Privacy Policy

Version 1.0 · Effective October 2, 2026

This policy explains how Dwellori handles personal information. It does not replace the notice each Broker gives its own leads and contacts.

At a glance

Brokers control their lead/contact data; Dwellori processes it for them.
Dwellori controls account, security, service-operation, and platform-user data.
Dwellori does not sell personal information or use it for targeted advertising.
You can ask to access, correct, export, or delete your data at any time.

Who we are and our roles

Dwellori. Dwellori operates the Dwellori service and is responsible for the personal data it controls as described in this policy. Send privacy questions and requests to the email address in the Contact section.

Broker leads and contacts: The real estate brokerage or team using Dwellori decides why and how it uses lead and contact data. It is the controller/business. Dwellori processes that data for the Broker as its processor/service provider, under the Terms of Service and the Data Processing Agreement.
Platform users: Dwellori is the controller/business for account, workspace, authentication, security, service-operation, privacy-request, and product-administration data about Brokers, agents, ISAs, and other operators.
Gate B activation operators: Dwellori controls the limited operator linkage used for guided activation checks. That feature has a separate layered notice and its own self-service export and erase path.

Feature-specific notice: Gate B activation privacy notice.

Where data comes from

You: Account, workspace, support, import, privacy-request, and service-use information you provide.
Your Broker or workspace: Membership, role, lead, contact, assignment, consent, and workflow information entered by authorized operators.
Lead sources and imports: CSV imports, intake webhooks, and other sources configured by the Broker.
Communications and infrastructure providers: Delivery status, inbound communications, call metadata, authentication, hosting, and security events.
Service activity and derivation: Events created when people use Dwellori and scores, summaries, or signals derived from existing records when enabled.

Data categories

Account and workspace: Name, email, user and membership identifiers, workspace, role, invitations, preferences, and account status.
Lead and contact: Name, phone, email, postal address, time zone, lead source, assignments, opportunities, showings, tasks, and qualification notes.
Communications: SMS and email content, subjects, delivery events, phone numbers, call metadata, and related activity history. Dwellori does not store call audio.
Consent and communication preferences: Consent source, capture time, language/version evidence, opt-outs, suppression records, and compliance decisions.
Derived data and profiling: Lead scores, score factors, message summaries, extracted tasks or signals, response metrics, and prioritization results when those features are enabled.
Technical, device, and security: Session and membership identifiers, browser storage identifiers, IP address, user agent, request identifiers, audit events, rate-limit keys, and error metadata. Dwellori designs its logs to exclude raw sensitive payloads and credentials.
Product analytics: Pseudonymous operator, membership, lead, message, and event identifiers plus bounded properties such as role and outcome. Product-event contracts reject free-text personal-data fields.
Billing and subscription: Plan, entitlement, usage, invoice status, and payment-provider customer or subscription identifiers. Dwellori does not receive or store full payment-card details.
Privacy and compliance: Privacy-request status, verification outcome, reason, deadlines, provider-action status, legal hold, retention decisions, and audit evidence. Account setup also records exact Privacy, Terms, and acceptance-statement versions, statement text, server timestamp, evidence source, request identifier, whether the address was verified at that moment, and the IP address and browser user agent the acceptance was submitted from. That IP address and user agent are recorded only to evidence the acceptance itself and are never used for analytics, profiling, or location.

How and why we use data

Provide and secure the service: Authenticate users, enforce roles and workspace boundaries, prevent abuse, operate features, troubleshoot failures, and recover service.
Process Broker workflows: Import and manage leads, coordinate assignments and tasks, communicate with contacts, record consent, and produce Broker-requested records.
Prioritize work and measure outcomes: Calculate transparent lead scores, order eligible work queues, measure response times and product outcomes, and improve reliability when enabled.
Administer subscriptions: Apply plans, entitlements, quotas, usage controls, and payment-provider billing identifiers.
Meet legal and compliance duties: Preserve opt-out and consent evidence, respond to verified privacy requests, investigate incidents, enforce agreements, and maintain required audit records.

