Privacy Policy

1. Introduction

This Privacy Policy describes how Strive Tech LLC ("Strive," "we," "us," or "our") collects, uses, shares, and protects personal information when you use EasyReal, an AI-powered enterprise real estate SaaS application (the "Platform" or "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Services.

2. Information We Collect

2.1 Information You Provide

Account Information:

• Name, email, phone number, business address
• Real estate license number, licensing state, brokerage affiliation
• Professional credentials, headshot, bio, website, social media links

Billing Information:

• Payment card details (processed by Stripe)
• Billing address and tax identification numbers

CRM and Client Data:

• Contact information for your leads, clients, and prospects
• Property preferences, financial qualifications, transaction details
• Information about third parties in transactions (lenders, attorneys, title companies, etc.)

Content and Communications:

• Messages sent through the Platform
• Conversations with our AI assistant (SAI)
• Voice calls and text messages placed or received through the Platform: call metadata (numbers, direction, timing, duration, outcome) and, where call recording is enabled, the audio recording together with an automated transcript and summary generated from it. Mobile numbers and text-messaging consent are handled as described in Section 4.9.
• Documents uploaded (e-signature documents are stored by DocuSeal; we store only metadata)
• QuickBooks financial data accessed via API (not stored locally)
• Customer support inquiries

Third-Party Integration Credentials:

• OAuth tokens for connected accounts (encrypted using AES-256)

2.2 Information Collected Automatically

Technical Information:

• IP address and approximate geolocation
• Device type, operating system, browser type
• Usage data: pages viewed, features used, time spent, search queries
• Property search criteria and saved favorites
• Error logs (retained 90 days for troubleshooting)

Location Information:

• Approximate location from IP address
• Precise geolocation (with consent) for mileage tracking

Marketing Data:

• Email campaign engagement metrics
• Social media post performance

Activity Logs:

• Actions within the Platform (creating, updating, and deleting records)
• Transaction history (retained 7 years for real estate compliance)

2.3 Third-Party Data Sources

We use third-party services for infrastructure, AI, market data, mapping, and analytics. Some of these providers only supply public market data to us and do not receive your personal information.

2.4 What We Do NOT Collect

We explicitly do not collect:

• Biometric information
• Racial/ethnic origin, religious beliefs, genetic data, or health information (except incidentally in free-text fields)
• Information from children under 18

3. How We Use Your Information

Service Delivery:

• Provide Platform features (CRM, AI assistant, analytics, content tools)
• Process billing via Stripe
• Enable third-party integrations
• Customer support

AI and Predictive Features:

• Power SAI AI assistant for personalized responses
• Generate market predictions and property valuations
• Create AI-generated marketing content
• Convert content to searchable embeddings for improved search

Communications:

• Transactional emails (receipts, confirmations, password resets)
• Service announcements
• Marketing communications (with consent; unsubscribe anytime)

Security and Compliance:

• Detect fraud and security threats
• Comply with legal obligations (real estate licensing, Fair Housing Act, privacy laws)
• Enforce Terms of Service
• Protect rights and safety

Analytics:

• Analyze usage to improve the Platform
• Develop new features
• Conduct market research

4. How We Share Your Information

4.1 Service Providers

We engage third-party service providers who process data on our behalf under their own data policies and agreements:

• Infrastructure: Google Cloud Platform (application hosting), Supabase (database, authentication, and file storage), Cloudflare (bot protection), Upstash (rate limiting)
• AI & Machine Learning: OpenRouter (model routing) and the LLM providers it routes to, OpenAI (text embeddings), Cohere (search reranking), Groq (voice transcription and inference), Deepgram (speech synthesis), all under the zero-data-retention standard in Section 5.2
• Business Tools: DocuSeal (e-signature), Intuit / QuickBooks (accounting and expenses), Stripe (payment processing), Orshot (marketing image rendering), MLS Grid (MLS listing data)
• Communications: Twilio (voice calling, SMS, and call recording), Resend (transactional email), SendGrid (email delivery)
• Connected accounts you authorize: Google (Calendar, Gmail) and Microsoft (Outlook Calendar)

These providers are contractually obligated to protect your data, and their privacy policies govern their processing. This list is current as of the Last Updated date above; we maintain it as our subprocessor list for the purposes of Section 4.8.

