Privacy Policy

Unreal CRM Inc. (“Unreal,” “we,” “us,” or “our”) provides a property intelligence, prospecting, and customer relationship management platform that helps real estate professionals and other businesses research properties, identify owners and other contacts, and manage their outreach. This Privacy Policy explains how we collect, use, disclose, and protect personal information, and the choices and rights available to you.

Privacy at a Glance

1. Scope of This Policy

This Policy applies to personal information we collect:

(a) Visitors and prospects — when you visit www.unrealcrm.com or our other websites (the “Site”), request a demo, subscribe to our newsletter, attend a webinar, or otherwise interact with our marketing;

(b) Customers and Authorized Users — when you or your organization create an account and use our platform at app.unrealcrm.com and related applications (the “Services”), including when you connect a Google or Microsoft account; and

(c) Property Record Individuals — when information about you (for example, as the owner of real property) is included in our property and contact database, which we describe in Section 3.

Information our customers store in the Services. Our customers use the Services to store and manage their own contacts, leads, clients, notes, email templates and campaigns, and call recordings (“Customer Data”). We process Customer Data on our customers’ behalf as a service provider or processor, under our contracts with them, and our customers are responsible for how they collect and use it. If you are a contact of one of our customers and have questions about how that customer uses your information, or if you received a call, voicemail, or email from a business using Unreal, please contact that business directly. We will refer any request we receive about Customer Data to the relevant customer and assist them as required by law. This Policy does not describe our customers’ privacy practices.

Job applicants and personnel. If you apply for a job with us, we will provide you with a separate notice at the time of application describing how we handle applicant information, and that notice applies instead of this Policy.

2. Information We Collect

2.1 Information You Provide to Us

2.2 Information We Collect Automatically

When you use the Site or Services, we and our vendors automatically collect device and usage information, such as IP address, browser and device type, operating system, referring and exit pages, pages viewed, links clicked, features used, search and filter settings, dates and times of access, general location derived from IP address, and error and diagnostic data. We collect this information using cookies, pixels, software development kits, log files, and session recording tools, as described in Section 6.

2.3 Information from Connected Accounts

If you connect a Google or Microsoft account, we access your email, calendar, and contacts through that provider only as needed to provide the features you use. We do not copy or store the contents of your mailbox. What we keep is limited, as described in Section 9.

2.4 Information from Other Sources

We receive information about prospects and customers from business partners, referral sources, event organizers, advertising and social media platforms, and publicly available sources such as brokerage websites and professional networking profiles. Information about Property Record Individuals comes from the sources described in Section 3.

3. Our Property and Contact Database

3.1 What the Database Contains

Our database covers more than 150 million properties in the United States. For each property, it may include the property address, parcel and tax information, physical characteristics, assessed and estimated values, sale and transfer history, recorded mortgages, liens, and other public filings, and the name of the record owner. Where the owner is an individual or can be linked to one (for example, an individual who manages an owning LLC), the database may also include that individual’s name, mailing address, telephone numbers, email addresses, links to professional or social media profiles, business affiliations, other properties associated with the owner, and indicators we or our providers generate, such as the likelihood that a telephone number is current or is a wireless line, or signals that a property may be a candidate for sale.

3.2 Where the Information Comes From

We obtain this information from: (a) public records maintained by county assessors, recorders, and other government offices, which we obtain directly or through licensed aggregators; (b) commercial data providers that license property, ownership, and contact data to us; (c) publicly available sources, such as business entity filings, business websites, and professional networking profiles; and (d) our own and our providers’ automated processes, including artificial intelligence, that match, verify, and enrich records. We do not add Customer Data (such as the contacts our customers upload) to our database.

3.3 How We Use and Disclose It

We make the database available to our business customers — such as real estate agents, brokers, investors, lenders, property managers, insurance and home services providers, and other businesses — so that they can research properties and contact property owners and businesses for property-related and other legitimate business purposes. Our customer agreements permit use only for the purposes they specify, prohibit use for credit, insurance, employment, or tenant screening decisions and for harassment or discrimination, and require customers to comply with telemarketing, do-not-call, and anti-spam laws. Because customers pay us for access, making this information available is a “sale” of personal information under the California Consumer Privacy Act and similar laws. We are not a consumer reporting agency, and our database is not a consumer report.

