A. Privacy Policy (/privacy) Effective: [[legal.effective_date]] · Entity: [[legal.entity_name]], [[legal.entity_address]] · Contact: [[legal.privacy_contact_email]] A.1 Who we are Renested provides AI assistants for real estate and mortgage professionals. This policy covers renested.ai, app.renested.ai, and console.renested.ai. A.2 What we collect from you (our customer) Account: name, email, password credentials (hashed — we never store your password in readable form), profession, and market. Billing: handled by Stripe. We never see or store your full card number. We store Stripe's identifiers, your plan, and your subscription status. Your configuration: your agents' instructions, your knowledge sources, your Lead Pages, and your settings. Usage: counts of AI conversations by surface, so we can enforce plan allowances and keep the service reliable. Support: what you send us when you ask for help. A.3 What your agents collect from your visitors When a visitor talks to your AI agent, we process on your behalf: the conversation, whatever contact details the visitor provides, and basic technical data (approximate location from IP, device/browser type) used for rate limiting and abuse prevention. You are the controller of this data. We do not sell it, we do not use it to market to your visitors, and we do not share it with other customers. Your agents are instructed never to request sensitive identifiers (government ID numbers, full financial account or card numbers, credentials). If a visitor volunteers one, our systems refuse to store it. A.4 How we use data To provide the service; to enforce your plan's allowances; to keep the service secure and prevent abuse; to support you; to comply with law. We do not sell personal information, and we do not use your data or your visitors' data to advertise to anyone. A.5 AI processing Conversations are processed by third-party AI model providers under contract, acting as our subprocessors (§D). We do not permit them to train their models on your data. We do not train our own models on your data — see §A.7. A.6 Assistant memory Rover, your assistant, keeps conversation memory scoped to you and your account. You choose how long it is kept — keep until you clear it (the default), 12 months, or 90 days — and you can change that setting or view and clear your memory at any time. Clearing deletes it — it is not hidden or flagged, and choosing a shorter period removes older memory at the next cleanup. Preferences you deliberately set persist until you change them. Memory is never shared across accounts, and our systems refuse to store secrets, credentials, or payment card numbers in it. A.7 Improving Renested — aggregate only, and only with your consent We would like to learn which conversational approaches actually work, so every customer's agents improve. If — and only if — you switch this on: We use aggregate, de-identified patterns (for example: which kinds of replies lead to booked appointments in a market segment). We never expose one customer's transcripts, contacts, or leads to another customer, in any form. It is off by default, you can turn it off at any time, and turning it off stops future use. Deleting your data removes your contribution. A.8 Retention and deletion Data Retention Account and billing records While your account is active, then [[legal.retention_account]] (tax/legal minimums apply) Conversations and leads While your account is active, or until you delete them Assistant memory Your chosen retention (default: until you clear it), or until you clear it Usage records [[legal.retention_usage]] You may request deletion at [[legal.privacy_contact_email]]. We delete rather than merely deactivate, except where law requires retention (for example, financial records). A.9 Your rights Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to it — including under the GDPR (if you are in the EEA/UK) and the CCPA/CPRA (if you are in California). We do not sell or share personal information as those laws define it. To exercise a right, contact [[legal.privacy_contact_email]]. If you are a visitor who spoke to one of our customers' agents, contact that professional — they control that data — and we will assist them. A.10 International transfers Our service and subprocessors operate in [[legal.processing_regions]]. Where data moves across borders we rely on [[legal.transfer_mechanism]]. A.11 Security Encryption in transit; credentials and provider keys held only in deployment configuration, never in our codebase or support tooling; role-based access with audited, time-limited, approval-gated staff access to customer accounts; and staff cannot use your AI assistant on your behalf. No system is perfectly secure, and we do not claim otherwise. A.12 Children Renested is a business tool not directed to anyone under 18, and we do not knowingly collect their data. A.13 Changes We will post changes here and, for material changes, notify you by email before they take effect.