4.2 MLS Data Sharing

When you access MLS data through our Platform via IDX or VOW functionality:

• MLS data is provided for your professional use in accordance with MLS rules
• You must comply with MLS policies regarding data use and display
• MLS data may not be used for unauthorized purposes
• We maintain audit trails as required by MLS policies
• Sellers may opt out of having their listings displayed online

4.3 Within Your Organization

If you're part of a brokerage or team:

Organization Admins Can See:

• Your profile and role
• Aggregate performance measurements attributed to you, such as counts and totals of activity volume and progress against any targets the organization sets. These are numeric measurements, not the contents of your records.
• Activity entries describing actions taken in the organization
• Pipeline and assignment status for contacts within the organization (stage, source, and assignment), which is how work is coordinated across a team

Organization Admins Cannot See:

• Your passwords or OAuth tokens
• Your contact and lead records themselves, meaning the contact details, notes, and history that make up your book of business
• Your call recordings, transcripts, or call summaries
• Your conversations with SAI, or the memory SAI builds from them
• Content marked as private
• Your personal (non-organization) activity

You maintain ownership of your "book of business" (contacts, leads, client relationships).

If you leave the organization. If you leave a brokerage or team but keep your account, your user-scoped data moves with you into your personal workspace: your contacts, leads, pipeline records, notes, tasks, activity history, call records, recordings, and transcripts. The organization does not retain access to it. The organization retains organization-scoped data: billing records, subscription settings, and templates or content it configured. Access you had previously granted to a specific record, for example a contact you shared with a teammate, ends when you leave unless you grant it again. Records we are required to keep by law, such as the transaction records described in Section 7, are retained for their required periods regardless of your organization membership.

4.4 Real Estate Industry Partners

We do not send your information to industry partners on our own initiative. Information reaches another party in a transaction only when you direct it: by adding them to a transaction, sharing a document or report with them, sending them a message, or requesting a signature. That includes:

• Other real estate professionals involved in a transaction you have added them to
• Title companies, escrow services, and closing agents you involve
• Mortgage lenders you or your client choose to involve

We have no independent relationship with these parties and send them nothing you have not directed us to send.

4.5 Legal Disclosures

We may disclose information when required by law:

• To comply with legal process (subpoena, court order)
• To respond to government requests
• To cooperate with law enforcement
• To protect rights, property, or safety

4.6 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring party as part of the business. We will notify you before that happens, or as soon after as is practical, so you can decide whether to continue using the Services and can export or request deletion of your data under Section 8 beforehand. Any acquirer remains bound by this Policy for information transferred to it until it gives you notice of a different policy.

We say "notify" rather than "opt out" because a right to opt out of an asset transfer is not something we could actually honor. Your real remedy is to export your data and close your account, and we will give you the time to do it.

4.7 No Sale of Personal Information

4.8 Data Processing for Business Customers

When you use our Platform to manage client data, Strive acts as a service provider/processor. We:

• Process data only as necessary to provide Services
• Do not sell or share client data
• Implement appropriate security measures
• Notify you without undue delay after confirming a data breach affecting that data (Section 12)
• Maintain a list of subprocessors

To obtain a Data Processing Addendum (DPA): Contact contact@strivetech.ai with "DPA Request" in the subject line.

4.9 Text Messaging Consent and Mobile Opt-In Data

Text messages (SMS and MMS) are sent through the Platform in two ways. Strive Tech team members can text prospective and current EasyReal customers directly, and real estate professionals using the Platform can text their own clients and leads through a registered business number. Either way, messages go only to people who have agreed to receive them: by giving the sender permission in person or by phone, in writing (such as an email reply, a paper contact form, or a real estate professional's web contact form), by texting the sender first, or by replying YES to a text that asks for your permission. Consent is never pre-checked or assumed. A professional using the Platform is responsible for having that consent before any message is sent. When Strive Tech texts you, the first message asks you to reply YES, and we send nothing else unless you do.

