Privacy Policy
Effective 4 September 2026. BrokerDIY is an AI operating system for real-estate brokerages, operated by BrokerDIY LLC, a Wyoming limited liability company with its principal place of business in the State of Florida (“BrokerDIY”, “we”, “us”). This policy explains what we do with information, and it forms part of our Terms of Use.
1. Two different kinds of information, and two different roles
Almost every confusing privacy policy is confusing because it mixes these up. Ours keeps them apart.
- Information we decide about. What we collect from visitors to this website, from people who join the waitlist, and from the people who administer an account with us — names, emails, billing details, support conversations, usage logs. For this we are the controller (the “business”, in California’s language). This policy governs it.
- Information a brokerage puts into the platform. Transactions, documents, templates, contacts and messages, including information about that brokerage’s clients, who are buyers, sellers and co-operating agents. We hold this on the brokerage’s behalf and on their instructions. For this we are a processor (a “service provider”), and the brokerage is the controller. We do not decide what goes in, and we do not use it for our own purposes beyond running, securing and supporting the service for them.
If you are a client of a brokerage that uses BrokerDIY and you want to see, correct or delete your information, ask that brokerage — they hold the relationship and the decision. Tell us and we will help them do it, but we will not act on their data without them.
2. If you visit this website
Our web host records ordinary server logs — IP address, browser, pages requested, timestamps — which we use to keep the site up and to stop abuse.
Analytics cookies are off until you say otherwise. We use Google Analytics on this marketing website to understand which pages people find useful, and it is denied by default on every visit: no analytics cookie is set and no analytics data is sent unless you accept it on the banner. We have not enabled Google’s advertising or audience-signal features, we run no advertising pixels here, and we disclose website data to nobody for advertising.
You can change your mind at any time: open your cookie choices. You may also opt out of Google Analytics everywhere with Google’s browser add-on. The site loads fonts from Google Fonts, which means Google receives that request; that is not a cookie and not analytics.
Strictly necessary cookies — the ones that keep you signed in and keep the site secure — are not covered by the banner, because the service cannot work without them.
Global Privacy Control. If your browser sends a GPC or equivalent opt-out signal, we treat it as a valid request to opt out of any sale or sharing of your personal information, and we honour it automatically without asking you to do anything else — the cookie banner records a decline for you and does not appear.
3. If you join the waitlist
We collect the name, email address, and optional brokerage name you submit, along with basic technical data such as your IP address and browser, to manage the waitlist and reduce spam. We use it only to contact you about BrokerDIY. You can ask us to remove your details at any time by replying to any email we send you, and every marketing email carries an unsubscribe link.
4. If your brokerage uses the platform
The platform holds what you put into it: your transactions, documents, templates, contacts and messages. Some of that is information about your clients, which you are entrusting to us on their behalf. We treat it that way.
- Your data is isolated to your brokerage. It is not pooled with other tenants, and what happens inside your brokerage never trains another brokerage’s system.
- We do not sell it. Not your data, and not your clients’ data. We have not sold or shared personal information in the preceding twelve months, and we do not sell or share the personal information of anyone we know to be under 16.
- We use it to run, secure, support and improve the service — diagnosing faults, preventing abuse, and making the product work. Where “improving” means learning across customers, it happens only through aggregate, de-identified information, described in section 9.
- Signed documents are delivered as they are executed. Every completed signing emails the certified PDF at the moment it is signed, so you hold a copy independently of us from day one, and it verifies without a BrokerDIY account.
- Our staff access your account only to support you. Access is granted by you, limited to the purpose, logged, and revoked when the work is done.
