Privacy Policy

Version: 2026-09-25 First Published: April 25, 2026

WebGrowly LLC ("WebGrowly," "we," "our," or "us"), a Delaware limited liability company based in Miami Beach, Florida, operates the WebGrowly marketing website at realty.webgrowly.com, the WebGrowly OS platform ("OS"), and the real estate websites we host for our customers under their custom domains (collectively, the "Service").

This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, how long we keep it, and the choices and rights available to you.

We handle personal information in three distinct roles. Understanding which role applies to you matters because your rights differ.

(a) Marketing Site Visitors. If you visit our marketing website at realty.webgrowly.com, use its AI concierge, request a demo, or submit a website project brief, we are the controller of your personal information. This Policy governs that relationship directly.

(b) WebGrowly OS Customers. If you are a real estate professional who purchases and uses WebGrowly OS, we are the controller of the account, billing, and usage data we collect from you as our direct customer (a "Customer"). This Policy governs that relationship directly.

(c) End-User Data Processed on Behalf of Our Customers. If you are a homebuyer, seller, tenant, renter, website visitor, or other person whose personal information was submitted to a website or CRM operated by one of our Customers, that Customer is the controller of your personal information and WebGrowly is a processor acting on the Customer's instructions. Each Customer website displays its own privacy notice. For privacy requests, contact the Customer directly; we will assist the Customer in responding. See Section 9.1.

2.1 Information You Provide to the Marketing Site

When you request a demo or contact us, we collect:

• Full name
• Email address
• Phone number
• City / market
• Free-text message
• If you have allowed analytics in the cookie banner, the page on which you arrived and the general channel that referred you (for example, a search engine or a campaign tag), which accompany your request

If you use the AI concierge on the marketing site, we collect the messages you send, the concierge's responses, limited session context needed to continue the conversation, and any voice transcript you choose to create. Concierge conversations are encrypted before they are stored in Supabase and are retained for no longer than 30 days after the conversation's last activity. Content-free usage and quality metrics (such as response time and cost) may be kept longer.

If you submit a website project brief through onboarding.webgrowly.com, we collect the business and professional information you provide for building your website, which may include your license and brokerage details, professional history, service areas, social-media profiles, and a photograph. If you choose the optional AI-created professional headshot, your photograph is processed by a third-party AI image service to create it. A separate notice shown with the brief supplements this Policy.

2.2 Information You Provide as an OS Customer

When you create, configure, and use an OS account, we collect:

• Account data: email, password (stored only as a hash), name, business or company name, profile photo, and, if you sign in with Google or Apple, the identity information those services provide
• Professional data: Florida license and brokerage information
• Billing data: a record of your one-time License Fee payment (payment card details are handled by our payment processor and are not stored by us)
• Business configuration: business phone, notification email, additional alert recipients you add, notification channels, widget and AI configuration, allowed domains, market and focus configuration, agent presets, and integrations you connect (such as Zapier)
• Device data for push notifications, if you enable them
• Communications with us (email, support messages)

2.3 End-User Data Processed on Behalf of Customers

When a Customer uses the Service, the Service processes personal information that end-users submit through the Customer's website or that the Customer enters or uploads. This may include:

• Contact details and inquiries: name, email, phone, messages, budget, property preferences, and home-valuation or showing requests
• Lead-portal accounts: name, email, phone, sign-in information (including through Google or Apple), saved properties, saved searches, recently viewed listings, and account activity
• Consent records: the consent or disclosure text displayed, its version, the date and time, and technical information such as IP address and browser type
• AI conversations and searches: messages sent to the AI assistant, AI property searches typed or spoken, and information the assistant extracts to help the Customer respond (such as contact details and stated interests)
• Fair-housing safeguard records: the text of an AI search or chat request that the Service's fair-housing safeguards flagged or handled (for example, a request that referred to a protected characteristic, the character or quality of an area, or an accessibility need), kept without IP addresses or device identifiers and without a link to the visitor's account or contact record
• Website analytics: visitor and session identifiers, pages viewed, referrer, campaign tags, device and browser type, and approximate location derived from IP address
• CRM records: leads, notes, tasks, showings and attendees, deals, transactions, commissions, invoices, and rent-tracker records, which may include names, addresses, phone numbers, email addresses, financial amounts, and documents such as leases that the Customer uploads
• Voice dictation, processed as described in Section 3

Property Passport reports compile public records about a property, which may include the names of owners as they appear in public records. Reports are generated on request and are not added to a visitor profile; AI-written summaries may be cached for a limited period.

