Privacy Policy

Total Agent (“Total Agent,” “we,” “us”) provides an AI assistant (“Total Agent AI”) that helps licensed real-estate agents manage their email, calendar, and client relationships. This policy explains exactly what Google user data we access when you connect a Google account, how we use it, who we share it with, how we protect it, and how we retain and delete it.

This Privacy Policy describes how Total Agent LLC ("Total Agent," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our Platform and Services. This Privacy Policy is incorporated into our Terms of Service.

Total Agent LLC is a Florida limited liability company. Statements below describing technical practices are limited to what the Platform currently implements; where a practice varies by feature, infrastructure provider, or account configuration, we use accurate general language rather than absolute guarantees.

1. INFORMATION WE COLLECT

1.1 Account Information When you create an account or complete checkout contact steps, we collect information such as:

• Name
• Email address
• Phone number
• Password (stored as a password hash)
• Real estate license number and state, when you choose to provide them (optional at launch onboarding; may be collected later in Settings)
• Brokerage affiliation or related professional details you choose to provide
• Payment-related identifiers (card details are processed by Stripe; we do not store full card numbers)
• Profile information you choose to provide

1.2 Billing Information We process and store billing records needed to operate subscriptions, including plan selection, invoices, payment status, additional-usage charges, billing-consent evidence, and related Stripe customer/subscription identifiers.

1.3 CRM and Business Data As you use the Platform, we collect and process contacts and CRM fields (including passive stored contacts and Intelligent Contacts enrolled in Client Intelligence features); imported contact databases and related import processing metadata; transactions; contracts and related documents; showing records; offers; listings and property data; deadlines; and related business records you create or import.

1.4 Communications Data Where you enable messaging or email features, we process communications content and metadata. Full email message bodies may be stored in our application database (including encrypted-at-rest storage where that write path is enabled) to power sync, search, AI assistance, and two-way mailbox mirroring.

1.5 Call Recordings, Transcripts, and Voicemail Where Calls features are enabled, we may process call metadata, audio recordings, transcripts, and voicemail-related audio or messages generated for connected or inbound call flows (recording and transcription may both occur where the feature path is enabled).

1.6 AI Prompts and Outputs When you interact with Total Agent AI features, we process prompts, responses, related context you supply, and processing metadata needed to deliver the feature.

1.7 OAuth Tokens and Connected Accounts If you connect Google, Microsoft, or similar accounts (often via Nylas), we store connection identifiers and related metadata. Access/refresh tokens are typically held by the connectivity provider’s vault rather than in cleartext in our application database.

1.8 ShowingTime / Calendar Feeds If you connect ShowingTime or other calendar/Webcal feeds, we process feed URLs, showing events, and related scheduling metadata (which may include property, seller, showing-agent, or appointment details present in the feed) to power Listing Manager showing coordination.

1.9 Audit and Security Logs We maintain operational and security logs, including hash-chained legal-acceptance records (legalAcceptances) used as a tamper-evident ledger of onboarding agreements.

1.10 Usage Information We automatically collect device and usage data such as device type, browser, IP address, approximate location derived from IP, access times, pages and features used, error reports, referral sources, and UTM or similar campaign parameters when present. On our public website and signup funnel this collection uses cookies, pixels, tags, browser storage, and similar technologies, and runs only with your permission — see Section 1.13.

1.11 Acquisition and Checkout Leads If you begin account creation or checkout and provide contact information before completing payment, we may retain that information as Total Agent's own acquisition/signup lead (separate from your CRM contacts), including if you abandon checkout. We may use it to assist with completing signup, respond to questions, understand abandonment, measure funnel conversion, and provide permitted human sales/support follow-up. Capturing a phone number for checkout is not consent to automated marketing SMS or calls.

1.12 Third-Party Data We may receive information from OAuth providers when you connect accounts, from carriers/providers used to deliver communications, and from other integrations you enable. Referral, affiliate, or brokerage attribution codes may be stored when supplied through a campaign or checkout path.

