Privacy Policy

This Privacy Policy is issued by ReAIState LLC ("ReAIstate", "we", "us", or "our"), a Wyoming limited liability company with its principal address at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. ReAIstate operates reaistate.com and the ReAIstate insights infrastructure for real estate brokerages (the "Service") under the brand name ReAIstate. The Service reads brokerage communications and listing content to produce compliance, client-opportunity (Signals) and agent-performance (Performance) insights for enrolled brokerages. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

ReAIstate is insights infrastructure for real estate brokerages, owned and operated by ReAIState LLC, a Wyoming limited liability company incorporated on August 15, 2026. Our principal business address is 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For all privacy inquiries, contact us at hello@reaistate.com.

We collect information in three ways:

A. Information you provide directly

— Waitlist signups: name and email address

— Compliance intake form (/comply): brokerage name, contact name, email address, phone number, and attorney or firm name if provided

— Communications sent to hello@reaistate.com

B. Information collected through the Service

For brokerages enrolled in ReAIstate, we process:

— Agent email communications routed through our scanning infrastructure (BCC, Gmail OAuth or Microsoft Outlook)

— Listing, social media and website content submitted for compliance review

— Scan results, violation flags, and compliance scores

— Timestamps and audit trail data associated with each scan

— For brokerages that enable Signals: signal records (the signal type, timestamps, the agent it was routed to, and the actions recorded in response)

— Performance measures calculated from signal, scan and broker-action records, such as response timing, actions taken and letter grades, shown to the brokerage's authorized leadership

— Usage records (the number of reads analyzed each month)

This content is processed only to provide the Service's compliance, Signals and Performance features to the enrolled brokerage. We do not use brokerage communication content for any other purpose.

C. Technical information

— Server logs including IP addresses and browser type when you visit reaistate.com

— Authentication data when you log in to the ReAIstate dashboard

— Fonts on reaistate.com are loaded from Google Fonts, which receives your IP address and browser type when you visit

— Aggregate page-view counts on our public marketing pages (see Section 7)

We use the information we collect to:

— Provide the compliance monitoring, Signals, Performance and evidence ledger services to enrolled brokerages

— Send compliance alerts, violation notifications, Signals alerts and weekly digest emails to designated brokers and agents

— Calculate agent performance measures for the enrolled brokerage's authorized leadership

— Measure usage so we can notify brokerages as they approach their plan's monthly volume and apply the usage limits described in the Terms

— Respond to compliance intake inquiries submitted at reaistate.com/comply

— Maintain the append-only audit ledger that forms the core of the compliance evidence record

— Improve the accuracy and coverage of our compliance rule engine

— Communicate with waitlist members about platform availability

We do not sell your information to third parties. We do not use brokerage communication content to train AI models.

All data is stored in Supabase, a SOC 2 compliant database infrastructure provider. Our data handling works as follows:

— Real-time scanning (default): Email content is processed entirely in memory. PII is stripped before processing. Only the SHA-256 hash of the content and the scan result (risk tier, rules triggered, compliance output) are stored in our database. The email body itself is never persisted.

— Batch scanning mode: Processed email text (with PII stripped) is held temporarily in a scan queue while awaiting processing and is deleted when processing completes. If processing fails, or a message is not processed within 72 hours, the text is deleted.

Preventing duplicate processing. Email providers can send us more than one notification about the same message. To avoid analyzing a message twice, we store a short-lived identifier for each message we process: a one-way, keyed hash (HMAC-SHA256) of the provider's message identifier combined with an internal account identifier. The identifier contains no message content, subject, sender or recipient, and cannot be used to recover them. We delete these identifiers automatically after approximately 72 hours.

Recording processing failures. If processing a message fails, we record the account it relates to, the stage at which processing failed, a retry count and timestamps, together with a one-way, keyed hash of the provider's message identifier that is separate from the hash described above. We use these records to retry the message and so that our staff can see that a failure occurred. We also record the date on which a connected mailbox's synchronization with its email provider had to be reset. These records contain no message content, subject, sender or recipient, and we delete them automatically after approximately 14 days.

— Listing, social media and website content submitted for scanning: Processed and stored as part of the scan session record for the evidence ledger.

Signals processing (when enabled): Client-side email content processed for Signals is never stored, in any form. It is read into memory only for the duration of the classification pass, analyzed against the Signals taxonomy, and then discarded completely: we do not persist the email body, a hash of its content, or any excerpt or derivative of it. The only records retained are that a signal was detected: its type, timestamps, which agent it was routed to, and the actions recorded in response (for example, acted on, marked not relevant, or a nudge response). We cannot reconstruct the original message from anything stored in our systems.

