Privacy Policy

1. Who this policy is for

Acre serves two kinds of people, and we treat their data differently:

• Agents — real estate professionals who hold an Acre account, use the web app and realtor mobile app, and enter their own business data (their contacts, deals, properties, and communications).
• Clients — the buyers and sellers an agent works with, who access the client mobile app through an invite code. Clients sign in anonymously: we do not ask a client for a password, and the client app reads only the single deal the invite code grants.

Much of the personal information in Acre is information an agent enters about their own clients and contacts. For that information the agent is the controller and Acre acts as a processor on the agent's behalf (see "Information our customers put into Acre" below).

2. Information we collect

Information you provide

• Account information — for agents: name, email address, and a password (or Google sign-in). For clients: an invite code and the anonymous identifier created at sign-in.
• CRM content — the contacts, deals, properties, tasks, notes, messages, and documents you create or upload in Acre.
• Communications — messages you send or receive through Acre, including in-app messages between an agent and a client, and email/SMS handled through our messaging integrations.
• Documents and signatures — files you upload to a deal and e-signature transactions you complete through our signing integration.
• Support and feedback — information you share when you contact us.

Information from connected accounts (optional)

If an agent connects a Google account, Acre accesses Google data using read-only scopes the agent grants — calendar events, contacts, and Gmail messages — solely to provide the features the agent turned on (calendar sync, contact import, and scanning emailed documents into the relevant deal). See "Google user data" below. You can disconnect at any time in the app, which revokes Acre's access.

Information from third-party data sources

When an agent adds a property, Acre may enrich it with information from third-party real estate and mapping providers (for example, geocoding, public tax and sale history, and valuation/rent estimates) keyed to the property address.

Information we collect automatically

• Device and push tokens — for the mobile apps, a push notification token so we can deliver notifications.
• Log and usage data — IP address, app/browser type, pages or screens viewed, and timestamps, used to operate, secure, and improve the Services.
• Cookies and similar technologies — used by the web app to keep you signed in and remember preferences (such as light/dark theme). We do not use third-party advertising cookies.

3. How we use information

• To provide, maintain, and secure the Services and your account.
• To power features you use — pipeline and contact management, property enrichment, messaging, document handling and e-signature, calendar and contact sync, and notifications.
• To generate AI-assisted suggestions (see "AI features" below).
• To communicate with you about the Services, including service and security notices.
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

4. AI features

Some features use a third-party AI provider (Anthropic) to generate suggestions — for example, drafting a reply, summarizing or classifying a document, enriching a contact, or proposing a next step. To do this, the relevant content is sent to the provider's API to produce a result that is returned to you.

This processing is transient and is used only to deliver the feature you invoked. Content sent to our AI provider through its API is not used to train its general models. AI output can be inaccurate or incomplete — you are responsible for reviewing it before relying on or sending it.

5. Google user data

Acre's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We access Google calendar, contacts, and Gmail data only with the read-only scopes you grant, and only to provide and improve the user-facing features you enabled.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to train generalized AI/ML models. Where an AI feature processes content that originated from Gmail (such as classifying an emailed document), that processing happens transiently to deliver the feature you invoked and is not used for model training.
• We limit human access to Google user data except with your consent, for security or to comply with law, or where the data has been aggregated/anonymized.
• You can revoke Acre's access at any time by disconnecting Google in the app or via your Google Account permissions.

6. How we share information

We share information only as described here. We use the service providers (subprocessors) below to run Acre; each receives only the information needed for its function:

• Supabase — database, authentication, and file storage (hosts your account and CRM content).
• Vercel — hosting and delivery of the web application.
• Anthropic — AI features (see above).
• Google — calendar, contacts, and Gmail access you connect.
• Mapbox and Rentcast — property geocoding and real estate data enrichment.
• Postmark — transactional and inbound email.
• Twilio — SMS messaging.
• DocuSign — document e-signature.
• Expo — mobile push notification delivery.
• Stripe — payment processing (used only if and when paid plans are enabled; not active during the beta).

We may also share information to comply with law or valid legal process, to protect the rights, safety, and security of Acre, our users, and the public, and in connection with a merger, acquisition, financing, or sale of assets (with notice where required).

7. Information our customers put into Acre

When an agent uses Acre to manage information about their own contacts and clients, the agent decides what to collect and how to use it — the agent is the controller of that information, and Acre processes it on the agent's behalf to provide the Services.

If you are a client or contact of an agent who uses Acre and you have questions about your information, please contact that agent directly. We will support our agent customers in responding to such requests.

8. Communications you send through Acre

Acre lets agents send and receive email and SMS with their contacts, and can draft or send after-hours auto-replies that an agent configures. Agents are responsible for having a lawful basis and any required consent to contact their recipients, and for complying with applicable laws (such as the TCPA, CAN-SPAM, and carrier messaging requirements). See our Terms of Service for details.

9. Your choices and rights

• Export — agents can download a full copy of their workspace data from Settings → Your data.
• Erase — agents can erase their CRM content from Settings → Your data; this removes your contacts, deals, properties, messages, and documents while keeping your login and empty workspace so you can start fresh.
• Access, correct, or delete — you may request access to, correction of, or deletion of personal information we hold about you. Depending on where you live, you may have additional rights (for example, under the GDPR or CCPA/CPRA), including the right to object to or restrict certain processing and to lodge a complaint with a regulator. We do not discriminate against you for exercising these rights.
• Disconnect integrations — disconnect Google in the app to revoke calendar/contacts/Gmail access.
• Notifications — turn off push notifications in your device settings.

To make a request, contact us at [privacy@acrerealestate.app]. We may need to verify your identity before acting on a request.

10. Data retention

We keep information for as long as your account is active or as needed to provide the Services, and afterward as required to comply with legal obligations, resolve disputes, and enforce our agreements. When you erase content or close your account, we delete or de-identify the associated data within a commercially reasonable period, subject to backups that age out on a rolling basis.

11. Security

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS/HSTS), per-workspace data isolation enforced at the database level (row-level security), and private storage for uploaded documents. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Where your information is processed

Acre and its service providers process and store information in the United States. If you access the Services from outside the United States, you understand your information will be processed in the United States, where data-protection laws may differ from those in your country.

13. Children's privacy

The Services are intended for business use by adults and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to this policy

We may update this Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised Policy.

15. Contact us

Questions about this Policy or your information? Contact us at [privacy@acrerealestate.app], or by mail at [LEGAL ENTITY NAME, mailing address].