1.13 Website Analytics, Advertising, and Session Replay On our public marketing website and our signup and checkout pages — and NOT inside the signed-in application — we use the third-party measurement and advertising technologies below, and our own first-party measurement, only after you choose Accept in the privacy choices banner on those pages. If your browser sends a Global Privacy Control signal, they do not run, whatever you choose:

• Meta Pixel (Meta Platforms, Inc.) — measures which advertisements and pages lead to signups and supports advertising audiences and retargeting. It sets cookies and reports page views and funnel steps to Meta.
• Google Analytics 4 (Google LLC) — reports traffic sources, pages viewed, and funnel steps.
• PostHog (PostHog, Inc.) — product analytics and session replay. Session replay records page interactions such as navigation, clicks, and scrolling. All form input is masked at capture, so the name, email address, and phone number typed on our checkout page are not recorded.

In your browser, these technologies receive page and event information — for example which page was viewed, which plan was selected, and that plan’s price — together with device, browser, IP address, and cookie or device identifiers the provider assigns. Our pages do not pass them your name, email address, phone number, or payment details. Card details are never present in our pages at all; Stripe collects them directly.

Meta Conversions API. In addition, when the payment that starts your subscription succeeds, our servers send Meta a purchase event so that Meta can attribute the purchase to the advertisement that led to it. It contains: a SHA-256 hash of the email address and of the phone number you gave at checkout (not the plain values); the IP address and browser user agent recorded when you agreed to billing at checkout; the Meta browser identifiers the Meta Pixel set in your browser (its _fbp and _fbc cookies, or, where the _fbc cookie was not yet set, the click identifier from the Meta ad link you arrived from); the amount paid, its currency, and the plan purchased; and an event identifier used to avoid counting the purchase twice. We send it only if, when you started checkout, your browser had accepted these technologies and was not sending a Global Privacy Control signal.

First-party measurement. Our own pages also keep a record of how a visitor arrived, used only by Total Agent: a ta_attribution_v1 entry in your browser’s storage (the campaign parameters, ad click identifiers, landing page, and referring site of the visit, kept for up to 7 days) and a ta_acq cookie (a random identifier set by our server, which scripts on the page cannot read, expiring 90 days after it is set) that links visits to a later checkout. When you start checkout, the campaign details and Meta browser identifiers are stored with your signup lead (Section 1.11). These also run only after you accept, and not when your browser sends a Global Privacy Control signal.

Your choice. Your choice is stored in a first-party ta_consent cookie in your browser for 180 days, recording the choice, when it was made, and the version of the banner. You can change it at any time with the “Privacy choices” link on our public pages and on the checkout page — see Section 5.6.

None of these technologies run inside the authenticated application. Your CRM contacts, client communications, listings, showings, documents, and call content are never sent to an analytics or advertising provider.

2. HOW WE USE YOUR INFORMATION

We use collected information to:

2.1 Provide the Platform

• Deliver Platform features and functionality
• Process transactions and documents
• Generate AI outputs (summaries, extractions, analyses, drafts)
• Enable communications with clients, cooperating agents, and service providers
• Operate automations you enable
• Maintain audit trails and compliance records

2.2 Account Management

• Create and maintain your account
• Authenticate your identity (including optional multi-factor authentication where you enable it)
• Process payments and billing
• Detect and prevent fraud, abuse, and security incidents
• Respond to support requests
• Enforce Terms of Service

2.3 Improve the Platform

• Analyze usage patterns to improve features and reliability
• Develop new features
• Monitor Platform performance
• Debug errors
• Product analytics
• Measure marketing campaigns, advertising performance, and signup-funnel conversion

We do not use your client content to train third-party foundation models. We do not operate a separate customer-data training pipeline that fine-tunes proprietary models on your CRM or communications content.

2.4 Communicate with You

• Send transactional notifications (account, billing, security, product-operation notices)
• Respond to inquiries
• Send security alerts
• Send product updates and announcements (with your consent where required)
• Provide permitted acquisition-funnel or abandoned-checkout human follow-up where disclosed

2.5 Comply with Legal Obligations

• Applicable record-retention and accounting requirements
• Respond to legal process
• Enforce rights and protect against harm

3. AI PROCESSING AND YOUR DATA

3.1 Total Agent AI Systems Total Agent AI uses AI providers (currently including Anthropic for language-model inference, and speech-to-text providers for call transcription where Calls features are enabled). When you use AI features, your content is processed to deliver the services you requested under confidentiality and data-use agreements with those providers.

3.2 Training Data Prohibition Your documents, client information, and transaction data are not used to train third-party AI models. Where our AI subprocessors offer training opt-out controls, we use those controls. Contractual restrictions with providers are the primary enforcement mechanism.

3.3 Human Review In limited circumstances, Total Agent employees may review AI outputs or related logs for quality assurance, debugging, abuse prevention, or compliance. Such review is conducted under confidentiality obligations.

4. HOW WE SHARE INFORMATION

We share information only as described below:

4.1 With Your Brokerage Brokerage-visibility features, if offered and enrolled, are limited to what that enrollment and product settings expressly enable. Brokers do not automatically receive full CRM contact databases or client communication body text merely because you use Total Agent.

4.2 With Service Providers (Subprocessors) We share information with third-party service providers who perform services on our behalf. Categories include:

• Cloud infrastructure and hosting (including Supabase; application data is hosted in the United States / us-east-1 region for our primary database)
• AI processing providers (including Anthropic and transcription providers)
• Communications (SMS, voice, email delivery — including Telnyx and related carriers)
• Email/calendar connectivity (including Nylas) and OAuth providers (Google, Microsoft)
• Payment processing (Stripe)
• Showing/calendar feed providers (including ShowingTime / Webcal integrations where used)
• Website analytics and advertising measurement (Meta Platforms, Google Analytics, PostHog) — limited to our public marketing and signup pages as described in Section 1.13
• Customer support tools

4.3 With Your Authorization We share information with third parties you designate, including cooperating agents, title companies, lenders, clients you invite, and services you connect via OAuth.

4.4 For Legal Requirements We may disclose information if required by law, regulation, legal process, or government request. We will notify you of legal requests where permitted by law.

4.5 For Business Transfers If Total Agent is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of the transaction, with notice where required.

4.6 Aggregated and De-Identified Data We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you.

4.7 What We Do NOT Do We do not sell your personal information or your client data for money. We do not share your CRM contacts, client communications, listings, transactions, documents, or call content with advertisers, data brokers, or advertising networks. We do not allow third-party AI providers to train models on your data.

4.8 Advertising and Analytics on Our Public Website The one exception concerns our own marketing. As described in Section 1.13, when you have accepted it, activity on our public marketing and signup pages is disclosed to Meta, Google, and PostHog, and a hashed record of the purchase that starts a subscription is sent to Meta, to measure advertising and improve the signup experience. Under some state privacy laws — including the California Consumer Privacy Act — this kind of advertising measurement may be treated as a “sale” or as “sharing” for cross-context behavioral advertising even though no money is exchanged. If you are a resident of such a state and wish to opt out, see Section 5.6.

5. YOUR PRIVACY RIGHTS

5.1 Access and Portability You can access much of your personal information through your account settings and may request export by emailing hello@totalagent.app.

5.2 Correction You can update your account information through your account settings.

5.3 Deletion You can request deletion of your account and associated data by emailing hello@totalagent.app. We will process deletion requests within a commercially reasonable time, subject to pending transactions, legal holds, category-specific retention needs (billing, tax, audit, communications), and audit-trail integrity (including hash-chained legal acceptance records).

5.4 California and Other State Rights If you are a California resident or a resident of another state with applicable privacy laws, you may have additional rights including access, deletion, correction, and non-discrimination, and the right to opt out of the sale or sharing of personal information. Contact hello@totalagent.app. We do not sell personal information for money. For the website advertising-measurement disclosures that some state laws treat as a sale or sharing, and how to opt out of them, see Sections 4.8 and 5.6.

5.5 Marketing Communications You can opt out of marketing emails through the unsubscribe link. You cannot opt out of transactional emails (account, security, billing) while maintaining an active account.

5.6 Advertising and Analytics Choices You can accept or reject the technologies described in Section 1.13 in the privacy choices banner on our public pages, and change your choice at any time with the “Privacy choices” link. If your browser or an extension sends a Global Privacy Control signal, we treat it as a rejection: those technologies do not load, and no purchase event is sent to Meta for a checkout started from that browser. Rejecting after accepting stops them loading from the next page you view; cookies a provider has already set are controlled by that provider and by your browser. You can also limit these technologies by blocking or clearing cookies in your browser; by using an ad or tracker blocker; by installing Google’s Analytics Opt-out Browser Add-on; or by adjusting the advertising preferences in your Meta account. You may also email hello@totalagent.app to ask us to stop disclosing your website activity for advertising measurement, and we will honor that request for the contact information you give us. These choices affect our public website only — they do not affect the operation of your account.

6. DATA RETENTION

6.1 Category-Specific Retention We retain information only as long as reasonably necessary for the purposes described in this Policy, which varies by category:

• Account profile data — while your account is active and for a limited wind-down period after closure
• Billing and payment records — for the period needed for accounting, tax, chargeback, and dispute defense
• CRM / transaction documents — while needed to provide the Service and for longer periods required by legal holds or professional obligations we support technically
• Communications content and metadata — while features remain enabled and thereafter as needed for continuity, abuse prevention, and legal defense
• Call recordings and transcripts — while Calls features remain enabled for your account and thereafter for a limited operational/legal period
• AI prompts/outputs — for feature delivery, debugging, and abuse prevention for limited periods
• OAuth tokens / connection grants — while the connection is active; revoked or deleted when you disconnect
• ShowingTime / calendar feed data — while the integration remains connected
• Acquisition/checkout leads — for funnel analytics and human follow-up for a commercially reasonable period
• Website analytics, advertising-measurement, and session-replay records — retained under the retention settings configured with the providers named in Section 1.13, and not retained by us indefinitely
• Audit logs and legalAcceptances — retained as a hash-chained, tamper-evident ledger for legal defense and may outlast ordinary account deletion of other content

6.2 After Retention Period After applicable retention ends, we delete or de-identify information, except where law requires continued retention of copies. Retention and deletion timing are category-specific and are not expressed as a single universal calendar SLA.

7. DATA SECURITY

7.1 Security Measures We implement security measures appropriate to the nature of the data, including:

• Encryption in transit (HTTPS/TLS) for Platform access
• Encryption at rest for selected sensitive application data where implemented (for example certain email-body and credential storage paths), and infrastructure-provider encryption where supported
• Role-based access controls
• Secure cloud infrastructure with backups
• Tamper-evident audit logs with cryptographic hash chaining for legal acceptance records
• Employee confidentiality obligations
• Optional multi-factor authentication where offered in Settings

We do not claim continuous third-party security certifications or standing external audit warranties.

7.2 Breach Notification If a security incident affecting your personal information occurs, we will notify you and applicable regulators as required by applicable law. We do not promise a fixed short-window notification SLA beyond those legal requirements.

7.3 Your Role You are responsible for maintaining the confidentiality of your credentials, using strong passwords, enabling available security features, and reporting suspected unauthorized access.

8. INTERNATIONAL DATA TRANSFERS

Total Agent processes data primarily in the United States. Vendors may store or process information in other jurisdictions where those providers operate. We rely on appropriate contractual and legal mechanisms for international transfers where applicable.

9. CHILDREN’S PRIVACY

The Platform is not intended for users under 18. We do not knowingly collect information from children. If we discover we have collected information from a child, we will delete it.

10. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites or integrate with third-party services (for example Gmail, Outlook, Stripe, Telnyx, ShowingTime), and our public website uses the measurement and advertising services named in Section 1.13 (Meta, Google, PostHog). This Privacy Policy does not apply to those third parties. Review their privacy policies separately.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. For material changes, we will provide notice via email, in-app notification, or Platform banner with reasonable advance notice before the changes take effect. Continued use after the effective date constitutes acceptance.

12. CONTACT US

For privacy questions, concerns, or to exercise your rights:

We respond to privacy inquiries within a commercially reasonable time.

13. ACKNOWLEDGMENT

BY USING THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.