from your edits.
• Sensitive personal information: account sign-in details, and the contents of email from connected accounts. We use it only to provide the Service and keep it secure, and not to infer anything about you, so the right to limit its use doesn't apply.

We don't sell or share personal information (as those words are defined in these laws), including information about people under 16. We treat a Global Privacy Control signal as an opt-out request, although there is nothing to opt out of. We don't disclose personal information to others for their direct marketing (California's "Shine the Light" law). How long we keep each category is explained in section 12.

The Service is for adults using it for their business. It is not directed to children, and we don't knowingly collect personal information from anyone under 18 (or under 16 where that is the relevant age). If you think a child has given us personal information, tell us and we will delete it.

We may update this policy. If a change is material, we will tell you by email or in the Service before it takes effect. If a change would let us use data from your connected accounts in a materially different way, we will ask for your consent first. The date at the top shows the latest version.

Questions or requests: contact@aura-technologies.co.