Privacy Policy

1. Overview

This Privacy Policy applies to the personal information we handle as part of providing Red Bricks OS, the Launchpad dashboard, and related services (the "Services"). It does not apply to third-party websites or services we do not control.

By using the Services, you agree to the practices described here. Where required by law, we rely on your consent, which you may withdraw at any time (subject to legal or contractual limits).

2. Our role: controller and processor

For information about your own account and your use of Launchpad — such as your name, email, and billing details — we act as the controller (the business that decides how the information is used).

For data you collect and manage through the Services about your clients, leads, and contacts ("Contact Data"), you are the controller and we act as a processor/service provider acting on your instructions. You are responsible for having a lawful basis and any required consents for that data. See Section 7.

3. Information we collect

Information you provide

• Account information: name, email address, password (stored hashed), brokerage details, and preferences.
• Site and branding content: the information you enter to launch and operate your site.
• Billing information: handled by our payment processor, Stripe. We do not store full card numbers; we receive limited details such as the card brand, the last four digits, and your subscription status.
• Support communications: messages you send us.

Information collected automatically

• Usage and device data: log data, IP address, browser type, pages viewed, and similar analytics used to operate and secure the Services.
• Cookies and similar technologies (see Section 5).

Information from third parties

Real-estate boards and data providers (for listing data tied to your account), and service providers that help us deliver the Services.

4. How we use information

• Provide, operate, maintain, and secure the Services.
• Provision and manage your site, domain, email, and subscription.
• Process payments and prevent fraud.
• Communicate with you about your account, including service and security notices.
• Provide support and respond to your requests.
• Monitor, analyze, and improve the Services.
• Comply with legal obligations and enforce our Terms.

5. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to operate the dashboard (for example, an authentication cookie). We may use limited analytics to understand usage.

You can control cookies through your browser, but disabling necessary cookies may prevent the Services from working.

6. How we share information

We do not sell your personal information. We share it only as needed to provide the Services or as described below, with providers bound by appropriate confidentiality and data-protection obligations:

• Hosting and infrastructure (for example, Vercel and Supabase) to run the platform and databases.
• Payments (Stripe) to process subscriptions.
• Email delivery (Amazon Web Services / SES) to send transactional and platform email.
• Messaging delivery (Telnyx LLC) to send and receive SMS, voice, and WhatsApp messages you initiate through the Services.
• WhatsApp messaging (Meta Platforms, Inc. / WhatsApp Business Platform), reached through Telnyx as our Business Solution Provider, to deliver messages between you and your contacts on WhatsApp. See Section 8.
• Domain and DNS (for example, Cloudflare) to provision and secure domains.
• AI features (for example, OpenRouter and its underlying model providers) to power the assistant; your inputs are sent to process your request.
• Gmail data imported through Inbox Sync is not shared with our AI providers or used for advertising (see Section 9).
• Real-estate boards and data providers, as required to enable listing features tied to your account.

We may also share information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

7. Data about your clients and contacts

When you use the Services to collect and manage Contact Data, you are the controller of that data and we process it on your behalf to provide the Services.

You are responsible for providing any required privacy notices to, and obtaining any required consents from, your contacts, and for handling their privacy-rights requests. We will reasonably assist you as required by law.

8. Messaging services (SMS, voice, and WhatsApp)

If you enable the messaging features of the Services, we use Telnyx LLC to send and receive SMS and voice messages, and Meta Platforms, Inc. (the WhatsApp Business Platform) — reached through Telnyx as our Business Solution Provider — to send and receive WhatsApp messages. These providers act as our sub-processors for the Contact Data described in Section 7.

To deliver a message you send or receive, the following is transmitted to and processed by these providers: the message content, the recipient's and sender's phone numbers, any message template you have approved for use, and delivery and read metadata (for example, sent, delivered, read, and failure statuses). Media you attach to a message is transmitted the same way.

The WhatsApp Business Account used to send and receive these messages is owned by you, and you are responsible for complying with Meta's WhatsApp Business Messaging Policy and Commerce Policy. We access it only to operate the Services on your behalf.

