Privacy Policy

This policy applies to the R35 marketing website, the desktop application for macOS and Windows, and the web console. It describes information we handle both about you (as our customer) and, where relevant, the property and contact data you bring into or source through the Service.

For much of the data you put into the Service — your leads, contacts, and the content of your outreach — you decide what is collected and how it is used. For that data you act as the controller and we act as your processor, handling it on your behalf and under your instructions and our agreement with you (see Section 5). For account, billing, website, and telemetry data, we are the controller.

We collect the following categories of information:

• Account and firm information. Your name, email, password credentials, Organization/firm name and details, team members and roles, and settings you configure.
• License and device-binding data. License keys, activation status, and identifiers used to bind an installation to a specific machine, plus app version and related device information used for licensing and security.
• Leads and property data. The contacts, owners, property records, buy-box criteria, and related data you import (for example from spreadsheets or integrations) or that the Service sources from public records and county, state, and federal data sources.
• Communications content. The content and metadata of outreach you run through the Service — SMS, email, and voice calls (including, where enabled, call recordings and transcripts) — and notes, documents, and e-signature records.
• Payment information. Billing contact details and subscription records. Card and bank details are collected and processed by our payment processors, not stored by us; we receive limited information such as the last four digits and payment status.
• Usage and telemetry. How the site and app are used — pages and features used, device and app version, diagnostics, and error logs — to operate, secure, and improve the Service.
• Support communications. Messages you send us and related records.

We use the information above to:

• provide, maintain, and secure the Service, including license activation and device binding;
• perform the features you use — sourcing and organizing leads, running outreach, qualifying and negotiating, generating and signing documents, and marketing properties;
• process payments, manage subscriptions, seats, and AI credits, and prevent fraud;
• power AI features you enable, as described in Section 4;
• provide support and respond to your requests;
• monitor, diagnose, and improve performance and reliability, and develop new features;
• detect, prevent, and address abuse, security incidents, and violations of our Terms; and
• comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use the content of your outreach for our own advertising.

AI features work by sending relevant content to third-party AI and model providers to generate a result. Depending on the features you use, this can include the prompt and the context needed for the task — for example lead and property details, prior messages in a thread, documents, and instructions — sent to a model provider (directly or through a router such as OpenRouter) to draft outreach, research, negotiate, summarize, or generate documents.

We also generate embeddings (numerical representations) of certain content so AI teammates can search across your data and maintain memory and context. These may be stored to power search and recall.

Model providers process the data we send them to return a response and under their own terms and privacy commitments; providers we use are not permitted to use your content to train general models except as allowed by our agreements or your settings. You control which AI features run and how autonomously they operate. AI Output can be imperfect and should be reviewed before you rely on it (see our Terms).

The leads, contacts, communications, and property data you manage in the Service belong to you. We process them as your processor, on your instructions, to provide the Service — and we do not use the contents of your outreach for our own marketing. You are responsible for having a lawful basis and the right to collect and hold that data and to contact the people it identifies, and for honoring their privacy and opt-out rights, as described in our Terms. If you are subject to laws such as the GDPR or CCPA/CPRA as a controller of that data, our processing on your behalf is governed by our agreement with you, including any data-processing terms.

We share information with service providers ("sub-processors") who perform functions on our behalf, each receiving only the information needed for their role and required to protect it and not use it for their own purposes. Categories include:

• AI and model providers / routers (for example OpenRouter and underlying model providers) — to generate AI Output and embeddings;
• Messaging and voice providers (for example Twilio and AgentMail) — to send and receive SMS, email, and calls;
• Mapping and location services (for example Google Maps) — for location and mapping features;
• Payment processors (for example Stripe and/or Square) — to process payments and top-ups;
• Social platforms (for example Meta / Facebook and Instagram) — to publish marketing to accounts you connect;
• Cloud hosting, storage, and error-reporting/analytics providers — to run, secure, and monitor the Service;
• Data and records sources and integrations (for example DealMachine and county/state/federal records sources) — to source and enrich leads and property data.

We may also disclose information to comply with law, legal process, or lawful requests; to enforce our Terms; to protect the rights, safety, and security of R35, our users, or others; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any material change. We do not sell your personal information.

We retain information for as long as your account is active and as needed to provide the Service, and afterward for a reasonable period to meet legal, accounting, security, and dispute-resolution needs. When we no longer need information, we delete it or make it anonymous.

The Service provides retention controls so you can manage your data — including, on applicable plans, configurable retention schedules, required-disclosure and record-keeping settings, and legal-hold functionality that preserves records when needed. You can also request deletion of your account and its data (see Section 9); we will honor such requests subject to records we are legally required to keep and to any active legal hold. Because some communications pass through third-party providers, their retention of logs is also governed by their policies.

We use administrative, technical, and organizational measures designed to protect information, such as encryption in transit, access controls and role-based permissions, two-factor authentication, audit logging, and monitoring. You also play a role: keep your credentials and license keys secure, use strong passwords and two-factor sign-in, and manage your team's access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you as required by law.

Depending on your location and applicable law (such as the GDPR or CCPA/CPRA), you may have the right to access, correct, port/export, or delete personal information we hold about you; to object to or restrict certain processing; to withdraw consent; and to be free from discrimination for exercising these rights. You may also opt out of non-essential communications at any time.

The desktop application and web console include tools that support these rights — including exporting and deleting account and lead data. To make a request, use those tools or contact us at privacy@r35.to; we may need to verify your identity first, and you may use an authorized agent where the law allows. If the request concerns data you process about others through the Service, we will assist you, as your processor, in responding to that person's request. If you are unsatisfied, you may have the right to lodge a complaint with your local data-protection authority.

On this marketing website we use cookies and similar technologies for essential functions (such as remembering your theme preference and keeping the site working) and for basic analytics that help us understand traffic and improve the site. We may also use a bot-protection/verification check (for example, a challenge widget) on forms to prevent abuse. Where required by law, we will ask for your consent to non-essential cookies. You can control or block cookies through your browser settings; blocking some cookies may affect how the site works. The desktop application uses local storage needed to run the app and keep you signed in rather than advertising cookies.

The Service is intended for businesses and users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us at privacy@r35.to and we will take appropriate steps to delete it.

We are based in the United States, and we and our sub-processors may store and process information in the United States and other countries where they operate. These countries may have data-protection laws different from those where you live. Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. By using the Service, you understand your information may be transferred to and processed in these locations.

We may update this Privacy Policy from time to time. If we make a material change, we will update the "Effective / last updated" date above and provide reasonable notice through the Service or by email when appropriate. Your continued use of the Service after a change takes effect means you accept the updated policy.

Questions about this policy or a request about your data? Contact us at privacy@r35.to or through our contact page. Mailing address: O2A2 LLC, 8524 Dahlia Drive, Charlotte, NC 28213. Data-protection contact: privacy@r35.to.