Legal bases where UK or EEA law applies

Broker-controlled data: The Broker chooses and documents its own legal basis. Dwellori processes this data only on the Broker's documented instructions, except where law requires otherwise.
Contract: Creating and running your account and workspace, providing the features your organization uses, and administering its subscription.
Legitimate interests: Securing the service, preventing fraud and abuse, troubleshooting, measuring and improving the product with pseudonymous analytics, and enforcing our agreements. These interests do not override your rights, and you can object to this processing.
Legal obligation: Keeping tax and accounting records, responding to privacy requests, keeping evidence of policy acceptance and communications consent, and answering valid legal process.
Consent: Any optional processing that we ask you to agree to. You can withdraw consent at any time without affecting processing that already happened.
Gate B operator linkage: Legitimate interests in platform security, product integrity, and operator-rights fulfilment, supported by a feature-specific assessment and notice.

Scoring, summaries, and automated processing

Lead scoring: When enabled, scoring uses structured factors such as contact completeness, qualification status, and recency. Scores can influence queue ordering; authorized operators can review the factors and decide what action to take.
Summaries and extracted signals: Summaries and signals are derived from records already in the workspace. Dwellori does not send message content to large language model (LLM) providers. Before that changes, Dwellori will name the provider in this policy and on the service-provider page.
Significant automated decisions: Dwellori makes no decision based solely on automated processing that has legal or similarly significant effects on a person. People decide what action to take.

Cookies and browser storage

Dwellori uses only essential authentication and workspace storage and local product-state storage. It uses no advertising cookies and no third-party behavioral analytics, so it does not ask for cookie consent.

Appwrite authentication session: Secure authentication cookie · Up to 1 year, or until you sign outEssential session credential used to keep a platform user signed in. It is restricted to the configured Appwrite project when forwarded by Dwellori.
Active workspace membership: dwellori_active_membership cookie · 30 daysStores the selected membership identifier. The cookie is HttpOnly, SameSite=Lax, and Secure outside local development.
Login completion notice: Session storage · Up to 5 minutes, one read, or tab closureStores only whether registration or password reset just succeeded; it is consumed once and is not accepted from URL parameters.
Pending account onboarding: Session storage · Up to 30 minutes, successful workspace claim, explicit cleanup, or tab closureTemporarily stores the invite or workspace code in the current tab so email verification or interrupted setup can resume. It is not placed in the verification URL or analytics.
Offline action queue and device identifier: Local storage and IndexedDB · Pending actions until synchronized or removed; removed-action archive 7 days; device identifier until browser data is clearedStores a random device identifier plus queued lead/task actions and bounded error details so an operator can synchronize or resolve offline work.
Import retry breadcrumb: Local storage · Used for 24 hours; may remain until overwritten or browser data is clearedStores an import job identifier and download time to warn against re-importing rows that already succeeded. It does not store the imported file.

Retention and deletion

Message content: 24 months after the message is createdMessage bodies are redacted unless a legal hold applies. Summaries and signals derived from a message are removed or de-identified with it.
Inactive contacts and leads: 36 months after the contact was last updatedThe contact and its dependent records are deleted unless the Broker deletes them sooner, a legal hold applies, or consent evidence for the contact must still be kept.
Consent and opt-out evidence: At least 7 years from capture; longer only while needed to prove consent or honor an opt-outConsent evidence proves that messages were sent with permission, so it blocks deletion of the related contact until it expires. Opt-out and suppression records are kept as long as they are needed to keep honoring the opt-out.
Buyer-agreement evidence for erased contacts: 7 years after the agreement expires or the last tour assessed against it, whichever is laterShows that tours met the written buyer-agreement requirement. Kept only after every party to the agreement has been erased, and only while no legal hold applies.
Privacy-request and audit records: 24 months after the request closes or the event occursKept separately from the data acted on and used only for compliance, security, and accountability.
Gate B activation data: 24-hour receipts; no more than 30 days operational; no more than 90 days tombstoneStart receipts expire first; operator linkage/digests are minimized after the support window; minimized tombstones are then hard-deleted unless legal hold applies.
Accounts and sessions: While the account is active, then deleted within 90 days of closureAccount and profile data is kept while the account is active and deleted after it is closed, except records this list says are kept longer.
Billing records: 7 years after the transactionInvoices, payments, and subscription identifiers are kept to meet tax and accounting duties.
Provider logs and backups: Logs for each provider's standard log period; database restore history up to 30 daysProvider and application logs are used only to operate, secure, and troubleshoot the service. Erased database data remains in the database provider's restore history until that window passes, and Dwellori re-erases it if a backup is ever restored.
Accounts created but never completed: 30 days after the account was createdThe authentication provider creates the account before Dwellori can record acceptance, so an account can exist with no accepted policies and no workspace access. Those accounts hold the name, email address, and password credential given at sign-up and nothing else — no workspace, contact, or message data is ever associated with them. They are deleted rather than kept.
Account policy acceptance evidence: 6 years after the account relationship endsStored separately as immutable account-level evidence, including the IP address and user agent the acceptance was submitted from. Retained to establish, exercise, or defend legal claims about the agreement, so an erasure request is refused for this record alone and honored for everything else in scope.