3.4 Data Broker Laws

Several states, including California, Texas, Oregon, and Vermont, regulate “data brokers,” which generally are businesses that sell personal information about people with whom they do not have a direct relationship. Where those laws apply to Unreal, we will maintain the registrations they require, and registration information will be publicly available from the applicable state agencies.

3.5 How to Remove or Suppress Your Information

If you would like us to remove your personal information from the database or stop making it available to our customers, submit a request at www.unrealcrm.com/privacy-requests or email privacy@unrealcrm.com. You do not need an account. We will ask for information needed to locate your records (such as the property address and the name on title) and to confirm the request is genuine. Once we process your request, we will suppress your personal information from the Services, instruct our customers who have accessed it through Unreal to stop contacting you using it, and keep only the minimum information needed to make sure it stays suppressed. Because public records are updated regularly, we maintain your suppression going forward. California residents may also submit a single deletion request to all registered data brokers through the California Delete Request and Opt-Out Platform (DROP) at privacy.ca.gov.

3.6 If One of Our Customers Contacted You

Our customers decide whom to contact and how. If you want a particular professional to stop contacting you, please tell that professional directly; they are required to honor do-not-call and unsubscribe requests. You can also contact us with the name of the professional, and we will forward your request.

4. How We Use Personal Information

We use personal information to:

• provide, operate, maintain, and support the Site and Services, including creating accounts, processing payments, and delivering the features you request;
• compile, verify, update, and make available our property and contact database, as described in Section 3;
• operate AI Features, such as enrichment, call summaries, drafted messages, and classification of replies to email sent through the Services;
• communicate with you about your account, security, billing, updates, and changes to our terms and policies;
• market our Services, including by email, telephone, and online advertising, subject to your choices;
• understand how the Site and Services are used, diagnose errors, and improve and develop our products;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms, including monitoring for misuse of the database and Outreach Features;
• honor privacy requests and maintain suppression lists; and
• comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We may also create de-identified or aggregated information that does not identify any individual, and we will maintain and use it in de-identified form without attempting to re-identify it.

5. How We Disclose Personal Information

We disclose personal information to the following categories of recipients:

• Our customers. We make Property Record Individuals’ information available to our business customers as described in Section 3. Within a customer account, information you enter may be visible to other Authorized Users of that account according to the account’s settings.
• Service providers. We use vendors that perform services for us, such as cloud hosting, data storage, customer support, payment processing, email delivery, telephony and messaging carriers, analytics, session recording, security, and artificial intelligence model providers. They may use personal information only to perform services for us and are prohibited from using it to train their own models.
• Data providers. We may disclose limited identifiers to our data providers to match, verify, or update records, and to pass along suppression and deletion requests.
• Advertising and analytics partners. We allow advertising partners, such as Meta and Google, to collect information through cookies and pixels on the Site to measure and deliver advertising. This may be a “sale” or “sharing” of personal information, or “targeted advertising,” under state laws. You can opt out as described in Section 12.
• Integration partners. When you connect a third-party service, we exchange information with that service as you direct.
• Legal and safety. We may disclose information when we believe in good faith it is necessary to comply with law, legal process, or a lawful government request; to enforce our agreements; to protect the rights, property, or safety of Unreal, our customers, or others; or to investigate fraud or misuse.
• Corporate transactions. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, including during due diligence, subject to confidentiality obligations, and the information may be transferred to a successor that will be bound by this Policy with respect to it.
• With your consent. We may disclose information for other purposes with your consent or at your direction.