• Message frequency varies by conversation. Message and data rates may apply.
• Recipients can reply STOP at any time to opt out. They will receive one message confirming the opt-out and no further messages from that sender. Recipients can reply HELP for help.
• We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. We use them only to deliver the messages you agreed to receive.
• Twilio delivers these messages on our behalf as a service provider under Section 4.1.

The consent process for each registered business number is documented in that number's campaign registration, which wireless carriers review as part of business texting approval. Text messaging program terms are in Section 18 of the Terms of Service.

5. AI and Automated Processing

5.1 AI Features

• SAI (AI Assistant): Powered by approved LLM routes through OpenRouter; processes your queries and contextual data to generate responses.
• Predictive Market Analytics: AI forecasting of market trends and property values using publicly accessible and licensed market data.
• Content Generation: AI-assisted creation of property descriptions and marketing materials.

5.2 How AI Processes Your Data

AI Providers and Their Privacy Policies:

• OpenRouter-routed LLM providers: Process SAI conversations and AI-generated content
• OpenAI: Text embeddings for semantic search
• Cohere: Search result reranking
• OpenRouter: AI request routing
• Groq: Transcription of call recordings, and the automated summaries generated from those transcripts
• Deepgram: Speech synthesis for spoken assistant responses
• Orshot: Renders marketing images from listing details you supply (an image-rendering service, not an AI model provider; it performs no training)

We route only to providers that meet the zero-data-retention standard described below. This applies to voice processing as well as text: the provider that transcribes a call recording returns the transcript and retains neither the audio nor the text.

Embeddings: Text converted to numerical representations for intelligent search; stored in our database and scoped to your account.

5.3 SAI Conversations: What We Keep and Why

We store your conversations with SAI. We are explicit about this because it is how several features work, and because you should know what we hold.

We keep conversations in order to:

• Give SAI working memory, so it can refer back to what you already told it, within your own account, instead of starting over each time.
• Improve accuracy and reliability, so we can review how the assistant performs and fix wrong answers, broken tool calls, and failures.
• Operate and troubleshoot the service, by diagnosing errors, outages, and incorrect behavior.
• Protect the platform, by investigating abuse, security incidents, and misuse.

Who can see them. Your conversations are scoped to your account and are not visible to other customers. A limited number of authorized Strive Tech personnel may access conversation data when it is necessary for the purposes above. Access is role-restricted, logged, and limited to what is needed for the task. We do not browse customer conversations for any other reason.

Quality and diagnostic records. To measure and improve how the assistant behaves, we record technical information about each AI request: which model and provider served it, timing, token counts and cost, which tools were called, and whether the request succeeded or failed. These operational records are designed to capture how the system behaved, not the contents of what you wrote.

What we do not do. We do not sell your conversations. We do not use them to train publicly available AI models. We do not share them with other customers. We do not use them for advertising.

Assistant memory. SAI builds a working memory from your use of the Platform so it can carry context between sessions. That memory is scoped to your account and is not visible to other customers, to your organization, or to your organization's administrators. It is operational data that exists inside our systems so the assistant can function. Unlike your book of business, it is not portable data we transfer out, and it does not leave our systems except where compliance obligations, applicable regulation, or a lawful order such as a court-ordered audit require it. You can delete conversations from your account as described below.

Your control. You can delete conversations from your account, and you can request deletion of your data by contacting us at contact@strivetech.ai. Deletion requests are honored subject to the retention obligations described in Section 7, including the seven-year transaction-record retention required for real-estate compliance.

5.4 Profiling and Automated Decision-Making

• Property Search Alerts: Automated matching based on your specified criteria.
• Investment Analytics: Automated scoring and ranking of investment opportunities (advisory only, not a replacement for professional judgment).

Your Rights:

• Be informed about automated decision-making
• Opt out of profiling for decisions with legal or significant effects
• Request human review of automated decisions
• Contest automated decisions

5.5 AI Usage Tracking

We track:

• SAI message volume and token usage
• AI model selection and tool invocations
• Feature usage frequency

This data is used for billing, resource allocation, and platform improvement.

5.6 Applicable Law, Regulation, and MLS Rules

You acknowledge and agree you shall comply with all applicable laws, rules, and regulations related to your use of Workspace, including but not limited to any applicable MLS Rules.

