Privacy Policy

This Privacy Policy explains how Footfallz ("Company," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use the Footfallz platform, including the website, mobile application, and askKeys AI chatbot (collectively, the "Services") as a licensed real estate agent or broker ("Realtor," "you," or "your").

By creating an account or using the Services, you consent to the practices described in this Privacy Policy. This policy should be read alongside our Realtor Terms of Use.

1. Information We Collect

2. How We Use Your Information

3. AI and Third-Party Processing

We take the following steps to limit your data exposure during AI processing:

• Sending only chat message content to AI providers — not your license number, brokerage details, or client data
• Storing all chat logs on our own secure servers
• We may change or add AI providers at any time to improve service quality

Important: We send requests only to AI providers whose terms or account settings prevent them from training on, or retaining, the data we send. On OpenRouter, we turn off providers that may train on inputs and enable Zero Data Retention. On the OpenAI API, inputs and outputs are not used for training. Our current models are from OpenAI (gpt-5.6-luna, gpt-4o-mini, gpt-3.5-turbo, text-embedding-ada-002), Google (gemini-2.5-flash-lite), and Qwen (qwen3-235b). Google user data is handled only as described in Section 4. We encourage you to review the privacy policies of OpenAI, Anthropic, and OpenRouter for details on how each provider handles data submitted via their APIs.

4. Google User Data

If you connect your Google Calendar, we request the following permissions:

• calendar.freebusy: to check when you are busy. We do not read event titles, descriptions, locations, or attendees.
• calendar.events: to create, update, and remove showing events on your calendar.
• calendar.calendarlist.readonly: to let you choose which calendars are checked for availability.

AI use: Calendar event details are never sent to any AI model. The askKeys assistant receives only open showing times, calculated from your availability and free/busy data. These are sent to OpenAI's model through OpenRouter, solely to answer the buyer in that conversation. Google user data, including derived or anonymized forms, is never used to train any AI or machine-learning model, and is never sent to a provider that may train on it.

Sharing: We do not sell Google user data or use it for advertising. We share it only to provide these features, to comply with law, or in connection with a merger or acquisition, with notice to you.

Storage and deletion: We store your Google connection (refresh token, email, granted permissions, and selected calendars). Short-lived access tokens are kept only in temporary memory until they expire (about one hour). Free/busy results are kept in temporary memory for 10 seconds and then discarded; they are never saved to our database. When you disconnect, we immediately delete your stored Google connection (refresh token, email, permissions, and calendar choices). The Google event IDs on your showing records are deleted when that showing or your Footfallz account is deleted. You can disconnect in your settings or revoke access at any time from your Google Account permissions page.

Limited Use: Footfallz's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Automated Profiling of Buyers

When buyers interact with askKeys through your open houses, listings, or direct invitations, our platform may perform automated processing of buyer-provided information to support your real estate services. This processing may include:

• Extracting housing preferences, location priorities, and property characteristics of interest from buyer conversations
• Inferring housing price-range signals and purchase readiness indicators based on buyer messages
• Inferring household-related preferences (such as family size or lifestyle needs) where reflected in buyer conversations
• Classifying buyer intent (for example, actively searching, casually browsing, or exploring a future move)

These automated inferences are used solely to personalize property recommendations and help you better understand your buyers' needs. They are not used to make legally significant decisions about individuals, such as determining eligibility for housing, credit, insurance, or financial services.

You are responsible for ensuring that any actions you take based on buyer profiles comply with the Fair Housing Act, RESPA, and all applicable laws. Footfallz processes buyer data for profiling purposes as a technology service provider supporting your use of the platform.

6. How Your Information Is Shared

We do not sell or share your personal information for cross-context behavioral advertising. If you have questions about this or wish to submit a request, email privacy@footfallz.com.

7. Your Responsibilities for Buyer Data

As a Realtor receiving buyer data through Footfallz, you must:

• Use buyer data solely for the purpose of providing real estate services related to their inquiry
• Not sell, rent, or share buyer data with third parties without the buyer's explicit consent
• Not add buyer contact information to unsolicited marketing lists without consent
• Comply with CAN-SPAM and TCPA when communicating with buyers
• Respond to buyer data deletion requests in a timely manner
• Maintain reasonable security measures to protect buyer data in your possession
• Delete or anonymize buyer data when it is no longer needed for the purpose it was shared

Footfallz is not responsible for your handling of buyer data after it has been shared with you. Violations of data handling obligations may result in suspension or termination of your account.

8. Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your own personal information held by Footfallz:

• Right to Know: Request what personal data we hold about you
• Right to Delete: Request deletion of your personal data (subject to legal retention requirements)
• Right to Correct: Request correction of inaccurate information
• Right to Opt Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. We do not sell or share your personal information as defined by CCPA/CPRA. To submit a request or ask any questions, email privacy@footfallz.com.
• Right to Data Portability: Request a copy of your personal information in a portable, structured, commonly used, machine-readable format that you can transmit to another organization
• Right to Non-Discrimination: We will not treat you differently for exercising your rights

These rights are available under CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), and other state privacy laws.

To exercise your rights: Email privacy@footfallz.com. We will acknowledge receipt of your request within 10 business days and provide a substantive response within 45 calendar days. If we need additional time (up to 45 more days), we will notify you of the extension and the reason before the initial 45-day period expires.

Note: Deleting your account will remove your profile from the platform, but we may retain certain information as required by law or for legitimate business purposes (e.g., transaction records, compliance logs).

9. Cookies and Tracking

You can manage cookies through your browser settings. Our service does not currently respond to "Do Not Track" browser signals. However, we recognize and honor Global Privacy Control (GPC) signals as required by applicable state law. When we detect a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information associated with that browser.

10. Data Security

We protect your personal information with encryption in transit (TLS/SSL) and at rest, role-based access controls, regular security assessments and penetration testing, secure cloud infrastructure with industry-standard certifications, and password hashing with multi-factor authentication options. No system is 100% secure, but we use commercially reasonable safeguards.

11. Data Retention

12. Data Breach Notification

If we discover a security breach that results in the unauthorized access, acquisition, or disclosure of your personal information, we will:

• Notify affected individuals in the most expedient manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement
• Notify the California Attorney General if the breach affects more than 500 California residents
• Notify other applicable state regulators within the timeframes required by their respective state laws (typically within 30–90 days of discovery)
• Provide you with information about what happened, what data was involved, what steps we are taking, and what steps you can take to protect yourself

If you believe your information has been compromised, please contact us immediately at privacy@footfallz.com.

13. Children's Privacy

The Services are not intended for anyone under the age of 18. We do not knowingly collect personal information from minors.

14. California-Specific Disclosures

If you are a California resident, the following additional disclosures apply under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Categories of personal information collected in the past 12 months: identifiers (name, email, phone number, business address, license number, IP address), professional information (brokerage affiliation, service areas, bio, headshot), account credentials (username; password stored encrypted), internet or other electronic network activity (usage data, chatbot session logs, login times), commercial information (payment and billing records, if applicable), buyer interaction data (lead records, response times, communication history), and inferences drawn from personal information (buyer profiles used to support your real estate services).

Purposes for collection: to operate your Footfallz account, verify your real estate license, match you with buyers, power askKeys AI features, process payments, communicate with you, and comply with applicable laws and professional regulations.

Categories disclosed to third parties: identifiers and professional information are displayed publicly to buyers on the platform. Chat message content is transmitted to AI providers (OpenAI, Anthropic, OpenRouter). License numbers are displayed publicly on your profile. Identifiers and usage data are shared with service providers (hosting, analytics, email, payment processing).

We do not sell or share your personal information for cross-context behavioral advertising as defined by CCPA/CPRA. Because we do not engage in these activities, a formal opt-out page is not required. If you have questions or wish to submit a request, email privacy@footfallz.com.

Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about the disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the platform at least 15 days before they take effect. Continued use after the effective date constitutes acceptance.

16. Contact Us

Questions about this Privacy Policy or your data?