We use this information solely to operate your own messaging: to deliver, display, and log your conversations, and to provide support. We do not sell it, and we do not use it for advertising, ad targeting, or building profiles. Messaging data is isolated to your tenant and is not shared with or used for the benefit of other customers.

Business-initiated marketing messages require the prior consent of the recipient, consistent with Canada's Anti-Spam Legislation (CASL) and with Meta's and Telnyx's policies. You are responsible for obtaining and keeping records of that consent. Every recipient may withdraw consent at any time — for example by replying "STOP" or using an opt-out link — and we honour and record opt-outs so that no further marketing messages are sent to that recipient.

9. Gmail and Google user data (Inbox Sync)

Inbox Sync is an optional feature that lets you connect your own Gmail account to the Red Bricks OS CRM. Signing in to Red Bricks OS does not give us access to your Gmail. You connect Gmail separately, from Settings → Email, and approve Google's permission screen. You can connect only your own mailbox.

What we access

With your permission, Red Bricks OS requests these Google permissions:

• Your Google account's email address and basic profile, to identify which mailbox is connected.
• Read-only access to your Gmail (gmail.readonly).
• Permission to send email on your behalf (gmail.send).

How we use it

We use Google user data only to provide the Inbox Sync features you see in the CRM:

• Contact email history: we look at the sender and recipient addresses of messages in your mailbox from up to the past 12 months, and then of new messages as they arrive. Only messages exchanged with people who are already contacts in your CRM are imported. For those, we store the subject, date, participants and message body and show them on the contact's timeline. Messages with anyone else are discarded before anything is stored, and we never create contacts from your email. Attachments are shown by name, type and size only; their contents are not stored.
• Sending and replying: when you click Send in the CRM email composer, we send the email through your Gmail account so it comes from your address and appears in your Gmail Sent folder. When you reply to a message, we read the original message's thread information so your reply stays in the same conversation. We never send email from your Gmail without you clicking Send.
• We never change, label, archive or delete anything in your Gmail.

Who can see it

The content of email we access from Gmail — subject lines, message bodies, sender and recipient addresses, and attachment details — is shown only inside Red Bricks OS, to you and to other users of your organization's CRM according to its contact permissions. It is never sent to our AI features or any AI model, is not available through our public API or third-party integrations (including MCP connections), and is never used to train or improve any AI model. It is never visible to other Red Bricks customers. Red Bricks staff do not read your Gmail data unless you ask us to (for example, for support with specific messages), it is necessary for security (such as investigating abuse), or the law requires it.

What we never do

We do not sell Gmail data, use it for advertising, or transfer it to anyone except as needed to provide Inbox Sync, for security, to comply with law, or as part of a merger or acquisition with notice to you.

Storage and security

Your Google authorization is stored encrypted on our central connector and is never shared with your website or browser. Imported messages are stored in your organization's CRM database, hosted on Supabase and Vercel, encrypted in transit and at rest, and isolated from other customers.

Retention

Imported message bodies are kept for 365 days by default. Your organization can shorten this to as little as 30 days. After that, only the subject, date and participants remain on the contact's timeline. Deleted data may remain in encrypted backups for up to 7 days.

Disconnecting and deletion

Google API Services User Data Policy

10. Data retention

We retain personal information for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

After account closure, we may retain certain information for a reasonable period or as required by law, after which we delete or de-identify it.

Gmail data imported through Inbox Sync follows the specific retention and deletion rules in Section 9.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption of sensitive credentials and access controls.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. International data transfers

We and our service providers may process and store information in countries other than yours, including the United States. Where required, we take steps to ensure appropriate protection for such transfers.

13. Your privacy rights

Subject to applicable law (including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)), you may request to access, correct, or delete your personal information, or withdraw consent. To make a request, contact us using the details in Section 16.

We will respond within the time required by law. We may need to verify your identity, and some information may be retained where permitted or required by law.

If you have a concern we cannot resolve, you may contact the Office of the Privacy Commissioner of Canada or your local regulator.

14. Children's privacy

The Services are intended for real-estate professionals and are not directed to children. We do not knowingly collect personal information from children under the age of majority.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version, revise the "Last updated" date, and provide additional notice where required.

16. How to contact us