This policy explains how REMARSO LLC handles personal data in RealEstateCRM.io. It covers two different roles: we are the controller of the data about you as our customer, and a processor of the data your workspace holds about your own contacts, leads and clients — that data stays under your control.
1. Who is responsible for what
Controller: REMARSO LLC, 530-B Harkle Road STE 100, Santa Fe, NM 87505, USA, legal@remarso.com. We are the controller for account, billing, support and product-usage data relating to you and your users.
Processor: for the CRM records you create — your contacts, leads, owners, tenants, buyers, documents, emails, calls and messages — you are the controller and we process that data on your instructions to provide the Service. Our processing commitments in this policy, together with the Terms, form the data-processing agreement between us.
2. Data we collect and why
| Category | Examples | Why |
|---|---|---|
| Account data | Name, work email, phone number, company name and country, password hash, role and permissions | To create and run your workspace, authenticate users and provide support |
| Billing data | Plan, add-ons, billing cycle, invoices, payment status, the last digits and expiry of the card held by our payment provider | To take payment, issue invoices and meet accounting obligations. Full card numbers are never stored by us — they are held by Stripe |
| Usage and device data | Login times, IP address, browser and device type, pages and features used, audit and activity logs | Security, abuse prevention, troubleshooting and improving the product |
| Communications | Support requests, emails you send us, in-app notifications | To answer you and keep a record of the request |
| Marketing preferences | Your opt-in or opt-out for product guidance and offers | To send optional commercial messages, only when you opted in, and to honour opt-outs |
| Workspace content | The CRM records, files and messages you and your users create | Processed on your instructions to provide the Service — see section 10 |
3. Legal bases
- Performance of a contract — creating and operating your workspace, billing, support.
- Legitimate interests — securing the Service, preventing abuse and fraud, improving the product, and sending service messages about your account.
- Consent — optional marketing messages and non-essential cookies. You can withdraw consent at any time.
- Legal obligation — keeping accounting and tax records, responding to lawful requests.
4. Service providers and sub-processors
We use the providers below to run the Service. Which of them process data for your workspace depends on the features you enable. We do not sell personal data.
| Provider | Purpose |
|---|---|
| Stripe | Payment processing, subscriptions and invoices |
| Amazon Web Services | Hosting, file storage and transactional/campaign email delivery (SES) |
| Cloudflare | Network delivery, media storage and edge services |
| Maps and geocoding; Gmail and Calendar synchronisation, Drive and translation where you connect those accounts; reCAPTCHA | |
| Twilio | Telephony and SMS, where the phone or calling features are enabled |
| WhatsApp / Meta | WhatsApp messaging, where you connect a WhatsApp number |
| AI model providers (via OpenRouter and equivalent gateways) | AI assistance, drafting, insights and media generation, where AI features are used |
| Search and messaging infrastructure (Meilisearch/Elasticsearch, Pusher/Reverb) | Search indexing and real-time updates inside the app |
| Sentry | Error monitoring and diagnostics |
We require each provider to protect the data it handles and to process it only for the purpose we instruct. A current list of sub-processors is available on request from legal@remarso.com; we will tell you about material changes so you can object.
5. International transfers
REMARSO LLC is established in the United States and the Service is operated from outside the European Union. Personal data — including data in your workspace — may therefore be processed outside your country and outside the EEA, including in the United States.
Where we transfer personal data from the EEA, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses with our providers, together with technical measures like encryption in transit and at rest. Acknowledging this transfer at sign-up does not waive any right you have under applicable data-protection law.
6. How long we keep data
- Active workspaces: for as long as the workspace exists.
- Unconverted trials: scheduled for deletion 30 days after the trial starts, with prior notice by email.
- After you close an account: workspace data is deleted or anonymised within a reasonable period after termination.
- Invoices and accounting records: kept for the period required by law.
- Security and audit logs: kept for a limited period proportionate to their purpose.
7. Security
- Traffic is encrypted with TLS; stored files and credentials for connected accounts are encrypted at rest.
- Each workspace is logically isolated; access is governed by roles and permissions you control.
- Two-factor authentication, step-up verification for sensitive actions and device limits are available.
- Access to production systems by our staff is restricted, logged and granted only when needed for support or operations.
- We keep backups and monitor for errors and abnormal activity. If a personal-data breach affects you, we will notify you without undue delay as required by law.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with your supervisory authority. Residents of California and other US states with privacy laws have equivalent rights, including the right not to be discriminated against for exercising them.
To exercise any of these, write to legal@remarso.com. Many actions — exporting data, correcting details, deleting records or closing the workspace — can also be done directly in the app. If your request concerns data held in someone else's workspace, we will forward it to that customer, who is the controller of that data.
9. Cookies and similar technologies
- Essential cookies keep you signed in, protect the session and remember your workspace. The Service cannot work without them.
- Preference cookies remember choices such as language and layout.
- Analytics is first-party and used to understand feature usage and improve the product. Where required, we ask for consent before setting non-essential cookies.
- You can clear or block cookies in your browser; blocking essential cookies will prevent sign-in.
10. Data in your workspace
For the records you create about your own contacts and clients, you decide what is collected and why. You are responsible for having a lawful basis, for informing those people, and for honouring their requests and any opt-outs. We process that data only to provide the Service, to prevent abuse and where the law requires it, and we do not use it to train AI models for other customers.
We make the tools available for you to meet your own obligations: export, deletion, consent and opt-out tracking, unsubscribe handling, activity logging and role-based access. On termination, we delete workspace data as described in section 6, or return it on request before deletion.
11. Contact and changes
Questions or requests: legal@remarso.com. For product support: support@realestatecrm.io.
REMARSO LLC
530-B Harkle Road STE 100, Santa Fe, NM 87505, USA
We may update this policy. The “last updated” date at the top always reflects the current version, and we notify workspace owners by email or in the app when the changes are material.