Privacy Policy

WebGrowly LLC ("WebGrowly," "we," "our," or "us"), a Delaware limited liability company with its principal place of business in Miami Beach, Florida, operates the WebGrowly marketing website at realty.webgrowly.com, the WebGrowly OS platform ("OS"), and any real estate websites hosted by us under our customers' custom domains (collectively, the "Service").

This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and your rights. By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

We handle personal information in three distinct roles. Understanding which role applies to you matters because your rights differ.

(a) Marketing Site Visitors. If you visit our marketing website at realty.webgrowly.com or submit a demo request, we are the controller of your personal information. This Policy governs that relationship directly.

(b) WebGrowly OS Customers (Realtors). If you purchase and use WebGrowly OS, we are the controller of the account, billing, and usage data we collect from you as our direct customer. This Policy governs that relationship directly.

(c) End-User Data Processed on Behalf of Our Customers. If you are a homebuyer, seller, tenant, renter, or website visitor whose personal information was submitted to a website or CRM operated by one of our real-estate-agent customers ("Realtor"), the Realtor is the controller of your personal information and WebGrowly is a processor acting on the Realtor's instructions. In that case, you should contact the Realtor directly for privacy requests. We will assist the Realtor in responding. See Section 10.

2.1 Information You Provide to the Marketing Site

When you request a demo or contact us, we collect:

• Full name
• Email address
• Phone number
• City / market
• Free-text message

2.2 Information You Provide as an OS Customer

When you create, configure, and use an OS account, we collect:

• Account data: email, hashed password, name, business/company name, profile photo
• Billing data: a record of your one-time License Fee payment (payment card details are handled by our payment processor and are not stored by us)
• Business configuration: business phone, preferred notification email, notification channels, widget configuration, AI configuration, allowed domains, market/focus configuration, agent presets
• Communications with us (email, support messages)

2.3 End-User Data Processed on Behalf of Realtors

When a Realtor uses the OS, the OS stores personal information that end-users submit to the Realtor's website, AI chat widget, contact forms, or that the Realtor enters manually. This may include:

• Name, email, phone, budget, property preferences
• Lead notes, messages, and free-text content entered by the Realtor
• Deal, transaction, commission, invoice, and rent-tracker records (which may contain names, addresses, phone numbers, email addresses, financial amounts, and lease documents of the Realtor's clients and tenants)
• Analytics events from visitors to the Realtor's hosted website (anonymous visitor identifier, session ID, UTM parameters, device and browser type, coarse geolocation derived from IP)
• Voice dictation (processed as described in Section 3 and immediately deleted; only the text transcript and AI-extracted notes are retained)

WebGrowly does not use end-user data for its own purposes. We process it only to provide the Service to the Realtor.

2.4 Automatically Collected Information

When you use the Service, we automatically collect:

• IP address (stored in activity and security logs)
• Device type, browser, operating system
• Coarse geolocation derived from IP (country, region, city)
• Pages visited, features used, session timestamps
• Referrer and UTM parameters
• Error reports and diagnostic data (via Sentry)
• Page-view and usage telemetry (via Vercel Analytics)

The OS includes a Voice Notes feature that allows a Realtor to dictate notes by voice. When a Realtor uses this feature:

1. The audio is transmitted to OpenAI's Whisper API for transcription.
2. We receive the text transcript from OpenAI.
3. We do not retain the audio file. The audio is deleted immediately after transcription is complete.
4. We retain only the text transcript, AI-generated summary, key points, action items, and inferred sentiment. These may be stored indefinitely or until the associated record is deleted.

We do not create, extract, or store voiceprints, voice templates, or any biometric identifier. Realtors are instructed to obtain consent from any third party before dictating notes that include identifiable information about that third party.