6. Cookies and Tracking

6.1 Cookies We Use

Strictly Necessary Cookies: Essential for Platform operation (cannot opt out).

Functional Cookies: Remember your preferences.

We do not use advertising or third-party tracking cookies.

6.2 Managing Cookies

You can manage cookies through browser settings. Note that disabling necessary cookies may prevent Platform use.

Do Not Track: We do not currently respond to DNT signals. You may exercise privacy rights under Section 8.

7. Data Security and Retention

7.1 Security Measures

Technical safeguards we operate today:

• Encryption in transit (TLS), and at rest where our infrastructure providers support it
• AES-256 encryption of stored secrets, including the OAuth tokens for accounts you connect
• Authentication through Supabase Auth, with multi-factor authentication available
• Bot protection (Cloudflare Turnstile) on sign-in and signup
• Role-based access control (RBAC)
• Per-account data isolation enforced at the database level through row-level security
• Private storage buckets for documents, receipts, call recordings, and transcripts

Operational safeguards:

• Internal access limits, with administrator access to individual agent data recorded in an audit log (Section 4.3)
• Application logging and error monitoring
• An incident-response process (Section 12)

7.2 Data Retention

Real Estate Records: Transaction records are retained minimum of 7 years to accommodate state requirements. Tennessee requires 3 years (Tenn. Code Ann. §62-13-309). You are responsible for ensuring that deletions comply with your state licensing obligations.

Data Clarification: "Operational" account data: deletable or exportable within 30 days post-termination (self-service tools), subject to exceptions.

"Regulatory" and audit records (real estate, tax, security logs): retained for specified periods (e.g., 7 years) and expressly carved out from early deletion.

8. Your Privacy Rights

8.1 Rights for All Users

• Access: Request information about personal information we hold
• Update: Correct inaccurate information via account settings
• Delete: Request deletion (subject to legal retention requirements)
• Opt Out: Unsubscribe from marketing emails anytime

8.2 Rights for External Parties

If your information was entered by a real estate professional, you have rights to:

• Know what information we hold
• Correct inaccuracies
• Request deletion (subject to legal requirements and legitimate business needs)
• Opt out of communications

Contact: contact@strivetech.ai with "External Party Privacy Request" in the subject line.

8.3 State Privacy Rights

A growing number of U.S. states have comprehensive privacy laws: Tennessee, California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, and others. The rights they grant differ in detail, and which of them applies to you depends on where you live and on whether the law's thresholds are met in a given year.

Rather than make you work that out, we extend the following to every resident of a state with an applicable privacy law, and in practice to anyone who asks:

• Know and access: confirm whether we process your personal information and obtain a copy of it
• Correct: have inaccurate personal information corrected
• Delete: have your personal information deleted, subject to the legal retention obligations in Section 7.2
• Portability: receive your information in a portable, machine-readable format (Section 8.4)
• Opt out of targeted advertising, of any sale of personal information, and of profiling that produces legal or similarly significant effects
• Non-discrimination: we will not deny you service, charge you differently, or provide a lesser experience because you exercised a privacy right
• Appeal: if we deny a request, appeal that decision (Section 8.6)
• Authorized agent: use an authorized agent to submit a request on your behalf, where the applicable law allows it, subject to our verifying their authority

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising (Section 4.7), so the opt-out right above has nothing to act on today. We state it anyway so that it is on the record if that ever changes.

Notice at Collection

Summarized for California residents and anyone else who wants it in one place:

We do not knowingly collect sensitive personal information as those laws define it, except where you or another user enters it in a free-text field, and we do not use or disclose it for purposes beyond providing the Platform to you. We do not sell or share any of the above. Sources, recipients, and further detail are in Sections 2, 4, and 7.

8.4 Data Portability Format

Export Formats: JSON (technical users) or CSV (spreadsheet analysis)

Data Included:

• Account information
• Contacts, leads, deals, transactions
• Calendar events, activity history
• AI conversation transcripts & usage
• User preferences

Data NOT Included (obtain from third parties):

• Signed documents held by DocuSeal (contact DocuSeal)
• QuickBooks data (contact Intuit)
• Content held on third-party social platforms

Delivery: a secure download link, valid for seven days. We aim to produce an export within a few business days of verifying your identity, and we will tell you if it will take longer.