5. What we collect, why, and who we give it to
This is the disclosure California, and now a dozen other states, require. It covers information we control — it is not a list of what is inside your brokerage’s account.
| Category | Examples | Where it comes from | Why we have it | Who we disclose it to |
|---|---|---|---|---|
| Identifiers | Name, email, phone, brokerage name, account ID, IP address | You; your brokerage’s administrator | Create and run your account, support, security, billing, service notices | Hosting, email delivery, payment processing |
| Commercial information | Plan, subscription history, invoices, usage of BrokerDIY Actions | You; generated by the platform | Billing, allowance metering, fraud prevention, support | Payment processing, hosting |
| Internet activity | Pages viewed, features used, log and diagnostic data | Generated automatically | Keep the service working, debug faults, prevent abuse, measure product use | Hosting, analytics (website only) |
| Audio and electronic information | Call recordings and transcripts where a feature records them, messages sent through the platform | You and the people you communicate with | Deliver the calling, messaging and assistant features you switched on | Telephony, AI processing |
| Professional information | Licence details, role, team membership | You | Set permissions and run brokerage workflows | Hosting |
| Financial identifiers | Payment card details | You, entered directly with our payment processor | Take payment | Payment processing only — we never see or store your full card number |
| Inferences | Product suggestions and summaries the platform generates | Derived from the above | Provide the AI features | AI processing |
We disclose these categories only to the service providers listed in our sub-processor list, for the business purposes above and under contracts that forbid them using it for anything else. We also disclose information where the law requires it, to protect rights and safety, and to a buyer or successor if the business is sold, in which case this policy continues to apply until you are told otherwise.
Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it beyond the purposes for which a right to limit does not apply.
6. Service providers we share data with
Running the platform means using other companies: hosting, email delivery, telephony and SMS, payments, and the AI providers behind our voice agents and assistants. Where those providers process information on our behalf they are bound by contract to use it only to provide their service to us, and never for their own purposes or to train their own general models on your content.
We publish the list. It is at brokerdiy.com/sub-processors, it names every provider and what each one does, and we update it before we add one. You do not have to ask.
Separately, you may connect the platform to services you choose: a CRM, a calendar, an MLS or IDX feed, an advertising account. Those are your relationships under their own terms, they are not our sub-processors, and what they do with data you send them is between you and them.
7. Advertising and marketing services
If you buy our advertising or lead-generation services, we act as your agent to run campaigns on platforms such as Google, Meta and similar networks, under their terms. We keep and use the performance data those campaigns generate — which creative, audience, placement, budget and timing produced which result — to run your campaigns and to improve campaign performance across the platform. That performance data is ours as the operator of the campaigns. It is not your client list, and we do not need your contacts to do it.
8. Calls, texts and email you send through the platform
The platform can call, text and email on your behalf. Those messages are yours: you decide who receives them, you hold the consent that makes them lawful, and you are responsible for that under section 4 of the Terms. We process the numbers and addresses you give us in order to deliver the messages, and we keep delivery records. Where a call is recorded, you are responsible for the notice and consent the jurisdiction requires. We do not use your recipient lists to market anything of ours.
9. Aggregate and de-identified information
We keep and use aggregate, de-identified and statistical information derived from use of the platform — for example how long a document typically takes to sign, how many documents a transaction needs, or how a campaign type performs in a market. This information carries no names, no addresses, no document contents and no client information, it is not attributed to any brokerage, and it cannot be turned back into your records. We may use it to operate, improve and develop our products, to train and evaluate our own systems, and to produce industry benchmarks and reports. We maintain it in de-identified form, do not attempt to re-identify it, and require the same by contract of anyone we give it to. This right survives the end of your account. Everything that identifies you or your clients is deleted on the schedule below.
10. What we do not do
- We do not sell your personal information, or your clients’ personal information, for money or anything else of value.
- We do not share it for cross-context behavioural advertising.
- We do not use one brokerage’s data to train systems that serve another brokerage.
- We do not let our AI providers train their general models on your content.
- We do not keep a former customer’s files after the window in section 11 closes.
11. How long we keep it, and when we delete it
While your account is active, we keep your data so the product works. When a trial ends or a subscription is cancelled, access to the platform ends and a defined window begins:
- We hold everything intact for 30 days. Ask us in that window and we will package your documents, your executed PDFs and your transaction records and send them to you, at no charge.
