This policy explains how REMARSO LLC handles personal data in RealEstateCRM.io. It covers two different roles: we are the controller of the data about you as our customer, and a processor of the data your workspace holds about your own contacts, leads and clients — that data stays under your control.
1. Who is responsible for what
Controller: REMARSO LLC, 530-B Harkle Road STE 100, Santa Fe, NM 87505, USA, [email protected]. We are the controller for account, billing, support and product-usage data relating to you and your users.
Processor: for the CRM records you create — your contacts, leads, owners, tenants, buyers, documents, emails, calls and messages — you are the controller and we process that data on your instructions to provide the Service. Our processing commitments in this policy, together with the Terms, form the data-processing agreement between us.
2. Data we collect and why
| Category | Examples | Why |
|---|---|---|
| Account data | Name, work email, phone number, company name and country, password hash, role and permissions | To create and run your workspace, authenticate users and provide support |
| Billing data | Plan, add-ons, billing cycle, invoices, payment status, the last digits and expiry of the card held by our payment provider | To take payment, issue invoices and meet accounting obligations. Full card numbers are never stored by us — they are held by Stripe |
| Usage and device data | Login times, IP address, browser and device type, pages and features used, audit and activity logs | Security, abuse prevention, troubleshooting and improving the product |
| Communications | Support requests, emails you send us, in-app notifications | To answer you and keep a record of the request |
| Marketing preferences | Your opt-in or opt-out for product guidance and offers | To send optional commercial messages, only when you opted in, and to honour opt-outs |
| Workspace content | The CRM records, files and messages you and your users create | Processed on your instructions to provide the Service — see section 10 |
3. Legal bases
- Performance of a contract — creating and operating your workspace, billing, support.
- Legitimate interests — securing the Service, preventing abuse and fraud, improving the product, and sending service messages about your account.
- Consent — optional marketing messages and non-essential cookies. You can withdraw consent at any time.
- Legal obligation — keeping accounting and tax records, responding to lawful requests.
4. Who we share data with
We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers. Personal data is shared only with:
- Your own workspace: the users of your company's workspace, according to the roles and permissions your company sets.
- Our service providers listed below, acting as processors on our behalf and only to run the Service.
- Authorities and other parties when the law requires it, or where needed to protect the rights, safety and security of our users and the Service.
Which of the providers below process data for your workspace depends on the features you enable.
| Provider | Purpose |
|---|---|
| Stripe | Payment processing, subscriptions and invoices |
| Amazon Web Services | Hosting, file storage and transactional/campaign email delivery (SES) |
| Cloudflare | Network delivery, media storage and edge services |
| Maps and geocoding; Gmail and Calendar synchronisation, Drive and translation where you connect those accounts; reCAPTCHA | |
| Twilio | Telephony and SMS, where the phone or calling features are enabled |
| WhatsApp / Meta | WhatsApp messaging, where you connect a WhatsApp number |
| AI model providers (via OpenRouter and equivalent gateways, Google Gemini, Cloudflare Workers AI) | AI assistance, drafting, insights and media generation, where AI features are used (including the AI actions of the Chrome extension) |
| Search and messaging infrastructure (Meilisearch/Elasticsearch, Pusher/Reverb) | Search indexing and real-time updates inside the app |
| Sentry | Error monitoring and diagnostics |
We require each provider to protect the data it handles and to process it only for the purpose we instruct. A current list of sub-processors is available on request from [email protected]; we will tell you about material changes so you can object.
5. International transfers
REMARSO LLC is established in the United States and the Service is operated from outside the European Union. Personal data — including data in your workspace — may therefore be processed outside your country and outside the EEA, including in the United States.
Where we transfer personal data from the EEA, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses with our providers, together with technical measures like encryption in transit and at rest. Acknowledging this transfer at sign-up does not waive any right you have under applicable data-protection law.
6. How long we keep data
- Active workspaces: for as long as the workspace exists.
- Unconverted trials: scheduled for deletion 30 days after the trial starts, with prior notice by email.
- After you close an account: workspace data is deleted or anonymised within a reasonable period after termination.
- Invoices and accounting records: kept for the period required by law.
- Security and audit logs: kept for a limited period proportionate to their purpose.
7. Security
- Traffic is encrypted with TLS; stored files and credentials for connected accounts are encrypted at rest.
- Each workspace is logically isolated; access is governed by roles and permissions you control.
- Two-factor authentication, step-up verification for sensitive actions and device limits are available.
- Access to production systems by our staff is restricted, logged and granted only when needed for support or operations.
- We keep backups and monitor for errors and abnormal activity. If a personal-data breach affects you, we will notify you without undue delay as required by law.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with your supervisory authority. Residents of California and other US states with privacy laws have equivalent rights, including the right not to be discriminated against for exercising them.
To exercise any of these, write to [email protected]. Many actions — exporting data, correcting details, deleting records or closing the workspace — can also be done directly in the app. If your request concerns data held in someone else's workspace, we will forward it to that customer, who is the controller of that data.
9. Cookies and similar technologies
- Essential cookies keep you signed in, protect the session and remember your workspace. The Service cannot work without them.
