Privacy
Privacy policy
Last updated May 8, 2026. We treat your data like we'd want ours treated.
This Privacy Policy explains how MyAgentEstate (“we”, “us”, “our”) collects, uses, and protects information when you use our website at myagentestate.comand the MyAgentEstate platform (collectively, the “Service”). By using the Service, you agree to this policy.
1. Information we collect
You give us
- Account info: name, email, firm name, password (hashed by Supabase Auth, never stored in plaintext).
- Payment info: handled entirely by Stripe. We receive only a customer ID, last-four digits of the card, and subscription status. We never see full card numbers.
- Connector credentials: when you connect Gmail, Zillow, or other tools, we store the OAuth tokens / API keys encrypted at rest. They are decrypted only at the moment of use, on our servers, never on your device.
- Conversations & content: chats with your AI agents, documents you upload to the doc store, and any settings you configure.
We collect automatically
- Usage data: pages visited, features used, timestamps. Used to improve the product.
- Device info: browser, OS, IP address, viewport size. Used for security and bug investigation.
- Cookies: session cookies for authentication, and minimal analytics cookies (no third-party advertising trackers).
2. How we use information
- To provide, operate, and improve the Service.
- To process payments via Stripe and respond to billing inquiries.
- To authenticate you and protect your account from unauthorized access.
- To send transactional emails (signup confirmation, billing receipts, security alerts) via Resend.
- To personalize your AI agents — they learn your firm's voice, listings, and clients over time. This learning happens within your firm's isolated workspace and is never shared across firms.
- To send product updates and marketing emails — only if you opt in. You can unsubscribe in one click.
3. AI model providers and data retention
We route AI agent requests through the Vercel AI Gateway, which has zero-data-retention agreements with the underlying model providers (currently OpenAI and Anthropic). Your conversations are not used to train any model— neither ours nor the underlying provider's.
Model providers see only the prompt content during inference, which they discard immediately. Metadata (token counts, latency, model used) is logged for billing and observability.
4. Sharing your information
We don't sell, rent, or trade your information. We share it only with service providers needed to operate the platform:
- Vercel — hosts our web application
- Supabase — provides our database and authentication
- Stripe — processes payments
- Resend — sends transactional emails
- OpenAI / Anthropic (via Vercel AI Gateway) — provides the underlying AI models, with zero data retention
- Connectors you authorize (Gmail, Google Calendar, Zillow, Higgsfield, ElevenLabs, DocuSign) — only when you explicitly connect them, and only with the scopes you grant
We may also disclose information if legally required (e.g. valid subpoena), but only to the extent necessary, and we'll notify you unless legally prohibited from doing so.
5. Per-broker isolation
Within a brokerage, every individual broker's agent conversations, learned skills, and personal credentials are isolated from their colleagues. Org admins manage members and billing, but cannot read other brokers' agent threads. This isolation is enforced at the database level (Postgres Row-Level Security), not just by application logic.
6. Your rights
- Access: you can export your data from the dashboard at any time.
- Correction: edit your account info from Settings.
- Deletion: delete your account from Settings → Danger zone, or email us. After deletion, we retain data for 90 days for recovery, then permanently erase it.
- Portability: request a machine-readable export of your data by emailing us.
- Opt out of marketing: every marketing email includes a one-click unsubscribe link.
7. Data location and transfer
Your data is stored in the United States (Supabase's us-east-1 region in Northern Virginia). If you access the Service from outside the US, your data will be transferred to and processed in the US.
8. Security
See our Security page for a detailed breakdown of how we protect your data — encryption at rest and in transit, isolation, access controls, and incident response.
No system is perfectly secure. If we detect or are notified of a breach affecting your data, we'll notify you within 72 hours of confirmed exposure.
9. Children
The Service is not intended for anyone under 18. We don't knowingly collect information from children. If you believe a child has provided us information, email us and we'll delete it.
10. Changes to this policy
We may update this policy. Material changes will be communicated via email and a prominent notice in the dashboard. The “Last updated” date at the top reflects the most recent revision.
11. Contact us
Questions, concerns, or requests? Email bendanzim@gmail.com. We respond to all privacy requests within one business day.
Note: this policy is provided as a starting framework. We recommend brokerages with specific compliance needs review it with their own counsel before relying on it. We'll update it as the platform grows and as legal requirements evolve.