Privacy Policy

Last updated 6 August 2026

Substrait is a business tool for real estate teams. It works the leads already in a brokerage's CRM, texting and emailing them on the team's behalf, and alerting an agent the moment someone needs a human.

That shape matters for privacy, because we hold two very different kinds of data and our obligations differ for each.

What we collect

From our customers

• Name, work email, and role of each person with a login
• Brokerage name, market, and business address
• Billing contact details (payment card data goes directly to our payment processor; we never see or store card numbers)
• Product usage: what was viewed, settings changed, actions taken
• Support correspondence

From our customers' CRM, about their contacts

Substrait connects to the CRM a brokerage already uses (such as Sierra Interactive or Follow Up Boss) and reads the records it needs to do its job:

• Contact details: name, phone number, email address
• Message history between the brokerage and that contact, including messages Substrait itself sends and receives
• Stated preferences: budget, areas, timeline, property criteria
• Website activity the brokerage's own site already records, such as which listings a contact viewed or saved
• Contact preferences and opt-out status

We do not buy contact data, and we do not collect it from anywhere other than the systems our customer connects and the replies people send.

From the Substrait mobile app

• A push notification token, so we can alert you when a lead needs you
• App version and device type, for diagnosing problems

Your session is stored in the iOS Keychain on your own device. If you turn on Face ID or Touch ID, that check happens entirely on your phone through Apple's system. We never receive your biometric data, only whether the unlock succeeded.

What we do with it

• Send text messages and emails to a brokerage's contacts, on that brokerage's behalf and under its instructions
• Decide when a conversation needs a human and alert the right agent
• Write what was learned back into the brokerage's own CRM
• Operate, secure, support, and improve the service
• Meet our legal and contractual obligations

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use one customer's contact data to benefit another customer.

Automated messaging and how to stop it

Substrait sends messages on behalf of the brokerage you gave your details to. Those messages come from that brokerage's own phone number and email address, not from Substrait.

Reply STOP to any text and messaging to that number stops. We record the opt-out immediately and it is honoured across the system. Email messages carry an unsubscribe link. You can also simply tell the brokerage you would rather not be contacted, and they can switch it off from their side.

Who we share it with

We use a small number of service providers to run Substrait. Each is bound by contract to use the data only to provide their service to us:

We also write to and read from the CRM our customer already uses. That system is the customer's own, under their agreement with that vendor.

We may disclose information if the law requires it, or to protect the rights and safety of people using the service. If Substrait is ever acquired or merged, information may transfer as part of that transaction; we would notify affected customers.

How long we keep it

• Customer account data: for as long as the account is open, then up to 12 months after it closes, unless we must keep it longer for tax or legal reasons.
• Contact and conversation data: for as long as the customer's account is open. When an account closes, this data is deleted or returned on request. The brokerage keeps its own copy in its CRM regardless, that copy is theirs, not ours.
• Opt-out records: kept indefinitely. We need them to guarantee we never contact someone again after they said stop.

Security

• Encrypted in transit (TLS) and at rest
• Credentials for connected systems are encrypted with a key that is itself split across separate stores
• Access is scoped per brokerage, one customer's data is not reachable from another customer's session
• On mobile, sessions live in the iOS Keychain and can be locked behind Face ID or Touch ID

No system is perfectly secure. If a breach affects your information, we will notify you and, where required, the relevant authority.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to certain processing. Nevada, California, and several other states provide these rights; so does the GDPR for people in the UK and EEA.

How to exercise them depends on which kind of data it is. If you are our customer, write to us directly. If you are a consumer in a brokerage's database, contact that brokerage, the data is theirs and they decide; we will help them respond. Either way, write to [email protected] and we will point you the right way.

We will never treat you differently for exercising a privacy right.

Children

Substrait is a business tool and is not directed at children. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it.

Changes

If we change this policy in a way that materially affects how we handle your information, we will update the date above and tell our customers directly before it takes effect.

Contact

Privacy questions: [email protected]
Anything else: [email protected]
Substrait AI, Las Vegas, Nevada, USA