6. Cookies, Pixels, and Session Recording

We and our vendors use cookies, pixels, tags, and similar technologies on the Site and Services. Some are strictly necessary (for example, to keep you signed in and secure the Services). Others help us understand usage and fix problems (analytics and error tracking), remember your preferences, and measure and deliver advertising (such as the Meta Pixel and Google advertising tags). We also use session recording tools that capture how users move through, click, and type within pages of the Site and Services so we can find and fix usability problems and errors. We configure these tools to mask passwords, payment information, and form fields designed to contain sensitive information, and we do not use them in portions of the Services that display Customer Data or Unreal Data confirm. You can manage non-essential cookies through the “Cookie Preferences” link in the footer of our Site, and you can block or delete cookies through your browser settings, although some features may not work without them.

Global Privacy Control. We treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising for that browser and, if we know who you are, for your account. We do not otherwise respond to “Do Not Track” signals.

7. Call Recordings and Transcripts

If a customer uses the Services to record or transcribe calls or generate AI call summaries, those recordings, transcripts, and summaries are Customer Data that we process on the customer’s behalf. Our customers are responsible for providing notice and obtaining consent from call participants where required.

8. Communications from Unreal

If you give us your email address or telephone number (for example, by requesting a demo), we may contact you about our Services. You can unsubscribe from marketing emails using the link in each email. If you consented to receive marketing calls or text messages from us, you can revoke that consent at any time by telling us during a call, replying STOP to a text, or contacting privacy@unrealcrm.com, and we will honor your request within the time required by law. Consent to marketing calls or texts is never a condition of purchase. We may still send you transactional and service messages about your account.

9. Connected Email Accounts (Google and Microsoft)

Users can connect Google or Microsoft email, calendar, and contact accounts to the Services. This section explains exactly what we access and keep.

9.1 How Accounts Are Connected and Protected

• We connect accounts only through Google’s and Microsoft’s OAuth 2.0 authorization. We never receive or store your mailbox password.
• Our access is limited to the permissions you approve, and we reject any permission outside our approved set.
• We encrypt the OAuth refresh token that keeps your account connected using AES-256-GCM, with a unique key for each user that is protected by a cloud provider’s key management service and bound to you. Short-lived access tokens are held only in memory and never written to storage.
• We keep an audit record of every decryption of a stored token, and that record never contains the token itself.
• When you disconnect an account, we send a revocation request to the provider and delete our copy of the token. You can also revoke our access from your Google or Microsoft account settings.

9.2 What We Access and What We Keep

• Your mailbox. We do not copy or store the contents of your mailbox. Messages, calendar events, and contacts are read from the provider only when needed to display them to you or to perform the functions below, and are not saved, except contacts you choose to import into the Services.
• Campaign and sequence email. For email you send through the Services as part of a campaign or sequence, we keep delivery records only: the recipient, message identifiers, delivery status, and open and click counts. Templates and attachments you create for campaigns and sequences are stored as part of your account.
• Bounces and replies. To detect bounces and replies, we read the content of only bounce notices from your provider and replies to email you sent through the Services. For each reply, we keep its identifier, the time it was received, and how it was classified (for example, interested or unsubscribe), and never its subject or body.
• Reply classification. To classify a reply, we send an excerpt of the reply and its subject to an AI service provider solely for that purpose, with quoted history, email addresses, telephone numbers, and links masked. That provider is prohibited from using the excerpt to train its models.
• Scheduled email. Email you schedule for later delivery is stored until it is sent or cancelled. At that point its body and attachments are deleted, and its subject, recipients, and delivery status are kept. If a message fails to deliver, we keep it in full so the failure can be reviewed.

9.3 Google API Limited Use

Unreal’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve user-facing features of the Services. We do not use it for advertising, do not sell it, do not use it to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models, and do not allow humans to read it unless you give us permission for specific messages, it is necessary for security purposes or to comply with law, or it is aggregated and anonymized for internal operations. We apply the same restrictions to Microsoft account data.

10. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, including to comply with legal, tax, and accounting obligations and to resolve disputes. Our general retention periods are:

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, multi-factor authentication for internal access, logging and monitoring, and vendor security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

12. Your Privacy Choices and Rights

12.1 Your Rights

Depending on the state where you live, you may have the right to:

• Know and access the personal information we have about you, and receive a copy in a portable format;
• Correct inaccurate personal information;
• Delete personal information we have about you;
• Opt out of the sale of your personal information, the sharing of your personal information for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling);
• Obtain a list of the specific third parties to which we have disclosed personal information, where your state law provides this right; and
• Appeal our decision on your request.

We provide these rights to all U.S. residents regardless of where you live, subject to verification and to the exceptions allowed by law. For example, we may retain information needed to complete a transaction, comply with law, detect security incidents, or keep your information suppressed.

12.2 Do Not Sell or Share My Personal Information

You can opt out of the sale and sharing of your personal information and of targeted advertising by visiting our Do Not Sell or Share My Personal Information page at www.unrealcrm.com/do-not-sell, by enabling Global Privacy Control in your browser, or by emailing privacy@unrealcrm.com. If you are a Property Record Individual, opting out will remove your personal information from the records we make available to customers.

12.3 How to Submit a Request

You may submit a request by: (a) using our online form at www.unrealcrm.com/privacy-requests; (b) emailing privacy@unrealcrm.com; or (c) calling us at (858) 231-0863. Customers and Authorized Users may also manage much of their information in their account settings.

12.4 Verification and Authorized Agents

We will verify your identity before fulfilling requests to know, access, correct, or delete, by matching information you provide with information we have. We do not need to verify opt-out requests, but may ask for information needed to locate your records. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of your signed permission and may ask you to verify your identity directly, unless the agent holds a valid power of attorney.

12.5 Response Timing and Appeals

We will confirm receipt of your request within ten (10) business days and respond within forty-five (45) days, which we may extend by an additional forty-five (45) days where permitted by law, in which case we will tell you. We process opt-out requests as soon as feasibly possible and within fifteen (15) business days. If we deny your request, you may appeal by replying to our decision or emailing privacy@unrealcrm.com with the subject line “Privacy Appeal.” We will respond to your appeal within the time required by your state’s law, and if we deny it, you may contact your state’s Attorney General.

12.6 No Discrimination

We will not discriminate against you for exercising your privacy rights.

13. Additional Information for California Residents

This section supplements this Policy and applies to California residents under the California Consumer Privacy Act, as amended (“CCPA”). It serves as our notice at collection.

13.1 Categories of Personal Information

In the past twelve (12) months, we have collected the following categories of personal information, from the sources described in Sections 2 and 3, for the purposes described in Section 4:

We do not use or disclose sensitive personal information for any purpose that would give California residents the right to limit its use under the CCPA. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age. Our retention periods are described in Section 10.

13.2 Request Metrics

We will publish information about the number of privacy requests we receive and how we respond to them in this section by July 1 of each year, as required by law.

13.3 Shine the Light

California residents may request information about our disclosure of personal information to third parties for their own direct marketing purposes in the preceding calendar year by emailing privacy@unrealcrm.com with “Shine the Light Request” in the subject line.

14. Additional State Disclosures

Nevada. Nevada residents may submit a request directing us not to sell covered information by emailing privacy@unrealcrm.com.

Other states. Residents of Colorado, Connecticut, Virginia, Oregon, Texas, and other states with comprehensive privacy laws may exercise the rights described in Section 12, including the right to appeal.

15. Children's Privacy

The Site and Services are intended for businesses and adults. We do not knowingly collect personal information from children under 18 through the Site or Services. If you believe a child has provided us with personal information, please contact us and we will delete it. Our property database reflects record ownership of real property and is not directed to children.

16. Users Outside the United States

The Services and our database relate to property in the United States and are intended for use in the United States. If you access the Site from outside the United States, your information will be processed in the United States, where privacy laws may differ from those in your country.

17. Third-Party Sites and Services

The Site and Services may link to or integrate with third-party websites and services that we do not control. Their privacy practices are governed by their own policies.

18. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new “Last Updated” date and, if we make material changes, we will notify customers by email or in the Services and post a prominent notice on the Site before the changes take effect. We will obtain consent where required by law.

19. Contact Us