1. What this covers

CaprikaOS is a customer relationship management platform for real estate professionals. This policy explains what we collect from account holders and their team members (agents, staff) and how we handle the client records our customers store in the platform. For client records, our customer (the agent or brokerage) is the data controller and we process that data on their behalf.

2. Information we collect

• Account information — name, email, phone, brokerage details, authentication credentials, billing details (payment cards are processed by Stripe; we never store full card numbers).
• CRM content you or your team enter — contacts, leads, properties, transactions, documents, notes, marketing materials.
• Communications routed through the platform — emails, text messages, and call metadata/recordings handled by our telephony and email providers on your instruction.
• Usage and device data — log data, feature usage, and diagnostics used to operate and improve the service.
• Google user data — only if you choose to connect a Google account (see section 3).

3. Google user data (Google API Services)

If you connect a Google account, CaprikaOS requests only the scopes needed for the features you use: Gmail (send email on your behalf from the CRM, and read/organize messages solely to sync your client conversations into the CRM), Google Calendar (create and sync appointments and bookings), Google Contacts (read-only) (import contacts you choose to import), and Google Business Profile (publish content you compose to your own business profile).

CaprikaOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms:

• We use Google user data only to provide the user-facing features described above — never for advertising, profiling unrelated to those features, or determining creditworthiness.
• We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide those features (e.g., our hosting infrastructure), to comply with law, or as part of a merger/acquisition with equivalent protections.
• No humans read your Google data except with your explicit permission (e.g., a support request), where required for security or legal compliance, or where the data has been aggregated and anonymized.
• Google user data is not used to develop, improve, or train generalized artificial intelligence or machine-learning models.
• You can disconnect Google at any time from your CaprikaOS settings, and revoke access at myaccount.google.com/permissions. On disconnection we delete stored Google tokens; synced copies of messages/events you already saved into your CRM remain under your control.

4. AI features

Some features use artificial intelligence (drafting messages, summarizing conversations, answering calls). Content is processed by our AI infrastructure providers solely to deliver the feature you invoked, subject to contractual confidentiality. We do not use your CRM content to train third-party foundation models.

5. How we share information

We share data only with service providers needed to run CaprikaOS — hosting and database (Vercel, Supabase), payments (Stripe), email delivery (Mailgun, or your connected mailbox provider), telephony (Twilio), and similar processors — each bound to use it only to provide their service to us. We do not sell personal information.

6. Retention & deletion

We retain data while your account is active. On account closure you may export your data; archived accounts are moved to cold storage and deleted per our retention schedule, except where law requires longer retention. You may request deletion at any time via the contact below.

7. Security

Data is encrypted in transit and at rest. Access is role-restricted and audit-logged. No system is perfectly secure; we notify affected users of any breach as required by law.

8. Your choices & rights

You can access, correct, export, or delete your account data, and disconnect any integration, from your settings or by contacting us. Depending on your location you may have additional statutory rights (e.g., under state privacy laws); we honor verified requests.

9. Children

CaprikaOS is a professional tool and not directed to children under 16; we do not knowingly collect their data.

10. Changes & contact

We will post any material changes here and update the effective date. Questions or requests: support@caprikaos.com.