- We email you a notice seven days and again one day before anything is deleted.
- Then we permanently delete it. We do not keep a former customer’s files, because holding your clients’ information after you have left is a risk to people who never agreed to it.
The full policy, including what is not affected by deletion, is published at Your data and leaving BrokerDIY. We wrote that page before asking anyone to hand us a file.
Outside that window we keep: waitlist and marketing contacts until you unsubscribe or ask us to remove them; billing and tax records for as long as tax and accounting law requires; security and audit logs for up to 24 months; and aggregate information as described in section 9. Backups roll off on their own cycle within 35 days of deletion.
Your brokerage has its own record-keeping obligations, and they do not transfer to a software vendor. State real-estate commissions set their own retention periods and they are typically measured in years. Your state commission is the authority on what applies to you — keep your own copies the way you would with any vendor.
12. Security
We encrypt data in transit and at rest, isolate each brokerage’s data by tenant, restrict staff access to what a job needs, log administrative actions, and keep the platform patched. Documents carry a hash-chained verification record, so an executed PDF can be checked for tampering independently of us. No system is perfectly secure and we do not promise that ours is, but if a breach affects your information we will tell you, and the regulators the law requires us to tell, without undue delay.
13. Your rights if you are in the United States
California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida and a growing list of other states give residents rights over personal information. We extend these rights to everyone in the United States, because operating two standards is how mistakes happen. You may ask us to:
- Know what we have collected about you, where it came from, why, and who we disclosed it to.
- Get a copy in a portable format.
- Correct anything inaccurate.
- Delete it, subject to what we must keep by law.
- Opt out of sale, sharing, targeted advertising or profiling. We do none of these, so there is nothing to opt out of, but the request is honoured and recorded anyway, and we respect Global Privacy Control automatically.
- Limit the use of sensitive personal information. We do not use it beyond permitted purposes.
How to make a request. Write to us through our contact page or reply to any email from us. We will verify it is you, usually by asking you to reply from the address on the account, and we answer within 45 days, or tell you why we need up to 45 more. An authorised agent may act for you with written permission. We will never charge you, refuse you service, or give you a worse price for exercising a right. If we turn a request down you can appeal by replying to our answer, and we will reconsider within 45 days and tell you where to complain if you are still unhappy.
If your request concerns data held inside a brokerage’s account, we will route it to that brokerage, because it is theirs to decide.
14. Your rights if you are in the UK, EU or EEA
Where we are the controller, we rely on these legal bases: contract, to give you the service you asked for; legitimate interests, to secure the platform, prevent abuse, and market to businesses, balanced against your interests and subject to your right to object at any time; consent, for analytics cookies and marketing email, which you can withdraw; and legal obligation, for tax, accounting and lawful requests. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority.
International transfers. We are based in the United States and our providers are principally in the United States, so information reaches the US. Where we transfer personal data out of the UK, EU or EEA we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with technical measures including encryption in transit and at rest.
Data processing agreement. Where we process personal data on your behalf, our Data Processing Agreement governs that processing and incorporates the sub-processor list. It is published and already in force for every customer — there is nothing to request and nothing to sign. It carries the Standard Contractual Clauses and the UK Addendum for transfers, and the CCPA service-provider restrictions. If your legal team needs it countersigned on your paper, ask through our contact page and we will sign.
15. Children
BrokerDIY is a business tool. It is not directed to children, and you must be 18 to hold an account. We do not knowingly collect information from anyone under 18, and we delete it if we find we have.
16. Cancelling
You cancel the same way you signed up, in the app, yourself. No retention call, no support ticket, and no waiting for business hours.
17. Changes to this policy
We will update this page when what we do changes. The effective date at the top always tells you which version you are reading. If a change is material we will tell you by email or in the product before it takes effect, and we will keep the previous version available on request so you can see what changed.
18. Contact
For anything about your data — a copy, a correction, deletion, a data processing agreement, or a question about this policy — reply to any email from us or write to us through our contact page. A person reads it.