Privacy policy

• Brokers who sign in to CRE Brain on behalf of their firm.
• People a firm keeps records about (its clients, prospects and other contacts), and people who write to its brokers. The firm decides what it records and is responsible for having a basis to do so; we process those records on the firm’s behalf.

• Account details: a broker’s name, email and firm, through our sign-in provider.
• Records a firm enters, imports or files: contacts, organizations, requirements, properties, listings, pitches.
• Gmail data, only if a broker connects Gmail (Google scope gmail.readonly):
  • Message metadata, always: the sender’s and recipients’ addresses and display names, the date, Gmail’s message and thread ids, and labels. From this we work out who at the firm corresponds with whom and how recently.
  • Message contents, only if the firm turns on AI capture. A firm admin turns capture on and chooses which kinds of sender it reads (for example, people and listservs). From then on, for the mail it covers, we read the message’s subject and body and its first PDF attachments: three of up to 5 MB each, unless the admin sets other limits (at most ten, of up to 20 MB). Other attachments are listed by name, type and size, and never read. A broker can also ask for a “deep scan” of their own mailbox’s earlier mail, which is read the same way.
• Mail a broker sends us: a message a broker forwards to their firm’s capture address, a note they type, or a file they drop on the Capture page. These are read the same way. A broker who connects Claude to CRE Brain can also send a note from Claude, which goes to the same review queue.
• Digests and what brokers do with them: each digest’s items, the evidence they rest on, and each broker’s actions on them (acted on, pitch logged, snoozed, dismissed with a reason). Alerts and their acknowledgements.
• Questions asked in Ask, and Ask’s answers with the records they cite.
• Usage and diagnostics: logs and error reports needed to run and secure the service. They carry ids, counts and timings, never message text.

• To provide the service to the firm:
  • matching listings to requirements;
  • showing which broker knows a contact;
  • listing people the firm emails who aren’t yet in its records;
  • with capture on, proposing new or updated records from the mail it reads. A proposal waits for a broker to approve, edit or reject it. Some kinds can be filed automatically if an admin chooses, but never forwards or off-market listings;
  • the digest: a Tuesday and Thursday email to each broker of who to call and why (new matches, owners who fit a requirement, 1031 and lease dates, requirements about to lapse, threads gone quiet), chosen by our own code from the firm’s records, and a roll-up of the brokers’ digests for the firm’s admins;
  • alerts on dates stated in the firm’s records (1031 deadlines, lease notice windows);
  • Ask: answering a broker’s questions about the firm’s records, citing the records each answer rests on;
  • Claude connectors: letting a broker’s own Claude read the firm’s records and, with the broker’s consent, log a pitch or send a note to the review queue.
• To keep the service secure and working.
• We do not sell personal information or use Gmail data for advertising. Neither we nor our providers use it to train AI models. We test capture’s accuracy on invented messages only, never on anyone’s mail.

We use Anthropic (the Claude API) for three things. Our own code decides what is matched, listed and filed; the AI reads messy input and writes sentences, and our code checks what it writes.

• Capture. With capture on, each message it reads is cleaned first: quoted replies and boilerplate are removed. It is then sent, with its PDFs, to Anthropic, which returns a structured reading of it. Our own code checks every number, unit, date and place in that reading before anything is proposed. What goes to Anthropic: the cleaned message (its sender, date and subject, the sender’s own words, and any forwarded message inside it) and the PDF attachments that capture reads. Nothing from the firm’s records is sent with it.
• Digest lines. Our code chooses every digest item and every fact in it. Anthropic then writes one short line per item. What goes to Anthropic: each item’s facts and the records it rests on, such as names of contacts and organizations, addresses, requirement titles, sizes, prices and dates (for a thread gone quiet, the date of the broker’s last two-way thread with the contact and how many days it has been quiet). Never a message’s subject or text. Our code checks every number and name in each line against the item, and uses a plain template line instead on any mismatch.
• Ask. A broker’s question, the earlier questions and answers in the same conversation, and the results of the searches Ask runs to answer it are sent to Anthropic. Those results are the firm’s records: requirements, listings, properties, contacts with their details, pitches, matches and open alerts, and, for a contact, who at the firm corresponds with them and when they last did (from synced mail metadata; never a subject or message text). Our code checks every record an answer cites against those results.

Nothing from any other firm is ever sent. Digest lines and Ask run for every firm once we turn them on, whether or not the firm has turned capture on: the firm’s capture switch doesn’t cover them. Each firm’s monthly AI spending cap limits them, and past it the digest uses template lines and Ask stops. Anthropic processes this data on our behalf. Under its commercial terms it may not train its models on it, and it keeps it only for the limited time those terms set out (for example, results of a batch request are kept for 29 days).