We process End-User Data on the Customer's behalf to provide the Service, and also as needed to secure the Service, prevent abuse, maintain fair-housing safeguards, comply with law, and create aggregated or de-identified information that does not identify any individual. We do not use End-User Data to market our own products to end-users.

2.4 Automatically Collected Information

When you use the Service, we and our service providers automatically collect:

• IP address
• Device type, browser, and operating system
• Approximate location derived from IP (country, region, city)
• Pages visited, features used, and session timestamps
• Referrer and campaign (UTM) parameters
• Error reports and diagnostic data (via Sentry)
• Page-view and performance telemetry (via Vercel; on the marketing site, only if you allow analytics as described in Section 10.1)

The marketing-site AI concierge lets a visitor submit an optional voice question. The audio is sent to OpenAI solely to prepare the transcript. WebGrowly does not retain the concierge audio after transcription. The transcript is returned to the message field for the visitor to review and, if sent, becomes part of the encrypted concierge conversation described in Section 2.1.

Customer websites may offer voice search and voice input for the AI assistant. The audio is sent to OpenAI to prepare a transcript, which is then used to run the search or answer the question. WebGrowly does not store the audio file.

The OS includes a Voice Notes feature that allows a Customer to dictate notes by voice. When a Customer uses this feature:

1. The audio is transmitted to OpenAI's speech-to-text service for transcription.
2. We receive the text transcript from OpenAI.
3. WebGrowly does not store the audio file.
4. We retain the text transcript and the AI-generated summary, key points, action items, and sentiment with the associated record until that record is deleted.

OpenAI processes audio under its data-usage commitments for business API customers. We do not create, extract, or store voiceprints, voice templates, or any biometric identifier. Customers are instructed to obtain consent from any third party before recording or dictating information about that person.

We use information for the following purposes:

• Provide, maintain, host, and secure the Service
• Authenticate accounts and enforce access controls
• Process your License Fee payment and issue receipts
• Respond to demo requests, support requests, and other inquiries
• Send transactional communications (account, security, billing, lead alerts, reminders)
• Send text messages and emails to Customers, and to the additional alert recipients they designate, at the phone numbers and email addresses provided, and send showing confirmations and reminders on a Customer's behalf
• Provide AI features using OpenAI (see Section 5), including AI search, the AI assistant, and summaries that help a Customer understand and prioritize inquiries
• Maintain fair-housing safeguards and review their consistent operation
• Monitor, debug, and improve the Service, including through aggregated or de-identified statistics
• Comply with law, respond to lawful requests, and establish or defend legal claims
• Enforce our Terms of Service and Acceptable Use Policy

Text messages. We send text messages to Customers and to the alert recipients they designate (for example, new-lead alerts and task and showing reminders) and, on a Customer's behalf, showing confirmations and reminders to showing attendees. Message frequency varies with account and showing activity. Message and data rates may apply. Reply STOP to any text message to opt out; for help, reply HELP or email support@webgrowly.com. We do not share, sell, or provide mobile phone numbers or text-messaging consent to third parties or affiliates for their marketing or promotional purposes.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Features that summarize conversations or estimate the interest of an inquiry do so only for the Customer's own use in responding to that inquiry. We do not use Service data to build advertising profiles, for ad targeting or ad-network sharing, or for lookalike modeling. Our agreement with OpenAI for the Service does not permit OpenAI to use Service data to train its models, and we do not provide Service data to any service provider for the purpose of training AI models.