8.5 Exercising Your Rights

Contact Methods:

• Email: contact@strivetech.ai with "Privacy Request" in the subject line
• Phone: +1 (423) 890-4007
• Mail: Strive Tech LLC, Attn: Privacy Team, 116 Agnes Rd, Ste 200, Knoxville, TN 37919

Verification: We will verify your identity before processing requests.

Response Time: 45 days (may extend an additional 45 days if needed).

8.6 Appeals

Internal Appeal: Contact contact@strivetech.ai with "Privacy Appeal" in the subject line. Response within 60 days.

External Complaints:

• California: oag.ca.gov/privacy | (916) 210-6276
• Tennessee: tn.gov/attorneygeneral | (615) 741-3491

9. Children's Privacy

Our Platform is not directed to children under 18. Users must be at least 18 years old to create an account. We do not knowingly collect information from children.

If we learn we have collected information from a child, we will delete it immediately. Contact us at contact@strivetech.ai if you believe we have collected information from a child.

Note: Real estate professionals may input client data, including information about minors (e.g., household dependents). Professionals are responsible for obtaining appropriate consent and legal basis.

10. Data Location

Strive Tech is headquartered in Knoxville, Tennessee. Our Services are intended solely for users in the United States. Information is stored and processed in the United States: the application runs on Google Cloud Platform, the primary database, authentication, and file storage are provided by Supabase (hosted on AWS), and our machine-learning service runs on Railway.

Some providers listed in Section 4.1 (for payment processing, network security, AI inference, or message delivery) may process limited data outside the United States in the course of delivering their service.

We do not market the Services outside the United States and do not knowingly collect information from individuals outside it. We do not offer European Union data residency.

11. Third-Party Links

Our Platform may link to third-party websites or services. We are not responsible for their privacy practices. Review their privacy policies.

Third-party integrations collect information directly from you or receive information pursuant to your authorization:

• DocuSeal: https://www.docuseal.com/privacy
• QuickBooks/Intuit: https://www.intuit.com/privacy/
• Twilio: https://www.twilio.com/en-us/legal/privacy
• Google: https://policies.google.com/privacy
• Microsoft: https://privacy.microsoft.com/privacystatement

12. Data Breach Notification

In the event of a data breach, we will:

• Investigate and contain the breach immediately
• Assess its nature, scope, and consequences
• Notify affected users without undue delay after confirming a qualifying breach
• Report to the relevant authorities within the timeframes the applicable law requires (Tennessee: 45 days)
• Tell you what happened, what information was involved, and what we are doing about it
• Offer appropriate remedial measures
• Document the incident and implement improvements

We commit to notifying you without undue delay rather than within a fixed number of hours. A fixed number would be a promise about how fast we detect a breach, which is not something we can honestly guarantee; "without undue delay" is a promise about how fast we act once we know, which is.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in practices, technology, or legal requirements.

Notification:

• Posting updated policy on strivetech.ai with new "Last Updated" date
• Email notification to your account address
• Prominent notice within the Platform

Effective Date: a material change takes effect for your existing account thirty days after we notify you, unless a legal requirement makes it effective sooner, in which case we will say so in the notice. A new account accepts the version in force when it is created.

Continued Use: continuing to use the Services after the effective date is your acceptance of the revised Policy. If you do not accept it, you can export your data and close your account before that date (Section 8).

We version this Policy and record which version each account accepted, together with the Terms of Service version. Email contact@strivetech.ai if you want to know which one applies to you or want a copy of it.

14. Contact Us

Accessibility: If you need this policy in an alternative format or require accommodations to exercise privacy rights, contact us with "Accessibility Accommodation" in the subject line.

15. Governing Law

This Privacy Policy is governed by the laws of the State of Tennessee, without regard to conflict of law principles, except where preempted by U.S. federal law.

Disputes are resolved as described in Section 16 of the Terms of Service: informal resolution first, then binding arbitration, with court venue in Knox County, Tennessee where arbitration does not apply. This Policy and the Terms of Service deliberately name the same law and the same forum so that a single dispute cannot be split between two of them.