Privacy policy
CREcertainty — Privacy Policy for Google Account Data
1. What CREcertainty is
CREcertainty is commercial real estate contact-intelligence software. It reads a brokerage's historical email in order to build one shared record of the people and companies the firm knows — names, email addresses, phone numbers, job titles, employers, and the relationships between them — with each fact traceable back to the message it came from.
2. What we ask Google for
When a user connects a Gmail mailbox, CREcertainty requests exactly one Google permission: https://www.googleapis.com/auth/gmail.readonly. It is a read-only permission. CREcertainty requests no other Google scope, and it cannot send, modify, delete, or label mail.
If a user grants less than that permission, the connection is refused and nothing is stored — no credential, no partial record of the attempt.
We ask Google for offline access (a refresh token) so that a backfill can continue after the initial hour, and we explicitly decline to widen the grant with previously granted scopes.
3. What we read from the mailbox
With that permission, CREcertainty reads whole messages, in Gmail's raw format — which is the complete RFC 2822 message, including headers, message body, and any attachments carried inside it. It reads the messages the connected user's own mailbox contains.
4. What we keep, and what we do not
Gmail message text is preserved on the hosted service, the same way the product preserves any other ingested mail. Attachment bytes are never stored — only a stub (filename, type, size, and a SHA-256 fingerprint) is kept.
What the Gmail path records for each message is a small set of Gmail's own identifiers and envelope values: message id, thread id, history id, the internal date, Gmail's size estimate, Gmail's label ids, and Gmail's short preview snippet of the message text — in addition to the full message text itself, preserved as described above.
No Gmail message has been ingested by this software yet. The description above states how ingestion will work when it runs, not a record of anything that has already happened.
5. What we derive from it
From messages, CREcertainty extracts contact records: a person's name, email addresses, phone number, job title, and employer, along with how many messages support the record and how complete the evidence for it was. If the source does not contain a fact, the record holds nothing in that place — we do not infer or fill in a plausible value.
Every extracted fact keeps a link back to the message it came from.
Contact categories (role and property sector) are the one kind of value that is suggested rather than extracted: each is shown with its confidence, as described in clause 6, and is not recorded as confirmed until a person at the firm confirms it.
6. How an AI service helps categorise contacts
To suggest each contact's role (for example broker, attorney or landlord) and property sector (for example retail, office or medical), CREcertainty sends a limited set of data to TypeSafe (typesafe.ai), a third-party AI classification service: the contact's name, email address and domain, company, job title and email signature, and the text of recent messages that contact sent, with quoted earlier messages removed. Attachments are never sent. TypeSafe returns a category and a confidence percentage; it does not write text. Each result is shown in the product as a suggestion with its confidence, for a person at the firm to confirm or reject. CREcertainty does not use Google user data to train any AI or machine-learning model.
7. Where the data physically sits
- Gmail messages, once connected, are pulled, preserved and processed entirely on our hosted service. Nothing runs on a separate operator machine.
- The hosted service runs a paid Render web service, disk, and PostgreSQL database, in Render's Oregon, United States region. There is no separate storage location, because ingestion and storage both run on the hosted service.
- The database holding OAuth credentials and normalized mail is the hosted PostgreSQL database, not a machine belonging to any individual.
8. Who can see what
- The hosted service today serves a single brokerage. Isolation is achieved because there is only one firm connected, not by multi-tenant database scoping. If and when the service supports more than one firm, this page will be updated to describe how firms are kept separate from each other.
- Inside a firm, contact facts are shared across the firm. A person, company, phone number or title found in one connected mailbox is visible to the firm, with its source attached. That is what the product is for. A user may narrow a view to a single mailbox, and that is a display choice, not a wall.
Clause deliberately NOT written here: a claim that message subjects and bodies are restricted to the mailbox owner. See Part 2 — the seal that would do that is specified and NOT IMPLEMENTED.
9. What we do with your Google credential
The credential Google issues is stored encrypted, in a table with no user-facing read path. Access tokens are never stored — only the refresh token, encrypted.
The credential is not exposed anywhere in the product. Exactly one module is permitted to read it, and that is enforced by a test that fails if any other file so much as names the table — including anything in the web front end.
The credential is never printed, logged, or rendered into an error.
10. Disconnecting
Read this clause carefully; it is the one most likely to differ from what you expect.
- To end CREcertainty's access to your Gmail, revoke it in your own Google Account settings. That is the action that actually stops access.
- When you revoke at Google, CREcertainty finds out the next time it tries to use the credential: it marks the connection as revoked, stops syncing that mailbox, and does not retry.
- CREcertainty also has an operator command that marks a connection as disconnected on our side. That command does not tell Google anything, and it does not delete the stored credential — it stamps the row as revoked. After it runs, the grant is still live at Google until you revoke it there.
- Once marked revoked, the stored credential is refused by the software: the code path that loads a credential returns nothing for a revoked row rather than returning it with a flag.
11. Retention and deletion
We keep the data we extract from connected mailboxes. We have not yet set a specific retention period, and there is no automatic deletion trigger on disconnect. This clause will be rewritten again once that retention policy — not just the principle of keeping data — is decided.
There is no implemented retention period, no automatic expiry, and no deletion path that reaches mail-derived data today. To ask for data to be removed, contact privacy@crecertainty.com; removal today is a manual operator action, not an automated product feature.
12. Sharing
CREcertainty does not sell Google user data and does not share it with advertisers.
Render, Inc. (cloud hosting infrastructure) hosts the data. TypeSafe receives only the limited data described in clause 6, and only to return contact categories. No other third party receives it, and no advertiser or data broker receives it.
13. Limited Use
The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
14. Changes to this policy
Changes are posted on this page with an updated effective date. No separate email or in-product notice is sent.