Connecting Claude. A broker can connect their own Claude (Claude Code, or a claude.ai connector) to CRE Brain. The records Claude asks for then go to that broker’s Claude account, under the broker’s or their firm’s own agreement with Anthropic, not ours. A connection reads only the broker’s own firm, and can write (log a pitch, send a note to the review queue) only if the broker allowed it when connecting.

The digest, the admins’ roll-up and alert emails are sent through Postmark. Each one carries what the broker would see on the page: the items’ lines, the names and addresses of the records they rest on, and links back to CRE Brain. They carry no tracking pixel, and their links aren’t rewritten to track clicks. Each has a one-click unsubscribe, and a broker can turn the digest email off in CRE Brain at any time; the digest is still shown in the app.

The firm already sees who at the firm corresponds with each contact, and when anyone last did. Beyond that, facts from a broker’s synced mail appear in their own digest only, with these exceptions:

• A broker’s own digest can name a contact they had a two-way thread with that has since gone quiet, with that thread’s date, and can hold an item back because the broker wrote to the contact recently.
• Silence is measured across the firm. A colleague’s later message with the same contact ends the “gone quiet” silence, and its date can appear in the item’s evidence and its count of days, without naming who sent it.
• Who gets an item. A match, a date coming due or an alert goes to the brokers who correspond with its contacts, as well as to the people who own the records.
• The roll-up for admins holds counts: how many items of each kind each broker got (including threads gone quiet) and how many capture proposals are waiting, plus a list of cross-broker matches (which broker got a match on a colleague’s listing). No addresses, mail dates, subjects or message text.
• An admin’s digest counts the capture proposals still waiting from brokers who have left the firm, naming the oldest by its number and date, so none goes unreviewed.

A record a broker files from a capture proposal is part of the firm’s records, and appears in any broker’s digest it matches, like any other record. A message’s subject or text never appears in a digest.

CRE Brain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

CRE Brain uses the scope https://www.googleapis.com/auth/gmail.readonly, with a broker’s permission, for these user-facing features:

• Relationships (always on once Gmail is connected). CRE Brain reads message metadata: sender and recipient addresses and names, dates, message and thread ids, and labels. It also reads the mailbox’s own send-as addresses, so mail to an alias counts as the broker’s. With these it shows the broker’s firm which of its brokers corresponds with each contact, and when they last did; and which people the firm emails who are not yet in its records.
• The digest and Ask (built on the relationship facts above, from metadata only). CRE Brain uses them to tell a broker, in their own digest, about a contact on a live requirement they had a two-way thread with that has since gone quiet, with that thread’s date; to send an item (a match, a date coming due, an alert) to the brokers who correspond with its contacts; to hold back an item about a contact the broker wrote to recently; and to answer a broker’s question about a contact in Ask with who at the firm corresponds with them and when.
• AI capture (only after a firm admin turns it on). For the kinds of sender the admin chooses, CRE Brain reads a message’s subject and body and its first PDF attachments (three by default, at most ten). From them it proposes records for the firm: requirements, properties a contact offers, lease expirations and contact updates. A broker reviews each one. Other attachments are never read.

Where it goes

• Capture. The cleaned text of a message capture reads, and its PDFs, are sent to Anthropic, our AI service provider, only to produce those proposals. Nothing else from the firm’s records is sent with it.
• Digest lines. For a thread gone quiet, the date of the broker’s last two-way thread with the contact and the number of days since the last message either way are sent to Anthropic with the item’s records, only to write that item’s line in the broker’s digest. No email address, subject or message text is sent.
• Digest lines and Ask run for every firm on the service, whether or not the firm has turned capture on; capture’s switch covers message contents only.
• Ask. When Ask looks up a contact for a broker’s question, the result sent to Anthropic includes, for each of the firm’s brokers who corresponds with that contact, the broker’s name, the contact’s address, the number of threads, whether they were two-way, and the date of the last message; and who at the firm knows the contact and when anyone last wrote to them. Only to answer that question. No subject or message text is sent.
• The digest email. The digest is sent to the broker through Postmark, our email provider. A thread gone quiet appears in it with its date and day count, as above.
• A broker’s own Claude. If a broker connects their own Claude (Claude Code, or a claude.ai connector) to CRE Brain, Claude can look up a contact the same way Ask does, and that result goes to the broker’s Claude account. The broker chooses to make this connection, and can revoke it.

Under their commercial terms, Anthropic and Postmark process the data on our behalf, and Anthropic may not use it to train its models.

Who sees it

Relationship facts (who at the firm corresponds with a contact, and when anyone last did) are visible to the broker’s firm. Beyond that, what the digest takes from a broker’s mail appears in that broker’s own digest only, with the exceptions listed under What the digest shows from mail. A message’s subject or text never appears in a digest, an alert or the roll-up.

What we keep

• Metadata is kept with the firm’s records.
• Message text is kept only while a proposal from it awaits a broker’s decision, and an unreadable message’s text for at most 90 days.
• Attachments are never stored.
• What a broker files keeps the phrase it was read from and a short quote.

Limited Use

• We use Gmail data only to provide and improve these user-facing features.
• We do not transfer it to others except as needed to provide the service, to comply with law, or as part of a merger or acquisition with notice to users. The providers involved are our hosting and database providers, Anthropic for AI capture, digest lines and Ask, and Postmark for the digest email. Our job scheduler (Inngest) receives ids and dates only, never Gmail data.
• We do not use it for advertising, and we do not sell it.
• No person reads it, except with the user’s explicit consent for specific messages, for security purposes, to comply with law, or when aggregated and anonymized for internal operations. A broker reviewing a proposal from their own firm’s mail is a user of the feature.
• We do not use it, and our providers may not use it, to develop, improve or train generalized or non-personalized AI or machine-learning models.
• We test capture’s accuracy, the digest’s lines and Ask’s answers on invented records and messages only, never on Gmail data.

Control

• A broker can disconnect Gmail at any time, in CRE Brain (Mail → Disconnect) or from their Google Account’s third-party access page. Either one revokes our access, and we delete the stored tokens.
• A firm admin can turn capture off, which stops all reading of message contents. It doesn’t stop the digest’s lines or Ask, which use metadata-derived facts only. An admin can also disconnect any of the firm’s mailboxes.
• A broker removed from the firm is disconnected, and Google’s grant revoked, automatically.

• Inside the firm: a firm’s records are visible to that firm’s brokers, including relationship facts derived from its brokers’ mail and proposals from capture. A broker’s digest and Ask conversations are their own; the firm’s admins get a roll-up of the digests (counts and cross-broker matches, as above). No other firm can see them.
• Service providers that host and run CRE Brain on our behalf, under contracts that limit their use of the data:
  • Vercel: hosting;
  • Neon: the database;
  • Clerk: sign-in;
  • Anthropic: AI capture, digest lines and Ask, as above;
  • Postmark: receives mail forwarded to a firm’s capture address, and sends the digest, roll-up and alert emails;
  • Inngest: schedules and retries the digest and alert jobs; it receives only ids, dates and counts, never record content;
  • Sentry: error reports, which carry no request bodies, headers or cookies.
• When the law requires it.

• Data is encrypted in transit.
• Gmail access tokens are encrypted at rest with a key kept outside the database.
• Each firm’s data is isolated at the database level.

• Mail metadata is kept with the firm’s records for as long as the firm uses CRE Brain, including after a broker disconnects Gmail, because it is the firm’s history of who knows whom.
• Message text that capture reads is kept only while a proposal from that message is waiting for a broker’s decision. Once every proposal from it is decided, the text is deleted. A message capture couldn’t read (for example, the AI service refused or returned something invalid) keeps its text until a broker reads it again or sets it aside, and for no more than 90 days.
• Ask conversations are cleared 30 days after their last message: the questions, answers and the record text they quoted are deleted, and only the fact that a conversation existed is kept.
• Digests, alerts and the actions on them are kept with the firm’s records, as its history of who was told what.
• Attachments are never stored. We keep only their name, type and size, and whether they were read.
• What a broker files from a proposal becomes part of the firm’s records, with the phrase each value was read from and a short quote from the message (a sentence or two), so the firm can see where each fact came from.
• A broker can disconnect Gmail at any time from the Mail page. We revoke our access with Google and delete the stored tokens immediately. A firm can ask us to delete one mailbox’s mail data; we do so within 30 days.
• When a firm closes its account, we export its data to it, then delete it within 30 days.
• Backups are kept for up to 30 days.

You can ask to see, correct or delete the personal information we hold about you by writing to [contact email]. We answer within 30 days. If a firm keeps records about you, you can also ask that firm directly, and we help it answer.

Depending on where you live (for example, California), local law may give you further rights over your information. We honor them, and we won’t treat you differently for using them.

We will post updates here and, for material changes, tell firms in advance. The terms of service cover the rest of our agreement with each firm.