We use information for the following purposes:

• Provide, maintain, host, and secure the Service
• Authenticate accounts and enforce access controls
• Process your License Fee payment and issue receipts
• Send transactional communications (account, security, billing, lead alerts)
• Send SMS and email notifications to Realtors at phone numbers and email addresses they provide (with their consent)
• Provide AI features using OpenAI (see Section 5)
• Monitor, debug, and improve the Service (error reports via Sentry, performance telemetry via Vercel)
• Comply with law, respond to subpoenas and lawful requests, and defend legal claims
• Enforce our Terms of Service and Acceptable Use Policy

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We do not build behavioral profiles of Customers or end-users. We do not use Service data for advertising targeting, ad-network sharing, or lookalike modeling. We do not authorize OpenAI or any other subprocessor to train AI models on Service data. The WebGrowly business model is a one-time License Fee; we have no commercial incentive to monetize your data in any other way, and we have taken the technical and contractual measures set out in this Policy and the Data Processing Addendum to prevent such monetization.

The OS includes features that use OpenAI models (GPT-4 family for text generation, GPT-4 Vision for photo analysis, Whisper for speech-to-text). When you use these features, relevant input data (text prompts, property photos, audio for transcription, prior message context, CRM fields) is transmitted to OpenAI for processing, and the output is returned to the OS and saved in your records.

AI output is probabilistic and may be inaccurate, incomplete, biased, or misleading. You are solely responsible for reviewing AI output before using it for any purpose. AI features are provided free of additional charge for the first 180 days of your account. After that period, you may continue to use AI features through one of the options described in Section 6.2 of the Terms of Service — either WebGrowly's Managed AI Add-On (where offered, on then-current terms) or by supplying your own API key from a supported AI provider with WebGrowly's guided assistance. If you do not select an option, AI features will cease to function while non-AI features of the Service continue to operate without additional charge.

During the initial 180-day period, and where you subsequently subscribe to the Managed AI Add-On under Section 6.2(a) of the Terms of Service, AI features are routed through WebGrowly's OpenAI account and are governed by OpenAI's Enterprise Privacy commitments in effect at that time, and we do not authorize OpenAI to use Service data routed through our account to train its models. Where you instead supply your own API key under Section 6.2(b) of the Terms of Service, AI features are governed by your direct contractual relationship with the AI provider, and you are responsible for the privacy and training-data settings you select with that provider.

We share personal information with the following subprocessors, each of whom acts only on our documented instructions and is bound by confidentiality and data-protection obligations. The current list of subprocessors is:

An up-to-date list of subprocessors, including any additions, is maintained at realty.webgrowly.com/legal and in the Data Processing Addendum.

Beyond these subprocessors, we share personal information only:

• With the Realtor customer whose account the data belongs to (for end-user data processed on their behalf)
• With our legal, accounting, and professional advisors under confidentiality
• With a successor in connection with a merger, acquisition, reorganization, or asset sale (with notice)
• As required by law, subpoena, court order, or to prevent fraud, abuse, or harm
• With your explicit consent

We do not sell personal information and have not sold personal information in the preceding twelve months.

Upon account closure, customer and end-user data will be deleted within 45 days of the end of the 30-day export window, except (i) financial records required by tax law, (ii) data retained in compliance with a legal hold, and (iii) data reasonably needed to defend legal claims, which will be archived and inaccessible to Service operations.

We maintain reasonable administrative, technical, and physical safeguards, including:

• HTTPS/TLS in transit; encryption at rest for database and file storage
• Password hashing by Supabase Auth using industry-standard algorithms
• Row-level security policies for multi-tenant data isolation
• Rate limiting on authentication and sensitive API endpoints
• Secure session cookies (HttpOnly, Secure, SameSite)
• Audit logging of administrative actions including impersonation
• Least-privilege access controls for administrators
• Subprocessor selection based on security posture

No system is perfectly secure. We cannot guarantee that unauthorized access, use, or disclosure will never occur.

Subject to verification and applicable law, you may request to:

• Know what personal information we hold about you and how we use it
• Access a copy of your personal information
• Correct inaccurate personal information
• Delete your personal information (subject to the exceptions in Section 7)
• Port your personal information to another service in a portable, structured, commonly used, machine-readable format where technically feasible
• Opt out of sale or sharing for cross-context behavioral advertising (we do not engage in either)
• Withdraw consent where processing is based on consent
• Appeal a denial of any of the above

To exercise these rights, email privacy@webgrowly.com with the subject line "Privacy Request". Include the email address associated with your account or submission and the nature of your request. We will respond within 45 days. We may request reasonable verification before fulfilling the request.

