Privacy Policy

Synclarion ("we", "us") is built for licensed real estate agents. This Privacy Policy explains what information we collect when you use the platform, how we use it, who we share it with, and the choices you have.

1. Information we collect

We collect the following categories of information:

• Account information — your name, email address, brokerage, license number, time zone, and any contact details you choose to add to your profile.
• Transaction data — property addresses, sale prices, parties (buyer / seller / lender / escrow / listing agent), key dates and deadlines, checklist items, deal notes, and any documents you upload.
• Contact & CRM data — names, emails, phone numbers, tags, notes, and the relationships you record between contacts and transactions. When you import contacts from a file, Synclarion keeps the file's rows so you can review them before saving; see Data retention.
• Google data — when you connect your Google account, you give Synclarion access to your Gmail and your Google Calendar, and to the Google Drive folders and files Synclarion itself creates — not the rest of your Drive. Synclarion uses it to show and sort your mail, send the emails you write, show your calendar and put your transactions' dates, tasks and appointments on it, and keep a copy of each transaction's documents in its folder in your Drive. No person at Synclarion reads your mail in the ordinary course of running the product. Synclarion's software reads the headers of your mail — sender, recipients, subject, date — to sort threads onto your transactions when you open your Emails page or a file's Emails tab. Claire, Synclarion's AI, reads your mail when you ask her to in chat; each morning, if you receive the morning briefing, she reads the subject and sender of your most recent threads; and when you run the contact scan on your Today page, she reads the messages it scans. What Synclarion keeps: the header of every message in a connected mailbox (sender, recipients, subject, date, labels and a one-line preview), and a full copy, with attachments, of every email that belongs to one of your transactions. The rest of your mail is read from your mailbox when you open it and is not stored. The only exceptions to the first sentence are the ones Google's policy allows: a security investigation, a legal obligation, or your own request. Synclarion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Sign-in records — the IP address and browser of each sign-in, kept by Supabase, our sign-in provider, with your session and in its security logs, to protect your account. To slow password guessing, Synclarion also counts sign-in attempts using a scrambled form of your email and IP address that can't be turned back into either, and clears those counts within a day.
• Claire interactions — the messages you send to Claire and the responses she generates, plus the actions she takes on your behalf (notes created, contacts added, emails drafted). We retain these so you can review past conversations.
• Usage telemetry — page views, feature usage, error logs, and session replays with the screen's words hidden (see PostHog and Sentry below). We use this to improve the product and to debug issues.

2. How we use your information

• To run the core product — show your transactions, contacts, calendar, compliance checklist, deadlines, and morning briefing.
• To process your messages with Claire (our AI assistant). Your transaction and contact context is sent to Anthropic's Claude API as part of the prompt so Claire can answer questions about your deals. See "Third-party services" below.
• To send transactional email — confirmations, password reset, calendar reminders, and emails you explicitly draft and send through Synclarion.
• To compute compliance signals (e.g. missing forms, expiring agreements) and surface them in your dashboard.
• To improve the product — debug issues, measure feature adoption, prioritise roadmap. We do not sell your data. Synclarion doesn't use your data or your conversations with Claire to train AI models.

3. Third-party services

Synclarion is built on top of trusted infrastructure providers. The data each provider sees is limited to what is necessary for the listed function:

• Supabase — our database, authentication, storage, and row-level-security backbone. All transactional data lives in a Supabase Postgres database hosted in the US, scoped per agent by RLS.
• Anthropic (Claude API) — powers Claire. When you chat with Claire, your message and a context snippet (transaction details, recent emails, etc.) are sent to Anthropic's API. When you import contacts, Synclarion sends Anthropic your file's column names, the format of a few entries (for example, “looks like a phone number”) but never the entries themselves, and each contact's type, tag and status words, to match columns and suggest contact types. Names, emails and phone numbers are not sent.
• Google (Calendar, Gmail, Drive APIs) — only invoked for agents who have explicitly connected their Google account through OAuth. Tokens are stored encrypted at rest in Supabase.
• Resend — sends the email that comes from Synclarion itself: sign-in and password emails, the morning briefing and its reminders, team invitations, feedback you send us, and requests from the early-access form on our home page. Resend sees the recipient and the message for the emails it sends only. Emails you write to clients are sent from your own connected Gmail account, through Google.
• Vercel — hosting, edge network, and runtime logs.
• Cloudflare (R2 storage) — a backup copy of the documents and pictures you upload, kept in a separate storage account so a file can be recovered if it's lost. Copies are encrypted at rest, and a deleted or replaced file's copy is gone within 7 days. Email attachments aren't copied.
• PostHog — product usage analytics: which pages and features are used, where people stop and who comes back, with you identified by your name and email. It also records a replay of each signed-in session: the layout of each page, scrolling and clicks. Every word on the screen and everything you type is hidden, emails, documents and pictures are blocked out, web addresses are trimmed, and nothing the app sends or receives behind the screen is recorded.
• Sentry — error reports, so we can fix what breaks. A report includes your account id and email. When an error happens, Sentry also keeps a replay of the moments around it, with every word on the screen and everything you type hidden and pictures blocked out. Passwords, tokens and sign-in cookies are removed before a report leaves the app. Neither keeps your IP address or location.
• RentCast — property data. When you fetch a property's details, its address is sent to RentCast.
• Google Maps — addresses and maps, such as address suggestions as you type.

4. Data retention

Account, transaction, contact, and Claire-conversation data is retained while your account is active. Closed transactions stay in your archive unless you delete them. To delete your account, go to Account → Security → Delete my account. You can download a copy of your data first. Your account is locked right away, and the deletion happens 7 days later. Until then you can cancel, either from the email we send you or by signing in. After 7 days, everything you created in Synclarion is deleted: your transactions, documents, contacts, notes, Claire conversations, settings and your login. Your Google connection is also removed. Nothing in your own Gmail, Google Calendar or Google Drive is touched, including the copies Synclarion saved to your Drive. If you're on a team, the records you shared with the team stay with the team's Account Owner. Our record of who opened client data is kept for one year with your name removed. Backups are kept for 7 days, after which deleted data is gone from them too.

Synclarion saves a record of the calendar events it creates for you, so it can update or remove them. It doesn't copy the rest of your calendar. Email headers are kept while the mailbox is connected and refreshed from it; copies filed to a transaction stay with that transaction's record after you disconnect your email account; remove an email from a transaction and its copy is deleted; delete your Synclarion account and every header and copy is deleted with it. Email content read for contact-suggestion scanning is processed in memory and not stored beyond the suggestion record itself (sender, signature snippet, deal-match address).

Contact imports: when you import a file, its rows are kept so you can review them before saving; their original values are cleared 30 days after the import is saved, an import you never save is deleted after 30 days, and the contacts you save stay with your account like any other. If you use “Let us do it” to send us a contacts file, it is kept in private storage that only Synclarion support can open, and support opens it only to prepare your import. Every opening is logged. The file is deleted once it is imported or after 30 days, whichever comes first, and when you delete your account.

5. Your rights

You can:

• Access and edit any data on your account directly inside Synclarion.
• You can disconnect Google anytime in Settings → Email. That stops Synclarion's access.
• Download your data any time in Account → Security → Download my data. You get spreadsheets of your transactions, closed files, opportunities, prospects, contacts and notes, plus every document you uploaded.
• Delete your account in Account → Security → Delete my account. It happens after 7 days, and you can cancel any time before then.

California residents have additional rights under the CCPA — including the right to know what data we have, the right to delete, and the right to opt out of sale (Synclarion does not sell personal data).

6. Security

All connections to Synclarion are TLS-encrypted. Data at rest is encrypted by Supabase. Your Google sign-in tokens are encrypted before they are saved, in a table only your account can read. We do not have a SOC 2 audit yet (we are in private beta); this is on the roadmap.

7. Children

Synclarion is intended for licensed real estate professionals. We do not knowingly collect data from anyone under 18.

8. Changes

If we make a meaningful change to how we handle your data, we'll email you before it takes effect and update the date at the top of this page.

9. Contact

Privacy questions or data requests: legal@synclarion.ai