Your data,
handled honestly.
How RealtrAI collects, uses, stores, and protects your information. Plain language, with the legal precision the law requires.
Introduction
This Privacy Policy explains how RealtrAI ("RealtrAI," "we," "our") collects, uses, stores, and protects information when real estate professionals use our platform at realtrai.com and related services (the "Services"). RealtrAI is operated by Trunnion AI, a wholly-owned subsidiary of Viceroy NM, headquartered in Albuquerque, New Mexico.
This policy applies to all visitors to our website, all account holders, and all team members on a Team or Brokerage subscription. It does not apply to third-party services we link to (CRMs, MLS providers, payment processors); those services have their own privacy policies which we encourage you to read.
By using the Services, you agree to the practices described in this policy. If you do not agree, please do not use the Services.
Information We Collect
We collect the following categories of information, only what is necessary to provide and improve the Services.
Account Information
Name, email address, phone number, mailing address, firm or brokerage name, MLS license number, and (for Brokerage plans) office locations and team rosters. Account information is collected during signup, during onboarding, and when you update your profile.
Authentication and Billing
Hashed passwords (we do not store passwords in plain text), single sign-on (SSO) tokens for those who connect via Google, Microsoft, or Okta, and billing information processed by our payment provider Stripe. We do not receive or store full credit card numbers; Stripe holds that data and provides us only a tokenized reference.
Content You Provide
Property addresses, listing descriptions you paste in, attendee sign-in data, investor contact records, photos you upload, brand assets (logos, color palettes, voice profiles), and any drafts or final outputs generated through the Services. This content remains your property at all times.
MLS and Property Data
When you query a property, we retrieve relevant MLS data and county-level property records through our licensed data partners. The data is scoped to your verified MLS license; we do not retrieve or display data outside of the access your license entitles.
Usage Data
How you interact with the Services: tools used, documents generated, features clicked, time spent on pages, error and crash reports, IP address, browser type and version, operating system, and device characteristics. Usage data is used in anonymized aggregate to improve the Services.
Cookies and Tracking
See Section 09 (Cookies and Tracking) for our use of cookies and similar technologies.
How We Use Information
We use the information we collect for the following purposes:
- Provide the Services: Generate documents, analyze properties, retrieve market data, run integrations with your CRM, and deliver outputs to you
- Authenticate accounts: Sign you in, verify MLS licensing, prevent unauthorized access
- Bill and account for usage: Manage subscriptions, process payments, calculate document volume
- Customer support: Respond to questions and requests, troubleshoot issues, deliver onboarding and training
- Improve the Services: Analyze anonymized usage patterns to identify what's working and what's not
- Communicate with you: Send transactional notices (billing, security, service status), product updates, and (with your consent) marketing communications
- Security and abuse prevention: Detect fraudulent or abusive use of the Services and enforce our Terms of Service
- Legal compliance: Respond to lawful requests from authorities, fulfill regulatory obligations, and protect our legal rights
We do not sell your personal information. We do not share it with advertisers. We do not allow it to be used for cross-context behavioral advertising.
AI & your data.
RealtrAI is built on the Trunnion AI Declarative Agentic Framework. We have a clear, simple policy on how the framework treats your data.
Your client data, MLS feeds, uploaded content, and generated documents are NOT used to train RealtrAI's underlying models. Period. The Trunnion AI DAF framework is built on tenant isolation: your data stays scoped to your account and is not co-mingled with other accounts or used to refine general-purpose AI capabilities.
What We Do Use For Improvement
We use anonymized, aggregated usage data (which features are popular, which tools are most valuable, where errors occur, where activity drops off) to improve the platform. This data is stripped of any client-identifiable information before analysis.
Third-Party AI Providers
We use third-party AI infrastructure providers (including Anthropic and OpenAI) for some model inference. These providers are contractually prohibited from training their models on data passed through our integration; we operate under enterprise agreements that include zero-retention or short-retention terms (typically 30 days for abuse-detection purposes only).
Your Generated Content
Drafts and final documents generated by the Services are stored in your account so you can return to them, edit them, and re-export them. They are not used to improve the platform's models. They remain yours, and you can delete them at any time.
Data Retention
During Your Subscription
While your account is active, we retain your account information, generated content, and usage history so the Services work as expected (drafts can be reopened, archives can be searched, integrations can run continuously).
After Cancellation
If you cancel your subscription, we retain your account and generated content for ninety (90) days so you can export your archive or reactivate. After that 90-day window, your data is permanently deleted from production systems. You may also request immediate deletion at any time during the window by emailing hello@realtrai.com.
Backups
Our infrastructure providers maintain a thirty (30) day rolling backup window for disaster recovery. Backup copies of deleted data persist for up to thirty days before being expired according to that rolling schedule. After expiration, no copies remain.
Legal Hold
We may retain certain information beyond the periods above if required by law (for example, billing records for tax purposes) or in connection with a pending legal matter. Retention beyond the standard schedule is documented and auditable.
Data Security
We take reasonable and appropriate measures to protect the information we hold from loss, theft, unauthorized access, disclosure, alteration, and destruction.
Technical Safeguards
- Encryption in transit: All data flows between your browser and the Services over TLS 1.3
- Encryption at rest: Stored data is encrypted with AES-256 in our infrastructure providers' systems
- Tenant isolation: Account data is logically separated; no cross-tenant access by design
- Access controls: Internal access to production data is limited to authorized engineers, logged, and reviewed
- SSO and MFA: Single sign-on and multi-factor authentication are supported and recommended
Compliance and Auditing
Our infrastructure providers (AWS, GCP) are SOC 2 Type II certified. RealtrAI's own SOC 2 Type II audit is in progress with an expected completion in 2026. Annual third-party penetration testing is conducted; the most recent report is available under NDA on Brokerage plans. We will publish audit summaries in our Trust Center as they are completed.
Incident Response
We maintain a documented incident response plan. In the event of a data breach affecting your information, we will notify you and any applicable regulatory authorities within the timeframes required by law (typically 72 hours under GDPR, where applicable, and within "reasonable time" under most US state laws).
Your Role
Security is shared. You are responsible for maintaining the confidentiality of your account credentials, enabling MFA, and notifying us promptly if you suspect unauthorized access. Most account compromises we have seen happen via reused passwords on other services; we strongly recommend a unique strong password on your RealtrAI account.
Your Rights & Choices
You have a number of rights regarding your personal information. Some of these rights vary by jurisdiction; we honor them globally where reasonably possible.
Access and Portability
You may request a copy of the personal information we hold about you. The export is provided in a machine-readable format (JSON or CSV) suitable for portability to another service.
Correction
You may correct inaccurate information directly in your account settings or by contacting us at hello@realtrai.com.
Deletion
You may request deletion of your account and associated personal information at any time. We will honor the request within 30 days, subject to any legal retention requirements (for example, billing records).
Opt-Out of Marketing
You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or updating your communication preferences in account settings. Transactional notices (billing, security, service status) will continue regardless of marketing preferences.
California (CCPA / CPRA)
California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know what categories of personal information we collect, the right to request deletion, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising), and the right to limit the use of sensitive personal information. To exercise these rights, contact us at hello@realtrai.com.
European Economic Area / UK (GDPR)
If you are in the EEA or UK, you have rights under the General Data Protection Regulation, including access, rectification, erasure, restriction of processing, data portability, and objection. The legal basis for our processing is typically the performance of a contract (providing the Services), our legitimate interests (improving the Services and preventing fraud), or your consent (marketing communications). You may lodge a complaint with your local data protection authority.
How to Exercise Your Rights
Email hello@realtrai.com with the subject "Privacy Request" and a description of what you would like. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.
Cookies & Tracking
We use cookies and similar technologies (local storage, session storage) for the following purposes:
Strictly Necessary
Cookies required for the Services to function: authentication tokens, session state, CSRF protection, and security. These cannot be disabled without breaking core functionality.
Functional
Cookies that remember preferences (theme, language, recently used tools) so you do not have to re-set them on every visit. You may disable these in your browser settings; the Services will still work but some preferences will not persist.
Analytics
Anonymized analytics cookies (we use a privacy-friendly analytics provider with no cross-site tracking) help us understand which features are used and where errors occur. No personally identifiable information is collected by our analytics. You may disable analytics cookies in your browser settings or use Do Not Track signals, which we honor.
No Advertising Cookies
We do not use advertising cookies, retargeting pixels, or third-party trackers. RealtrAI is not an ad-supported service and does not allow third parties to track you across sites via our platform.
International Data Transfers
RealtrAI is operated from the United States. By default, all data is stored and processed in US-based AWS regions. If you access the Services from outside the US, your information will be transferred to, stored, and processed in the United States.
Transfer Mechanisms
For information transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and supplementary measures consistent with the EDPB recommendations. We can provide a copy of the SCCs on request.
Alternative Regions
Data residency outside the US (EU regions, UK, Canada) is available on Brokerage plans on request. Contact us if your firm has data-residency requirements that we should accommodate before contracting.
Children's Privacy
The Services are intended for licensed real estate professionals and are not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided personal information to us, please contact hello@realtrai.com and we will investigate and delete the information promptly.
Changes to This Policy
We may update this Privacy Policy from time to time as the Services evolve, as we add new features, or as legal requirements change. The "Effective" date at the top of this policy is updated whenever we make changes.
Material Changes
For changes that materially affect your rights or how we handle your information, we will provide notice at least 30 days before the change takes effect. Notice may be by email to your account address, by a banner inside the Services, or both. Continued use of the Services after the effective date constitutes acceptance of the updated policy.
Minor Changes
For non-material changes (clarifications, formatting, typo corrections), we may update the policy without prior notice. The version history is available on request.
Contact Us
If you have questions about this Privacy Policy, want to exercise your rights, or want to report a concern, contact us:
hello@realtrai.com · with subject "Privacy" for fastest routing
Postal Mail
Trunnion AI / Viceroy NM
Attn: Privacy
Albuquerque, New Mexico, USA
Response Time
Privacy inquiries are answered within five (5) business days. Formal rights requests (access, correction, deletion, portability) are fulfilled within thirty (30) days as required by applicable law. Urgent security concerns (suspected breach, account compromise) should be flagged in the email subject line; we treat those with same-day priority.
Get a real answer,
fast.
Privacy and data-handling questions go straight to the team that owns the policy. No tier-one ticket queue. Five business days max for general questions, same day for security concerns.
Built for agents.
Honest with data.
Seven days, all seventeen tools, no credit card required. The data you bring stays yours.