The Service includes features that use OpenAI models for text generation, photo analysis, search, translation, moderation, speech-to-text, and text-to-speech. When these features are used, the relevant input (such as text prompts, messages, search requests, property photos, listing information, public-record facts, audio for transcription, prior message context, and CRM fields) is transmitted to OpenAI for processing. Marketing-site concierge requests are sent with provider-side response storage disabled; encrypted conversation continuity is maintained separately in Supabase as described in Section 2.1. Output from other features is returned to the Service and saved where the feature requires it, as described elsewhere in this Policy.

AI output is probabilistic and may be inaccurate, incomplete, biased, or misleading. You are responsible for reviewing AI output before relying on it.

AI features are routed through WebGrowly's OpenAI account and are governed by OpenAI's data-usage commitments for business API customers in effect at the time.

We share personal information with the following service providers to provide the Service. Providers that process personal information on our behalf do so under contractual confidentiality and data-protection terms; sign-in services, push-notification services, and integrations that a user or Customer chooses to use also process it under their own terms and privacy policies:

Listing data on Customer websites is supplied by the MLS through its authorized data provider (currently Bridge Interactive). Property Passport reports are compiled from government and other public-record sources, which receive the address being researched but not the visitor's identity. Customer agreements are signed through an electronic-signature provider (currently DocuSign), and License Fee payments are handled by the payment processor or bank used for the payment. We may update this list as described in the Data Processing Addendum; the current list is always available at realty.webgrowly.com/legal.

Beyond these service providers, we share personal information only:

• With the Customer customer whose account the data belongs to (for End-User Data processed on the Customer's behalf), and with the recipients the Customer designates
• With our legal, accounting, and professional advisors under confidentiality
• With a successor in connection with a merger, acquisition, reorganization, or asset sale
• As required by law, subpoena, or court order, or to prevent fraud, abuse, or harm
• With your consent or at your direction

When a page loads design files, such as graphics, from a third-party content host, that host receives the technical information any web request carries, such as IP address and browser type.

We do not sell personal information and have not sold personal information in the preceding twelve months.

We keep personal information only as long as needed for the purposes described in this Policy, including to provide the Service, meet legal, tax, and accounting requirements, resolve disputes, and enforce our agreements.

After a Customer's export period ends, we delete or de-identify customer and End-User Data within a commercially reasonable time, except (i) records we must keep for tax, accounting, or other legal reasons, (ii) data subject to a legal hold, (iii) data reasonably needed to establish or defend legal claims, and (iv) copies in backups until they are overwritten. Retained data remains protected by this Policy.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit (HTTPS/TLS, with HTTP Strict Transport Security) and encryption at rest for our primary database and file storage
• Additional application-level encryption for certain data, such as concierge conversations and integration tokens
• Password hashing using industry-standard algorithms
• Row-level security and application checks that separate each customer's data
• Rate limiting and abuse controls on sign-in and sensitive endpoints
• Security headers and restrictions on browser features
• Administrative access limited to authorized personnel, with time-limited support sessions
• Scrubbing of contact details and credentials from error reports
• Dependency and secret scanning
• Selection of service providers based on their security practices

No system is perfectly secure, and we cannot guarantee that unauthorized access, use, or disclosure will never occur. If a security breach affects your personal information, we will notify you, and our Customers where we act as their processor, as required by applicable law, including Fla. Stat. § 501.171.

Subject to verification and applicable law, you may request to:

• Know what personal information we hold about you and how we use it
• Access a copy of your personal information
• Correct inaccurate personal information
• Delete your personal information (subject to the exceptions in Section 7)
• Port your personal information in a structured, commonly used, machine-readable format where technically feasible
• Opt out of sale or sharing for cross-context behavioral advertising (we do not engage in either)
• Withdraw consent where processing is based on consent
• Appeal a denial of any of the above

To exercise these rights, email privacy@webgrowly.com with the subject line "Privacy Request". Include the email address associated with your account or submission and the nature of your request. We will respond within 45 days, which may be extended where the law allows. We may request reasonable verification before fulfilling the request. An authorized agent may submit a request on your behalf with proof of authorization.

We treat a Global Privacy Control (GPC) signal as a request to opt out of any sale or sharing of personal information associated with that browser. The Service does not respond to "Do Not Track" browser signals, for which there is no common industry standard; we do not track visitors across third-party websites.

You will not be discriminated against for exercising these rights.

9.1 Requests Involving End-User Data

If your data is held in a Customer's website or CRM, contact the Customer directly. We will assist the Customer in responding to your request, but we act on the Customer's instructions for that data. Lead-portal users can also delete their portal account from the account settings. If you contact us about End-User Data, we will forward your request to the relevant Customer where we can identify them.

9.2 Florida Residents

Florida residents may exercise the rights described in this Section. Where the Florida Digital Bill of Rights applies to our processing of your personal information, you also have the rights it provides.

9.3 California Residents

California residents may exercise the rights described in this Section. Where the California Consumer Privacy Act, as amended, applies to our processing of your personal information, you also have the rights it provides.

10.1 Marketing Site

The marketing site at realty.webgrowly.com asks for your choice in a cookie banner, which you can reopen at any time from the Cookie settings link at the bottom of every page.

• Essential (always on). If you open the AI concierge, the site sets one essential Secure, HttpOnly, SameSite session cookie containing a random session token. It is used only to keep the encrypted conversation available across page navigation and to protect the concierge from abuse, and expires no later than 30 days; it is not an advertising or cross-site tracking cookie. The site also uses browser storage to remember your cookie choice and to skip the introductory animation on repeat page views.
• Analytics (only if you choose "Accept all"). The site measures visits with Vercel Web Analytics, which does not use cookies, and remembers for the current browser tab the page and channel that brought you to the site so that they can accompany a demo request. Until you choose, and if you choose "Essential only", neither runs.

There are no advertising cookies, no Google Analytics, no Meta Pixel, no remarketing, and no cross-site tracking.

10.2 WebGrowly OS

The OS uses cookies and browser storage required for sign-in and session management. A short-lived cookie is set when an authorized WebGrowly team member opens a support session; it is HttpOnly and Secure and expires within four hours. The OS uses privacy-focused analytics and performance monitoring. No advertising or cross-site tracking cookies are used.

10.3 Websites We Host for Customers

WebGrowly provides the cookie notice and consent mechanism for Customer websites as part of the Service. These websites use cookies, browser storage, and similar technologies that are needed to operate their features and keep them secure (for example, language preference, saved properties, lead-portal sign-in, and AI search), some of which remain on the device between visits; first-party analytics that report visits to the Customer; and map services provided by Mapbox. Where the visitor chooses "Accept all," the website also uses identifiers that recognize a returning browser for visit statistics and for continuity of AI assistant conversations. Some Customer websites display content supplied by third parties, such as new-construction catalogues, under those third parties' own policies. Each Customer website displays its own privacy notice and cookie banner. The Customer is the controller for each Customer website.

The Service is intended for business use by adult real estate professionals. Customer websites are not directed to children under 13, and the lead portal is intended for users who are 18 or older. We do not knowingly collect personal information directly from children under 13.

Information about minors may appear incidentally in Customer records — for example, names of household members in tenant records or lease applications. Such information is processed under the Customer's controllership pursuant to the Data Processing Addendum, and the Customer is responsible for any required consents.

If we learn that we have collected personal information directly from a child under 13 other than incidentally in a Customer's business records, we will delete it. A parent or guardian who believes we have done so may email privacy@webgrowly.com.

The Service is operated from the United States for real estate professionals in Florida. Customer websites may be available in several languages and may be viewed from other countries. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

We may update this Policy to reflect changes in the Service, our practices, or the law. We will post the updated Policy with a new "Last Updated" date and, where a change is material, notify Customers by email. Changes to Customers' contractual rights are governed by Section 21 of the Terms of Service and by the Data Processing Addendum.

Prior versions of this Policy are archived and available on request to privacy@webgrowly.com.

For privacy questions or requests:

WebGrowly LLC Attn: Privacy 407 Lincoln Rd, Ste 6H, PMB 529 Miami Beach, FL 33139, United States Email: privacy@webgrowly.com

For notices of claimed copyright infringement under the Digital Millennium Copyright Act (DMCA), see our DMCA Policy and Section 25 of the Terms of Service.