Privacy Policy

Propagate 3 LLC (“Propagate,” “we,” “our,” or “us”) describes here how we collect, use, protect, and disclose personal information when you visit our website, use our software-as-a-service platform, or interact with our services (collectively, the “Services”). By using the Services you agree to the practices described in this Policy.

1. Two Roles, Two Sets of Rules

This Policy covers two different kinds of personal information, and our obligations differ between them. Read Section 2 for the first and Section 3 for the second.

• Account Information. Personal information about you, our customer and user. We decide how and why this is used, and we are the controller of it.
• Customer Content. Personal information about third parties, such as buyers, sellers, leads, agents, and other counterparties, that our customers upload or connect to the platform. We process this only on our customer’s behalf and on their instructions. We act as a service provider or processor, not a controller. We do not decide what it is used for, and we do not use it for our own purposes.

2. Account Information We Collect

2.1 Categories. We may collect:

• Identifiers such as name, email address, postal address, account name, and IP address
• Customer records such as phone number and billing contact details
• Commercial information such as subscription, transaction, and purchase history
• Professional information such as job title and organization name
• Internet and network activity such as device information, log data, and interactions with the Services
• Inferences drawn from the above to understand how you use the Services

2.2 Sources. We collect this directly from you when you create an account, use the Services, or contact us, and from our payment processor and analytics providers.

2.5 Sensitive Personal Information. Where you connect an email or file-storage account, the contents of your communications and files are transmitted to and processed by the Services. The contents of communications are treated as sensitive personal information under the California Consumer Privacy Act and as sensitive data under several other state privacy laws. We process it for one purpose only: to provide the features you connected that source for. We do not use or disclose sensitive personal information for any purpose other than those permitted for service providers under applicable law, we do not use it to infer characteristics about you, and we do not sell or share it. Because we limit our use in this way, no separate right to limit its use applies, and we will honor any such request we receive. We ask customers not to submit government identification numbers, financial account numbers, payment card numbers, biometric or health information, or precise geolocation to the Services, and our Terms of Service prohibit it.

2.3 How We Use It. To operate, maintain, secure, and improve the Services; to authenticate you and administer your account; to process payments; to respond to inquiries and send administrative or promotional messages; to analyze usage and performance; and to comply with law and prevent fraud or abuse.

2.4 Payment Data. Card and bank details are collected and stored by our payment processor. Propagate does not store full payment card numbers.

3. Customer Content: Personal Information Uploaded by Our Customers

3.1 What It Is. Our customers connect data sources they control, such as CRM systems, mail accounts, and shared drives, and upload records and documents. Those sources routinely contain personal information about people who are not our users, including property owners, buyers, sellers, leads, agents, and other counterparties. A connected source is the customer’s own vendor, not ours. We read from it under credentials the customer grants and can revoke at any time, using only the minimum authorization scopes the enabled features require, and we use those credentials only to provide the Services to that customer.

3.2 Our Role. We process Customer Content solely to provide the Services to the customer who supplied it, and solely on that customer’s instructions. We do not sell or share Customer Content, do not use it for our own commercial purposes, do not use it to train AI models, and do not use one customer’s Customer Content to serve any other customer. Where applicable law uses the terms, we act as a “service provider” or “processor” with respect to Customer Content.

3.3 The Customer’s Responsibility. The customer who uploads or connects Customer Content is responsible for having a lawful basis to do so and for obtaining any required consents and giving any required notices. Our Terms of Service restrict what customers may upload.

3.4 If You Are a Third Party. If you believe your personal information is in our platform because one of our customers put it there, contact us at contact@propagate.cloud. In most cases we will refer your request to that customer, who controls the data, and we will assist them in responding. Where we are required to act directly, we will.

4. Artificial Intelligence and Automated Processing

4.1 How We Use AI. The Services use machine learning models and large language models to produce outputs such as property valuations, after-repair-value and repair cost estimates, buyer matching and scoring, document analysis, and conversational assistance. To do this, data submitted or connected to the platform, which may include documents and the contents of connected email and file-storage accounts, is transmitted to the third-party AI model providers listed in Section 5, acting as our service providers. Section 4.5 describes this for Google accounts.