Legal holds and independent recordkeeping duties can delay deletion. Deletion is complete when the required service-provider actions finish. If a backup is restored before it expires, Dwellori erases the deleted data from it again.

Your privacy rights

If you are a Broker lead or contact: Contact the Broker that collected or contacted you. The Broker verifies and decides the request; Dwellori supports authorized access, correction, export, deletion, restriction, and provider follow-up as its processor. You may also email Dwellori, and we will route your request to the right Broker.
If you are a platform user: Email Dwellori to access, correct, delete, restrict, or export your data, or to object to processing. The Activation settings page also provides a self-service export and erase path for Gate B operator linkage.
Response times: We answer within one month where UK or EEA law applies and within 45 days where a U.S. state privacy law applies. If the law allows an extension for a complex request, we tell you within the original period and explain why.
Verification and appeals: We verify requests with information we already hold where possible, never ask for your password, and delete verification-only data afterwards. If we decline a request, we explain why. You can appeal by replying to our decision; a different person reviews the appeal and we answer within 45 days.
U.S. state privacy rights: Depending on where you live, including California, you may have the right to know and access, correct, delete, and receive a portable copy of your personal information, to opt out of sale, sharing, targeted advertising, or certain profiling, and not to be discriminated against for using these rights. An authorized agent may make a request for you with your signed permission.
UK or EEA rights: You may have the right to access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. Rights vary by purpose and legal basis. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Authenticated operators can review Broker-contact requests and limited activation-linkage controls in Privacy settings.

California and tracking disclosures

Sale, sharing, and targeted advertising: Dwellori does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and has not done so in the past 12 months. Dwellori uses no advertising cookies or advertising technology.
Do Not Track and Global Privacy Control: Because Dwellori does not sell or share personal information or track people across sites, these signals do not change how the service behaves. If that ever changes, Dwellori will treat a Global Privacy Control signal as a valid opt-out request.
Sensitive or special-category information: Dwellori does not ask for special-category or sensitive personal information for ordinary CRM use and does not use it to infer characteristics about people. Free-text messages, notes, addresses, and consent evidence can still reveal sensitive facts, so Brokers must minimize such content.

To make a request, use the contact below. Dwellori will not discriminate against a person for exercising a privacy right.

Security

Dwellori's safeguards include:

Encryption in transit (HTTPS) and encryption at rest by our hosting and database providers
Role and permission checks, workspace scoping, and database row-level controls
Optional multi-factor authentication, restricted authentication-cookie forwarding, and hardened membership cookies
Audit trails, provider-signature checks, rate limiting, and idempotency controls
Retention, erasure, legal-hold, and backup re-erasure procedures
Logging rules that exclude raw sensitive payloads and credentials

No service can guarantee absolute security. If a breach affects your personal data and the law requires notice, Dwellori notifies you and the relevant regulator without undue delay. Report a suspected privacy or security issue using the contact below; do not email passwords, session tokens, or raw customer exports.

Children

Dwellori is business software for adults. Users must be at least 18 years old, and Dwellori does not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it and delete its data. Brokers must not use Dwellori to collect children's data.

Changes to this policy

Each version of this policy has a version number and an effective date. For a material change, we notify workspace owners and administrators by email or in the product at least 30 days before it takes effect, and users accept the new version before they continue using the service. Earlier versions are available on request.

Contact and complaints

Include whether you are a platform user or a lead/contact, and identify the relevant Broker or workspace if known. Do not send passwords, provider tokens, or unnecessary sensitive data.

Need help? Email wcurb@proton.me. If you are stuck on this page and email is not working, ask your workspace admin for help before retrying.

If you are unhappy with our answer, you can appeal as described under Your privacy rights, or complain to the UK Information Commissioner's Office, your local data protection authority, or your state attorney general.