Privacy Policy

• Account information — your name, email address, and login credentials (managed by our authentication provider).
• Business profile — details you provide during onboarding: your markets, brokerage, communication style, tools, and working preferences.
• Contacts and deals — contact lists you import (for example, a CSV from your CRM) and transaction records you or the product create.
• Google user data — only if you choose to connect your Google account, as described below.

If you connect your Google account, we request the following permissions, each for a specific user-facing feature:

• Gmail — read and organize (gmail.modify): we read your email to set up your workspace (identifying your active deals, clients, and email signature) and to file or label deal-related messages. We never delete email.
• Gmail — send (gmail.send): we send email from your address only when you explicitly review a draft and click send. Nothing is ever sent automatically.
• Calendar (calendar.events): we create and update events for your appointments and deal deadlines.
• Contacts (contacts.readonly): we read your contacts to help build your sphere-of-influence database. We never modify your Google contacts.

The Agent Brain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Agent Brain uses large-language-model providers (Anthropic, and Google as a fallback) as data processors to power its features — for example, classifying which emails belong to a transaction, drafting outreach in your voice, and organizing contacts. Content is sent to these providers only to produce the feature you are using, is not used by us or by them to train general-purpose AI models, and is not retained by them beyond the processing request. We never use Google user data for advertising, and we never sell it.

• Google OAuth tokens are encrypted at rest with AES-256-GCM.
• Application data is stored in a managed PostgreSQL database (Supabase) with row-level security scoping every record to your account.
• All data moves over TLS. Access to production systems is limited to the operator of the service.

We share data only with the service providers required to run the product — hosting (Vercel), database and authentication (Supabase), payments (Stripe), email delivery, and the AI processors named above — each bound to use it only to provide their service to us. We do not sell personal information, and we do not share it for advertising.

• Disconnecting your Google account revokes our access and deletes the stored tokens.
• You can request deletion of your account and all associated data at any time by emailing ai@theagentbrain.com; we complete deletion within 30 days.
• You can also revoke our access from your Google Account permissions page.

If we make material changes to this policy we will update this page and note the new effective date. Questions: ai@theagentbrain.com.