4.2 No Model Training. We do not use Account Information or Customer Content, or outputs derived from them, to train, fine-tune, or otherwise improve any AI model made available to or used to serve other customers. This applies equally to aggregated, anonymized, de-identified, and derived data. We require the AI model providers we use to be contractually prohibited from using our inputs or outputs to train or improve their models, and we do not use consumer-grade or free-tier AI tools to process this data.

4.3 Automated Decision-Making. The Services produce valuations, estimates, scores, rankings, and matches through automated processing. These are decision support for our customers, not decisions. A human at the customer reviews the output and decides whether to act on it, and the Services do not execute any transaction. Where applicable law gives an individual a right to notice of, access to, or an opportunity to opt out of automated decision-making technology that produces legal or similarly significant effects, we will support our customers in providing that notice and honoring those rights, and individuals may contact us at contact@propagate.cloud.

4.5 Google User Data. This section applies when you sign in with Google or connect a Google account.

Limited Use. Propagate’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

What we access.

• Google sign-in. Your name, email address, and profile picture. We use them only to sign you in and identify your account.
• Gmail. When you connect a Google account, we ask for read-only access to Gmail (gmail.readonly).
• Google Drive. When you add Drive access for a feature that needs it, we ask separately for read-only access to Google Drive (drive.readonly).

We cannot send, change, or delete your email or files.

How we use it.

• Gmail lead source. After you add a Gmail lead source, we read each new message in the mailbox: sender, recipients, subject, date, and body. We do not download attachments. We do not read messages that arrived before you added the source. We check every new message to find real estate leads and extract the property details, whether or not the message turns out to be a lead.
• Drive folder lead source. We watch the folder you choose and read the Google Sheets and CSV files inside it and its subfolders.
• Repair estimate photos. When you run a repair estimate on a lead that has a Google Drive photo link, we list and download the image files in that folder.
• Copilot documents. When you add a Drive file to Copilot, we download or export that file, extract its text, and index it so Copilot can answer your questions from it. We watch that file for changes to keep the index current.

To see changes in Drive, Google sends us the name, type, and folder of files that change anywhere in your Drive. We use this only to find changes to the folder or files you chose. We do not open other files.

AI processing. These features use the AI model providers listed in Section 5. We send message text and spreadsheet rows to OpenAI to extract lead details. We send Drive photos to Anthropic to estimate repairs. We send document text to OpenAI to index it, and relevant passages to Anthropic to answer your questions. We send the property address found in a lead to our property data provider to look up property records. Section 4.2 applies to all of this data.

What we do not do. We do not use Google user data to develop, improve, or train artificial intelligence or machine learning models. We do not sell it. We do not use it for advertising, or to decide eligibility for credit or lending. We do not transfer it to others except as described above, where necessary for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your consent.

Storage and retention. Google user data is stored in the United States on Amazon Web Services. Your Google access tokens are stored encrypted. Messages and spreadsheet rows, and the leads made from them, are deleted automatically thirty (30) days after we receive them. Repair estimate photos are deleted after thirty-five (35) days. Our copy of a Copilot document is deleted when you delete the document, and in any case after ninety (90) days. Text indexed from a Copilot document is kept until the file is removed from your Drive or you ask us to delete it.

Your controls. You can turn off AI access for a Google connection, or disconnect it, at any time on the Connections page. When you disconnect, we delete your access tokens and stop reading new data. You can also remove Propagate’s access in your Google Account at myaccount.google.com/permissions. To delete Google user data we already hold, email contact@propagate.cloud and we will delete it within thirty (30) days.

4.4 Human Review. Our personnel may access data and AI inputs and outputs where necessary to operate, support, secure, debug, or evaluate the quality of the Services, subject to access controls and confidentiality obligations.

5. Service Providers and Subprocessors

We share personal information with the providers below, each of which processes it on our behalf under contractual confidentiality and use restrictions. We give notice before adding a provider that materially changes how personal information is processed.

We may also disclose personal information to professional advisors such as legal and accounting counsel, to government or law enforcement agencies where required by law or valid legal process, and to an acquirer in connection with a merger, financing, or sale of assets, subject to this Policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

6. Cookies and Analytics

We use cookies and similar technologies for authentication, session management, preferences, and product analytics. You can set your browser to refuse cookies, though some features may not work correctly without them. We do not use advertising networks, we do not serve targeted advertising, and we do not sell or share personal information for cross-context behavioral advertising. We recognize and honor the Global Privacy Control and other opt-out preference signals sent by a browser or device, and we treat such a signal as a request to opt out of any sale or sharing for the browser or device that sends it.

7. Retention

We retain each category of personal information for the period described below, or for longer where a longer period is required by law or necessary to establish, exercise, or defend a legal claim. Where a precise period cannot be given in advance, we state the criteria we use.

• Identifiers and customer records: for as long as the account is active, then up to twenty-four (24) months.
• Commercial information including subscription and billing records: seven (7) years, to meet tax, accounting, and audit requirements.
• Professional information: for as long as the account is active, then up to twenty-four (24) months.
• Internet and network activity and security logs: twelve (12) months.
• Inferences: for as long as the account is active, then deleted.
• Customer Content: lead records and the source messages they came from are deleted automatically thirty (30) days after ingestion. Repair estimate photos are deleted after thirty-five (35) days. Copies of Copilot documents are deleted when you delete the document, and in any case after ninety (90) days. Data in the analytical store supporting the Intelligent Buy Box and comparable features is deleted automatically ninety (90) days after ingestion. Other Customer Content is retained while the customer maintains it in the platform, and on termination is returned or deleted within thirty (30) days at the customer’s election.

Copies held in routine backup systems are deleted in the ordinary course of backup rotation and in any event within twelve (12) months. Retained copies remain subject to the protections described here and are not processed for any other purpose.

8. Security

We maintain a written information security program with administrative, technical, and physical safeguards, including encryption in transit and at rest, role-based access control and least privilege, multi-factor authentication for access to systems holding personal information, logical separation of each customer’s data from every other customer’s, access logging and monitoring, and separation of development, test, and production environments. No system is completely secure. You are responsible for safeguarding your credentials and for notifying us at contact@propagate.cloud of any unauthorized use of your account.

9. Breach Notification

If we confirm a security incident affecting personal information, we will notify affected customers without undue delay, and will notify individuals and regulators where and within the time required by applicable law, including A.R.S. § 18-551 et seq. Our contracts with customers, including our Data Processing Addendum, commit us to a specific notification period of seventy-two (72) hours from confirmation, and those contractual commitments govern as between us and the customer. A good-faith investigation undertaken to determine whether an event is a reportable incident does not, by itself, delay this obligation beyond what is reasonable.

10. Your Choices and Rights

You may update or correct your account information at any time, opt out of marketing email using the unsubscribe link in any such message, and request access to, correction of, deletion of, or a copy of your personal information.

Residents of California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have rights to know, access, correct, delete, obtain a portable copy of, and limit certain processing of their personal information, and to appeal a denied request. We do not sell personal information or use it for targeted advertising, so no opt-out of those activities is required. We will not discriminate against you for exercising any right.

To exercise a right, email contact@propagate.cloud. We will verify your identity before responding and will respond within the time applicable law requires, generally forty-five (45) days, which we may extend once where permitted by telling you why. An authorized agent may submit a request on your behalf with proof of authorization. There is no charge for a request unless it is manifestly unfounded or excessive. If your request concerns Customer Content, see Section 3.4.

Appeals. If we decline your request, we will tell you why and how to appeal. To appeal, reply to our decision or email contact@propagate.cloud with the word “Appeal” in the subject line. We will review the appeal and inform you in writing of the outcome, with an explanation of our reasoning, within forty-five (45) days of receipt, or within sixty (60) days where applicable law allows and we tell you why we need the additional time. If we deny your appeal, we will provide you with a method to contact your state attorney general to submit a complaint.

11. Communications

We comply with the CAN-SPAM Act: we identify commercial messages appropriately, honor opt-out requests promptly, maintain accurate sender information, and include a valid postal address.

12. Children

The Services are intended only for individuals eighteen (18) years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us at contact@propagate.cloud and we will delete it.

13. Third-Party Websites

The Services may link to third-party websites or applications we do not control. We are not responsible for their content or privacy practices. Review their policies before interacting with them.

14. Data Location and International Users

Personal information is stored and processed in data centers located in the United States. The Services are intended for users in the United States. If you access them from elsewhere, you are responsible for compliance with applicable local law and do so at your own risk.

15. Changes to This Policy

We may update this Policy to reflect legal, regulatory, or operational changes. Updates are posted in the app and on our website with a revised “Last updated” date. Material changes will be communicated by email or in-app notice. Continued use after an update constitutes acceptance.

16. Contact Us

Questions, concerns, or privacy requests: