Privacy Policy

Account information — name, email, role (advisor, investor or tenant), and for advisors a real estate license number, which we check against the Texas Real Estate Commission's public records. If you sign in with Google or LinkedIn, we receive your name, email address and profile photo from that service.

Profile and content — anything you choose to publish: profile details, photos, listings, rent rolls, closed-deal track records, comments, messages, and preferences such as a buyer's buy-box.

Mobile number — the mobile number you add to your account, confirmed with a one-time code, and, if you opt in to text alerts, a record of that consent: the wording you agreed to, when, from what IP address and for which number (section 7).

Tour bookings — when you book a tour of a space: your name, mobile number and email, the space and time you booked, whether you confirmed or cancelled, and whether the advisor recorded that you showed up.

Identity check — if you verify your identity, our provider Persona collects a photo of your government ID and a selfie. We receive only the result and a reference number, never the images (section 8).

Verification documents — documents advisors upload to prove a closed deal or a representation, such as a settlement statement, signed lease or representation agreement. They are stored privately, are never shown to other users, and are read only to confirm what they are meant to prove (section 9).

Payment information — card and bank details are collected and held by Stripe, not by us. We keep the amount, date and status of each payment and payout.

Usage information — standard logs (IP address, device and browser type, pages viewed, actions taken), an anonymous view counter (section 10) and the searches you type, used to keep the service secure and improve it.

Location — if you choose to sort listings by distance, your browser shares your location with the page to do the sorting. It stays in your browser; we do not receive or store it. We do not otherwise collect your device's location.

Information about people who are not users — advisors can add a tenant's or contact's name, email and phone number (to invite them or tag them on a rent roll), start a page for a business from its public Google listing, and publish rent rolls that name tenants, and fetch a business's logo from its website through Google. We do not text or call anyone from that information: invitations go by email, and the only message to a business's listed number is a one-time code someone asks us to send while claiming that page (section 7). We also prepare preview pages for licensed advisors not yet on Dealflix from public professional sources (name, firm, license number, public headline and links). Those pages are not indexed by search engines, and each has a link to remove it. Anyone can ask us to delete information about them at support@dealflix.ai.

To operate the platform: showing broker storefronts and deals, delivering follows/notifications/messages, verifying broker licenses, processing payments through our payment provider, preventing abuse, and improving the product. We send transactional email (and marketing email you can opt out of). We use your mobile number only to text you verification codes you ask for and the alerts you opt in to (section 7) — never for marketing. We use an identity check only to confirm a real person is behind an account. Content advisors publish publicly — listings, profiles, requirements — may also appear on our own pages and in our marketing, as the Terms of Service allow.

Tours. We use tour bookings to schedule the tour with the advisor, put it on the advisor's connected calendar, and email you a confirmation and reminders. Each tenant's page shows two numbers to everyone: how many tours they have booked and the share they showed up to. It never shows which spaces they toured or with which advisor; that stays with the advisor who hosted each tour.

You can optionally connect outside accounts. There are two kinds of connection, and they work differently.

Imports (Airtable, Google Sheets). You can connect your own Airtable or Google account to import data — for example pulling a rent roll from one of your Airtable bases into a deal instead of retyping it. You authorize these explicitly on the provider's own consent screen (OAuth). For Google we can open only the spreadsheets you pick, and we never change them. Maria can read those same sheets when you ask her about one: she never sees their phone or email columns, which are removed before anything is sent to our AI provider. She reads a sheet only when you ask, and keeps only the rows shown beside her answer, in that chat; deleting the chat deletes them. For Airtable we ask to read your records and base schema and to write records: when a deal's rent roll is synced from an Airtable table, saving or publishing the deal (or pressing Save to Airtable) writes your rent-roll edits and new suites back to that same table. We only update and add records in the table the roll came from, we never delete anything, and we skip a record that changed in Airtable since your last sync rather than overwrite it. We fetch data only when you sync or save. The rows you import become part of the deal you attached them to, where you can review and edit them before publishing.

Calendar (Google Calendar). Advisors who turn on tour booking connect their calendar so tenants can book open times. The same connection lets Maria, the advisor's assistant, answer questions about their schedule and suggest open times. For this connection:

· What we can see: whether you are busy or free at a given time, for your tour link. If you allow it on Google's screen, Maria can also see the title, time and location of your events, so she can tell you what is on your schedule. We never read your events' guests, descriptions, attachments or meeting links.
· What we change: we add an event for each tour booked through your tour link, and update or cancel that event if the booking changes. In Maria, we add an event only when you tap Add on one she suggests. We never edit or delete an event we did not create.
· When: automatically, not only when you click something. We check your busy times when someone opens your tour link or books a time, and write to your calendar when a tour is booked, moved or cancelled. Maria reads your calendar only when you ask her about your schedule; to write that answer, the busy times, or the event titles, times and locations, are sent to our AI provider, which does not keep them or train on them.
· What we keep: the access tokens your calendar provider gives us, and the identifiers of the tour events we created. We do not copy or store your other events; busy times and event details are used for that answer or check and then discarded.
· What we never do: sell your calendar data, use it for advertising, share it with anyone else, or use it to train AI models. Our staff do not look at it unless you ask us to, it is needed to investigate abuse or a security problem, or the law requires it.

Google Tasks. Advisors can connect Google Tasks so Maria can tell them what follow-ups are open and suggest new ones. We can see the title and due date of your open tasks, never their notes, and only when you ask Maria about them; to write that answer they are sent to our AI provider, which does not keep them or train on them. We add a task only when you tap Add on one Maria suggests, and we never edit, complete or delete a task. We keep the access tokens Google gives us and nothing else; disconnecting deletes them and tells Google to end our access.

Dealflix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Access tokens are stored server-side for every connection, are never exposed to other users or to the browser, and are used only for the feature you connected them for.

You can disconnect at any time from Dealflix, or by removing Dealflix in your Airtable or Google account settings. Disconnecting deletes our stored tokens for that service. Data you already imported into a deal stays with that deal until you edit or delete it. After you disconnect a calendar, your tour link offers your weekly hours alone, and tour events already on your calendar stay there until you delete them.

Other users. Content you publish is visible according to its audience (public deals are public; private deals are gated). When you message an advisor, request access to a deal or post a space requirement, the people you are contacting see your name, profile and what you sent. When you are signed in and open a deal or watch a story, the advisor who posted it can see that you viewed it, under your name.

When you book a tour, the advisor you booked with sees your name, mobile number, email and the booking, and we add the tour, with your name and mobile number, to the calendar the advisor connected. That calendar is held by Google under the advisor's own account.

Service providers. These companies run parts of the platform for us, process data only on our instructions, and are not allowed to use it for their own purposes:

· Vercel and Supabase — hosting, database and file storage.
· Stripe — payments, advisor payouts, fraud prevention and the identity and bank checks payouts require.
· Persona — identity checks (section 8).
· Resend — email delivery.
· Twilio — text messages and phone-number verification.
· Google — maps, address search, and Google sign-in, Sheets import and Google Calendar if you use them.
· LinkedIn — sign-in, if you use it.
· Anthropic and OpenAI — the automated checks, searches and Maria described in section 9, under commercial terms that do not allow them to train their models on what we send.
· GrowSurf — our advisor referral program; it receives an advisor's name and email at signup.
· Slack — internal alerts to our team, for example a new advisor's name, email and license number when they apply.
· Maps and address search — Komoot (Photon) and OpenStreetMap services, the U.S. Census geocoder, Esri, CARTO, MapTiler and the USGS National Map. They receive addresses and map locations, and your browser's IP address when it loads a map or searches an address. Address search sends what you type as you type it.
· Spotify — if an advisor adds a song to their profile, Spotify's player loads on that profile page and Spotify may set its own cookies.

Legal reasons and business transfers. We disclose information when the law requires it, or to protect the rights and safety of our users or Dealflix. If Dealflix is merged, acquired or sells its assets, your information may transfer to the new owner under this policy. We do not sell personal information.

All of the above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties. Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes.

We keep your data while your account is active. You can delete your content, disconnect connected services, or delete your account (tenants can do this in Settings; advisors and investors ask us, so listings, requests and payouts are wound down properly) — email support@dealflix.ai. After a deletion request we work to these periods:

· Account, profile and published content — deleted when the deletion runs. Deleting an account removes everything attached to it in our database at once: your profile, listings and content, your conversations (the other person loses the thread too), executed NDAs on your deals, your payment history in Dealflix, and your consent and attestation records. Most files go at the same time; any that remain in storage are removed within 30 days.
· Payment records — kept by Stripe. Stripe keeps the charges, payouts and tax figures it processed, as the law requires it to, after we delete our copy.
· Backups — 90 days. Backups roll off on their own schedule; deleted data is not restored from them.
· While your account is open: records of what you agreed to (terms acceptances, text-alert opt-ins, photo and listing attestations, with the time and IP address) are kept as our proof of your consent. Verification documents are kept while the deal they prove is on Dealflix; ask us to delete them once it is not. Security and activity logs are kept while needed to secure the platform and investigate misuse.
· Identity-check images — deleted by Persona within one year of the check. We keep only the result.

We may also keep what we need to resolve a dispute, enforce our agreements, or comply with the law, for as long as that reason lasts.

Data is encrypted in transit, access to production systems is restricted, and per-user authorization rules (row-level security) gate every read and write in our database. No system is perfectly secure — if we learn of a breach affecting your personal data we will notify you without unreasonable delay and in any event within 60 days of determining a breach occurred, and, where a breach affects 250 or more Texas residents, the Texas Attorney General within 30 days, as Texas law requires.

Verification codes. When you sign up or add a mobile number, we text a one-time code to confirm the number is yours. Asking for a code does not sign you up to anything else. When someone claims a business page, they can ask us to send a one-time code to that business's publicly listed number, to show they answer at that business: a single message, or an automated voice call reading the code if the line is a landline, which is why we check the line type first. We send it only when it is requested, never follow it with marketing, and it never enrolls anyone in Dealflix Alerts (see the SMS Terms). Codes are sent through Twilio Verify, not through the Dealflix Alerts program.

Dealflix Alerts — only if you switch them on. Text alerts are a separate, optional choice: an unticked box when you sign up, or switches in Settings. Advisors can choose texts about their listings, access requests, review outcomes and pitches; tenants can choose a text when an advisor replies to them. Saying no never affects your account. When you switch alerts on, we record the exact wording you agreed to, when, and the number it covers, and we text you a confirmation.

Message frequency varies with your activity — usually a few texts a week, never more than 12 in a day. Message and data rates may apply. We do not send marketing or promotional texts.

Reply STOP to any text to cancel, or switch alerts off in Settings. Reply HELP for help, or email support@dealflix.ai. Full program terms are in our SMS Terms & Conditions.

Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your number is used only to send the codes and alerts described here, through our messaging provider (Twilio).

Some actions on Dealflix require confirming that a real person is behind an account. That check is run by Persona: you photograph your government ID and take a selfie, and Persona compares the two using facial geometry. Texas law treats that measurement as a biometric identifier.

We ask first. The screen that starts the check says what it does, and nothing is captured unless you choose to continue. You can decline; the only effect is that the actions which require a check stay unavailable.

We never receive it. Persona keeps the images and the facial-geometry data; Dealflix receives only whether the check passed and a reference number. Persona deletes the images and biometric data within one year of the check. We do not sell, lease or disclose them, and Persona processes them only to run the check for us.

We use AI models from Anthropic and OpenAI for four narrow jobs:

· Checking closed-deal figures. When an advisor posts a priced comp, the verification documents they uploaded are read to confirm they support the figures. A comp that does not pass is held for a person to review; nothing is published or removed on the model's word alone.
· Reading searches. When a search sentence matches nothing our own rules understand, the text is sent to a model to work out what you are looking for.
· Aerial illustrations. An aerial photo of a listed property is turned into an illustration, and photos advisors upload as aerials are checked to make sure they are not screenshots of a map service.
· Maria, the advisor's assistant. When an advisor asks Maria a question, what she reads to answer it is sent to Anthropic: public listings and requirements, the advisor's own deals, and, if the advisor connected a calendar, their busy and free times and, if they allowed it, their events' titles, times and locations, and, if they connected Google Tasks, their open tasks' titles and due dates, and, if they shared Google Sheets, the rows of the sheet they asked about, without its phone or email columns. She never reads anyone's earnings, messages or contact details, and she drafts but never sends or books anything without the advisor's tap.

None of these make decisions about you with legal or similarly significant effects, and none of them are used to profile you or target advertising.

Our own cookies are the ones the site needs: your sign-in session; short-lived security cookies (about ten minutes) while you connect Google, Airtable or a calendar; a 30-day cookie remembering which advisor referred you, if you arrived through a referral link; and an anonymous view-counter cookie (up to two years) so a page view is counted once per browser. We also keep drafts and small preferences in your browser's local storage. Blocking these cookies will break signing in.

Other companies' code. Pages with payment features load Stripe's script, which Stripe uses for fraud prevention and may set its own cookies. Maps load from Google, CARTO, MapTiler or Esri. An advisor's profile with a song on it loads Spotify's player, which may set Spotify cookies. YouTube (privacy-enhanced mode) and Vimeo (do-not-track mode) videos load only after you press play.

We do not use advertising cookies, analytics or session-recording services, or tracking pixels, and we do not track you across other websites or let others do so through Dealflix for advertising.

Do Not Track and Global Privacy Control. Because we do not sell personal information, share it for cross-context advertising or track you across sites, there is nothing for these browser signals to switch off; we do not change how the site works when we receive them.

Texas residents have rights under the Texas Data Privacy and Security Act, and we extend the same rights to everyone who uses Dealflix regardless of where they live. You may ask us to:

· confirm whether we process your personal data, and give you a copy of it;
· correct data that is wrong;
· delete data we hold about you;
· provide it in a portable, machine-readable form; and
· opt out of targeted advertising, the sale of personal data, or profiling with legal effects — none of which we do today.

Ask by emailing support@dealflix.ai. We respond within 45 days, and may extend once by another 45 days where a request is complex, telling you why. We may need to verify who you are before acting — usually by confirming control of the account email.

If we refuse a request, you may appeal by replying to our decision. We will decide the appeal within 60 days and explain the reasoning in writing. If we deny the appeal, you may complain to the Texas Attorney General.

We do not sell personal data as that term is defined in Texas or California law, and we do not process it for targeted advertising.

This section gives California residents the disclosures California law asks of websites that collect their information.

What we collect, from where, and why is described in sections 1 and 2; who receives it is in section 4. You can review and correct most of your information in your account settings, or ask us at support@dealflix.ai. We tell you about changes to this policy as described in section 15.

No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act, and we have not done so in the past twelve months. We do not disclose personal information to third parties for their own direct marketing (California Civil Code §1798.83); you may ask us about this at support@dealflix.ai.

Your rights. We extend the rights in section 11 — to know, access, correct, delete and port your information — to California residents, and we will not treat you differently for using them. You may use an authorized agent; we may ask the agent for your signed permission and confirm your identity with you. Our use of sensitive information (the identity check in section 8) is limited to verifying who you are.

Residents of other states with consumer privacy laws, including Colorado, Connecticut, Virginia, Utah and Oregon, may make the same requests in the same way.

Dealflix is operated from the United States and intended for users in the United States. Our brokers are licensed in Texas and the deals here are Texas commercial real estate. We do not target the service at people in the European Economic Area or the United Kingdom, and it is not designed for the data protection regimes that apply there.

If you use Dealflix from outside the United States, you are sending your data to be processed in the United States.

Dealflix is a business platform for licensed brokers and the people who buy from them. It is not for anyone under 18, we do not knowingly collect data from children, and we delete such data if we discover it.

We may update this policy as the product evolves. Changes are posted here with an updated date, and material changes are also emailed to account holders before they take effect.

Questions, or a request under section 11? support@dealflix.ai, or write to Dealflix LLC, 11311 Fuqua St, Houston, TX 77089. Dealflix LLC is the controller of the personal data described here.