Privacy Policy

We collect the following categories of information:

• Account data — name, email address, profile information, and hashed authentication credentials.
• Session data — login sessions, authentication tokens, IP address, and browser/device information.
• Business data — listing details, deal records, transaction documents, commission data, and notes entered by you or your team.
• Contact data — buyer and seller contact records entered into the platform.
• Usage data — page views, feature interactions, and activity logs generated while using the platform.
• Google account data — if you choose to sign in with Google, we receive your name, email address, and email verification status from Google. We use this solely to create and authenticate your BrokerageOS account. We do not access your Gmail, Google Drive, Google Calendar, or any other Google services unless you explicitly connect a specific Google integration and grant the required permissions.

• Authenticate users and maintain secure sessions
• Provide and operate the BrokerageOS platform
• Send transactional emails (invite links, document notifications)
• Store and display business records entered by you
• Generate activity logs and audit trails within your account
• Process billing and subscription management
• Improve and debug the platform based on aggregated, anonymized usage patterns

When you sign in with Google, we receive limited profile information (name, email, email verification status) under the OAuth 2.0 protocol. We use this data exclusively to:

• Create or authenticate your BrokerageOS account
• Pre-fill your display name and email in your profile (you may change these at any time)

We do not:

• Sell or transfer Google user data to third parties
• Use Google user data for advertising or marketing purposes
• Allow humans to read your Google data
• Use Google user data to train AI or machine learning models
• Request access to any Google service beyond basic profile and email

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell your personal information. We share data only in the following circumstances:

• Service providers — we use the following sub-processors to operate the platform. Each processes data only as instructed and under their own privacy policies:
  • Convex (database and serverless backend) — convex.dev/privacy
  • Vercel (hosting and edge delivery) — vercel.com/legal/privacy-policy
  • Resend (transactional email) — resend.com/privacy
  • Box (document storage, where connected) — box.com/legal/privacypolicy
  • Documenso (e-signatures, where used) — documenso.com/privacy
• Your brokerage — data you enter is visible to members of your brokerage organization according to the role permissions you and your administrator configure.
• Legal requirements — we may disclose data if required by law, subpoena, or to protect the rights and safety of BrokerageOS or others.

All data is transmitted over HTTPS/TLS. Authentication tokens and credentials are stored encrypted and are never exposed in client storage. OAuth tokens for connected integrations (Google, Box) are held server-side only. We implement industry-standard access controls within our database and hosting infrastructure.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users of any confirmed data breach.

• Active account data is retained while your account remains open.
• Deleted accounts are purged from our primary database within 30 days.
• Google OAuth tokens are invalidated and deleted immediately upon account deletion or disconnection.
• Backup data may persist for up to 90 days after deletion before being overwritten.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete information via your account profile, or by contacting us.
• Deletion — request deletion of your account and associated personal data.
• Portability — request an export of your data in a machine-readable format.
• Revoke Google access — disconnect Google sign-in at any time from your account settings or via your Google account permissions.

To exercise any of these rights, contact us at support@brokerageos.ai. We will respond within 30 days.

BrokerageOS uses session cookies necessary to authenticate and maintain your login state. We do not use advertising cookies or third-party tracking pixels. We may use basic, privacy-respecting analytics to understand aggregate usage patterns.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information.

For users in the European Economic Area (EEA), we process personal data under the legal basis of contractual necessity and legitimate interest. You have the right to access, rectify, erase, port, or object to the processing of your data. Contact us at support@brokerageos.ai to exercise these rights.

BrokerageOS is designed for business use by adults. We do not knowingly collect personal information from anyone under the age of 16.

We may update this policy from time to time. We will notify active users of material changes by email or by a prominent notice within the platform. The "Last Updated" date at the top of this page reflects the most recent revision.

Questions or concerns about this Privacy Policy?

Email: support@brokerageos.ai
Website: brokerageos.ai