Reply timing. If a brokerage turns on reply-timing measures, the Service also reads message metadata from the connected mailbox: the sender and recipient addresses, the date and time, the conversation identifier, the labels that show whether a message was sent or is a draft, and the headers that identify automated mail. It does not read the subject, the body or any attachment for this purpose. This metadata is processed by our own software and is not sent to any AI model. The addresses and identifiers are converted in memory into one-way keyed codes and are not stored. What is stored is a daily count of replies by response time for each agent, with no message content, address or identifier. We use this metadata only to work out how quickly and how often replies to clients are sent.

Access to brokerage data is restricted by row-level security policies. Each brokerage can only access its own data, and access within a brokerage is limited by role. We test the Service against the OWASP Top 10 categories of web application risk.

Scan results and compliance audit records are retained for the duration of your subscription and for a reasonable period thereafter to support legal defensibility purposes, the primary value of the evidence ledger. Signal records and performance measures are retained for the same period. Audit ledger records are append-only by design. If you wish to request deletion of your data, contact hello@reaistate.com; we will honor requests to the extent permitted by law, and may retain ledger records where needed to support legal defensibility.

Depending on your location, you may have rights under applicable privacy law including:

— The right to access the personal data we hold about you

— The right to correct inaccurate data

— The right to request deletion of your data

— The right to object to or restrict processing

— The right to data portability

For EU/EEA residents, these rights are provided under the General Data Protection Regulation (GDPR). For California residents, these rights are provided under the California Consumer Privacy Act (CCPA). To exercise any of these rights, contact hello@reaistate.com.

reaistate.com uses only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

We use PostHog to count visits to our public marketing pages. It is configured to run without cookies, to record only the page address, and not to record names, email addresses or session recordings. It does not run on the dashboard or on any page that carries an access link.

We use the following third-party services to operate the platform:

— Supabase: database and authentication infrastructure

— Vercel: hosting and deployment

— Resend: transactional email delivery

— Google: OAuth authentication for Gmail integration

— Microsoft: OAuth authentication and Microsoft Graph for Outlook integration

— Anthropic: AI models used to analyze communications

— Sentry: error monitoring (reports are scrubbed of message content, URLs that carry access tokens, and user details)

— PostHog: aggregate page-view analytics on public marketing pages (cookieless)

— Upstash: rate limiting (uses IP addresses)

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google User Data: For brokerages that connect an agent's Gmail account, we access that agent's Gmail message content and metadata via the Gmail API (using the gmail.readonly scope, together with the userinfo.email and userinfo.profile scopes to identify the connected account). This data is used exclusively to (1) scan outgoing agent email for compliance risk, (2) for brokerages that separately enable it, classify incoming client email replies for opportunity signals ('Signals'), (3) calculate the agent performance measures shown to the brokerage's leadership from the resulting records, and (4) for brokerages that separately enable it, measure reply timing from message metadata, as described in Section 4. Gmail message content is processed by Anthropic's AI models solely to perform this scanning and classification — Anthropic does not use this data to train its models. We do not share, sell, or transfer Gmail message content or metadata to any other third party. Signals-related Gmail content is never stored in any form, as described above. Compliance-related scan results (not raw message content) are retained for the duration of the subscription as described in Section 5. An agent or brokerage may revoke Gmail access and request deletion of associated data at any time by contacting hello@reaistate.com.

Microsoft User Data: For brokerages that connect an agent's Outlook or Microsoft 365 mailbox, we access that agent's message content and metadata through Microsoft Graph. This data is used only to (1) scan outgoing agent email for compliance risk, (2) for brokerages that enable Signals, classify incoming client email replies for opportunity signals, (3) calculate the agent performance measures shown to the brokerage's leadership from the resulting records, and (4) for brokerages that enable reply-timing measures, measure reply timing from message metadata, as described in Section 4. Message content is processed by Anthropic's AI models solely to perform this analysis; Anthropic does not use it to train its models. We do not share, sell or transfer message content or metadata to any other third party. Signals-related message content is never stored in any form. An agent or brokerage may disconnect Outlook at any time, which stops access and removes stored credentials; to request deletion of associated data, contact hello@reaistate.com.

We do not permit any third-party AI provider to train on your data. Anthropic's commercial API terms do not use customer data to train their models.

In the event of a security breach involving unauthorized access to personal information we control, we will notify affected brokerages without unreasonable delay and in accordance with applicable law, including the New York SHIELD Act. Notification will include a description of the incident, the categories of information involved, and the steps being taken in response.

We may update this Privacy Policy from time to time. We will notify enrolled brokerages of material changes by email. The current version is always available at reaistate.com/privacy.

For any privacy-related questions or to exercise your rights, contact us at hello@reaistate.com, or by mail at ReAIState LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. We will respond within 30 days.