- Preference cookies remember choices such as language and layout.
- Analytics is first-party and used to understand feature usage and improve the product. Where required, we ask for consent before setting non-essential cookies.
- You can clear or block cookies in your browser; blocking essential cookies will prevent sign-in.
10. Data in your workspace
For the records you create about your own contacts and clients, you decide what is collected and why. You are responsible for having a lawful basis, for informing those people, and for honouring their requests and any opt-outs. We process that data only to provide the Service, to prevent abuse and where the law requires it, and we do not use it to train AI models for other customers.
We make the tools available for you to meet your own obligations: export, deletion, consent and opt-out tracking, unsubscribe handling, activity logging and role-based access. On termination, we delete workspace data as described in section 6, or return it on request before deletion.
11. RealEstateCRM.io Chrome extension
The RealEstateCRM.io extension for Google Chrome is a companion to your account: it only works after you sign in with it, and it moves real estate data between the web page you are on and your own workspace. This section describes what the extension collects, how it uses, stores and shares that data. It never reads pages in the background, and it contains no analytics, advertising or tracking code.
What the extension collects
- Authentication and account data: the session token issued when you sign in, and your profile as returned by the Service (name, avatar, language, company name, currency and country, role permissions). Sign-in uses our own sign-in page and a single-use code valid for 60 seconds; the extension never sees your password and does not access your Google account or Chrome profile.
- Personally identifiable information: names, email addresses and phone numbers that appear in an email, chat or web page you capture, look up or reply to.
- Personal communications:
- Gmail and Outlook on the web: while the side panel is open on an email, the sender's email address, to look the sender up in your workspace (this lookup can be turned off in the extension's Settings). The subject, body and earlier messages of the thread are read only when you click an action: capture it, log it as a note, or draft a reply.
- Inbox view: only when you click “Analyse”, the sender, subject and preview line of the emails visible in your inbox list, to find and score leads.
- WhatsApp Web: the contact's phone number, to look them up while the panel is open on their chat (same setting), and the messages of the open chat only when you click “Capture chat”.
- Website content: on other pages, only when you invoke the extension there (toolbar icon, right-click menu or keyboard shortcut) or on a site you chose to “Always allow”: the page address and title, the selected or page text, the page's structured listing data, the fields of a form you ask it to fill, and a screenshot of the visible page when you ask for one.
- Notification count: while you are signed in, the number of your unread notifications, checked every few minutes to show it on the extension's icon (can be turned off in Settings).
- Not collected: browsing history, location, keystrokes or mouse activity, health, financial or payment information, and passwords of other sites.
How the extension uses this data
- To show whether a sender or contact is already in your workspace, and open their record.
- To prepare a lead, contact, property or task from an email, chat or page. The first draft is built on your device from what the page shows, without sending anything.
- For the AI actions you click: improving a capture, drafting a reply, classifying and scoring inbox emails, mapping a property onto a listing form, reviewing a listing text and writing a social post.
- To fill a form or insert a reply or post in the page after you have reviewed it. The extension never submits a form or sends an email for you, and nothing is saved to your workspace until you confirm it.
This data is not used for advertising, profiling, creditworthiness or lending decisions, and is not used to train AI models. The use of information received by the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: it is used only to provide the extension's features, is transferred only as described below, and is not read by people except with your consent, for security purposes or to comply with the law.
Where the extension stores data, and for how long
- On your device, in the browser's extension storage: your session token, profile and permissions, preferences, short lists of your recently saved records and recently used properties (up to 8 each), and your inbox analysis results (each kept for at most 14 days, and clearable in Settings). Signing out deletes this data; uninstalling the extension deletes all of it.
- In your workspace: the records you confirm (leads, contacts, notes, tasks, properties), kept as described in section 6.
- AI requests: the content sent for an AI action is processed to return the result and is not stored as a record unless you save that result. We keep usage information (which AI action, when, credits used) for billing and abuse prevention, and error logs for a limited period.
Who the extension's data is shared with
- The extension sends data only to RealEstateCRM.io (app.realestatecrm.io), over encrypted HTTPS connections.
- Records you save are visible to the users of your company's workspace, according to its permissions.
- The content of an AI action you request is processed by our AI model providers (via OpenRouter, Google Gemini or Cloudflare Workers AI, depending on the task), acting as our processors. Our hosting and network providers (Amazon Web Services, Cloudflare) process it as part of running the Service, and Sentry may receive error diagnostics. They may not use it for their own purposes.
- Authorities, only when the law requires it.
- No data from the extension is sold or shared with advertisers, data brokers or analytics services.
You can turn off the automatic sender lookup and the notification badge, clear the inbox analysis and revoke any “Always allow” site in the extension's Settings. Your rights in section 8 apply to this data too.
12. Contact and changes
Questions or requests: [email protected]. For product support: [email protected].
REMARSO LLC
530-B Harkle Road STE 100, Santa Fe, NM 87505, USA
We may update this policy. The “last updated” date at the top always reflects the current version, and we notify workspace owners by email or in the app when the changes are material.