We honor Global Privacy Control (GPC) browser signals and treat a GPC signal as a request to opt out of any sale or sharing on behalf of the transmitting browser.

You will not be discriminated against for exercising these rights.

9.1 Requests Involving End-User Data

If you are an end-user whose data is held in a Realtor's CRM, you must contact the Realtor directly. We will assist the Realtor in responding to your request, but we cannot act unilaterally on their data.

9.2 Florida Residents

Florida residents have the rights described above under common-law privacy principles and applicable state consumer-protection statutes. The Florida Digital Bill of Rights (FDBR) imposes additional obligations only on businesses that meet specific revenue and business-model thresholds, and does not currently apply to WebGrowly. We reassess this classification upon material changes to revenue, business model, or operational scope, and will update this Policy if FDBR becomes applicable. We honor the rights in this Section regardless of whether FDBR formally applies.

9.3 California Residents

California residents have rights under the California Consumer Privacy Act as amended. The CCPA imposes revenue and consumer-volume thresholds that WebGrowly does not currently meet, but we honor CCPA-style rights (access, deletion, correction, opt-out of sale/share, data portability, non-discrimination) regardless.

10.1 Marketing Site

The marketing site at realty.webgrowly.com uses no cookies or tracking other than Vercel Analytics, which collects anonymized page views and coarse visitor metrics. There are no advertising cookies, no Google Analytics, no Meta Pixel, no remarketing, and no cross-site tracking.

10.2 WebGrowly OS

The OS uses cookies required for authentication and session management (Supabase Auth cookies). A short-lived cookie may be set when an authorized administrator impersonates a customer account for support purposes; this cookie is HttpOnly, Secure, and expires within four hours. No advertising or tracking cookies are used.

10.3 Realtor-Hosted Websites

Websites we host on behalf of Realtor customers may use cookies and analytics configured by the Realtor. The Realtor is the controller for those sites and is responsible for disclosing and obtaining consent for any cookies deployed on their site.

The Service is intended for business use by adult real estate professionals. We do not knowingly solicit or directly collect personal information from anyone under 18.

Information about minors may appear incidentally in Customer (Realtor) records — for example, names of family members in tenant records, lease applications, or school-district notes on property preferences. Such incidental information is processed under the Customer's controllership pursuant to the DPA; the Customer represents that any such collection complied with applicable law (including COPPA where relevant) and that the Customer has obtained any necessary parental consents. WebGrowly does not directly interact with these minors and does not market to them.

If we learn that we have directly solicited or collected personal information from a minor in a manner that was not incidental to a Realtor's business records, we will delete it. A parent or guardian who believes we have collected information from their child directly may email privacy@webgrowly.com.

The Service is operated from the United States and intended solely for real estate professionals operating in Florida. We do not target, market to, or intentionally serve users outside the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

We may update this Policy from time to time. Changes will be communicated and accepted under the framework set out in Section 21 of the Terms of Service: non-material changes (clarifications, typographical corrections, contact-information updates, or subprocessor list changes governed by DPA §5.3) by email notice and update of the "Last Updated" date above, with continued use after thirty (30) days constituting acceptance; material changes — including any expansion of WebGrowly's permitted use of End-User Data, any reduction of data-subject rights, any new category of personal information collected, any new purpose of processing, or any new subprocessor category not subject to DPA §5.3 — require Customer's affirmative acceptance via electronic signature (DocuSign or equivalent) as provided in TOS §21.2. Continued use of the Service does not constitute acceptance of such material changes absent affirmative electronic signature.

Prior versions of this Policy are archived and available on request to privacy@webgrowly.com.

For privacy questions or requests:

WebGrowly LLC Attn: Privacy 407 Lincoln Rd, Ste 6H, PMB 529 Miami Beach, FL 33139, United States Email: privacy@webgrowly.com

For notices of claimed copyright infringement under the Digital Millennium Copyright Act (DMCA), see Section 25 of the Terms of Service.