Privacy Policy

1. Introduction

REPlaybook AI, doing business as Bromwell ("Bromwell", "we", "us", "our"), operates Bromwell, an AI-powered workflow automation platform for real estate brokerages. REPlaybook AI is the entity responsible for the information described in this policy. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our platform.

By using Bromwell, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect the following categories of information:

• Account information: your name, email address, role, and brokerage affiliation provided during registration.
• Transaction data: real estate transaction details entered by you or your team into the platform.
• Connected service data: data received from third-party services you authorize, including Gmail, Google Calendar, Google Sheets, Follow Up Boss, SkySlope, and Infobip/WhatsApp integrations. Google data is described in detail in section 4.
• Usage data: log data, feature usage patterns, session information, and IP addresses collected automatically when you use the platform.
• Communication data: email content processed through the Gmail integration solely for the purpose of enabling workflow automation features you have authorized.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Bromwell platform and its features
• Power AI-assisted workflow automation and suggestions
• Sync data with third-party connectors you have authorized
• Send system notifications, security alerts, and product updates
• Improve platform features, performance, and user experience
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

4. Google User Data

Bromwell connects to Google services only when a brokerage owner or administrator explicitly authorizes the connection through Google's OAuth consent screen. Each connection can be revoked at any time. This section describes exactly which Google data Bromwell requests, what it does with it, and how long it keeps it.

4.1 Scopes we request and why

• Gmail — read (gmail.readonly): Bromwell searches the connected mailbox for messages related to your active transactions, matching on property address and on the email addresses of transaction participants. Matching messages — including subject, sender, recipients, body and attachments — are stored against the transaction so your team can see the full correspondence in one place. Messages that do not match an active transaction are not stored.
• Gmail — compose (gmail.compose): Bromwell creates draft messages in your mailbox for a person on your team to review. Drafts are never sent automatically.
• Gmail — send (gmail.send): Bromwell sends a message only after a member of your team approves it in the application.
• Google Calendar (calendar, calendar.events): Bromwell reads existing events to avoid scheduling conflicts and creates events for transaction deadlines and appointments.
• Google account email address (userinfo.email): used solely to record and display which Google account a connector is attached to.
• Google Sheets (spreadsheets): Bromwell reads the transaction spreadsheet you connect and, where you have enabled write access, updates the fields you have mapped.
• Google Drive — read (drive.readonly): used only to register and cancel a change-notification channel on the specific spreadsheet you connected, so that edits made in Google Sheets are picked up by Bromwell. Bromwell does not browse, index or download the other contents of your Drive.

4.2 Limited Use

Bromwell's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we do not use Google user data for advertising; we do not sell Google user data; we do not transfer Google user data to third parties except as necessary to provide the features you have authorized, to comply with applicable law, or as part of a merger or acquisition in which the acquirer assumes these same commitments; and we do not allow humans to read Google user data except with your explicit permission for a support request you have raised, where required by law, or where the data has been aggregated and de-identified for security or abuse investigation.

Google user data is not used to train any machine-learning model, whether ours or a third party's.

4.3 Storage and security of Google data

OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to our database, and are decrypted only in memory at the moment an authorized API call is made. Email content stored against a transaction is retained under the same terms as the rest of your transaction data (see section 7) and is isolated per brokerage.

4.4 Revoking access and deleting Google data

You can disconnect any Google connector from Bromwell at Settings → Connectors, which deletes the stored tokens for that connector. You can additionally revoke Bromwell's access from Google's own interface at myaccount.google.com/permissions.

To request deletion of Google data already stored in your Bromwell account — email threads attached to transactions, calendar events created by Bromwell, or spreadsheet sync history — email [email protected]. We action deletion requests within 30 days.

5. Data Sharing

We do not sell your personal information.

We share data only in the following limited circumstances:

• Authorized connectors: with third-party services (Gmail, SkySlope, Follow Up Boss, etc.) that you explicitly connect to your account.
• Infrastructure providers: with service providers who operate our hosting, storage, and security infrastructure under confidentiality obligations.
• Legal compliance: with law enforcement or government agencies when required by applicable law, court order, or legal process.
• AI processing: transaction and workflow data may be processed by Anthropic's Claude API to generate workflow suggestions and automations. Data sent to the Claude API is subject to Anthropic's privacy policy and is not used to train Anthropic's models per our API agreement.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit using TLS and at rest
• Access controls limiting brokerage data to authorized users within that brokerage
• Agent data visibility controls that allow brokers to restrict what agents can see
• Regular security reviews and monitoring

No system is completely secure. If you believe your account has been compromised, contact us immediately at [email protected].

7. Data Retention

We retain your account and transaction data for the duration of your active subscription plus 90 days following cancellation, during which you may export your data. After this period, your data is deleted from our systems.

You may request deletion of your data at any time by contacting us at [email protected].

8. Your Rights

You have the right to:

• Access and review your personal information
• Correct inaccurate account information
• Request deletion of your personal data
• Export your transaction data from the platform
• Revoke third-party connector access at any time via brokerage settings
• Opt out of non-essential communications

To exercise any of these rights, contact us at [email protected].

9. Cookies

Bromwell uses session cookies solely for authentication and maintaining your logged-in state. We do not use advertising, tracking, or analytics cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through an in-app notice at least 14 days before the changes take effect. Your continued use of Bromwell after changes become effective constitutes your acceptance of the updated policy.

11. Contact

If you have questions or concerns about this Privacy Policy, please contact us: