Privacy Notice

Coordy CRM ("Coordy," "we," "our," or "us") is committed to protecting the privacy of individuals who use our platform. This Privacy Notice explains how we collect, use, disclose, and safeguard your information when you access or use our Services. By using the Services, you agree to the practices described in this Notice. If you do not agree, please discontinue use of the Services.

We collect information you provide directly, information generated through your use of the Services, and information received from third parties:

• Name, email address, phone number, and login credentials
• Brokerage or company name, role, and license information (if applicable)
• Profile settings and preferences

• Client and lead information you enter, including names, contact details, and notes
• Transaction records, documents, checklists, and associated metadata
• Task history, calendar events, and communication logs

• IP address, browser type, operating system, and device identifiers
• Pages visited, features used, session duration, and clickstream data
• Error logs, performance data, and diagnostic information

• OAuth tokens and connection metadata for services users or their organizations choose to connect, including Microsoft, Google, cloud storage providers, email providers, calendar providers, and other supported integrations.
• Metadata necessary to provide and synchronize authorized third-party integrations, including calendar events, email metadata, connected storage references, file identifiers, folder identifiers, and integration status information.
• MLS/IDX listing information accessed through approved MLS, IDX, API, or data-provider integrations.
• Authorization and connection information associated with participating brokerages, agents, offices, and approved MLS users, where permitted by the applicable MLS or data provider.

We use the information we collect to:

• Provide, operate, and maintain the Services
• Authenticate users and manage account access and permissions
• Process transactions, route workflows, and coordinate document handling
• Deliver notifications, reminders, and platform communications
• Support integrations with third-party services you authorize
• Analyze usage patterns to improve product features and user experience
• Detect, investigate, and prevent fraud, abuse, or security incidents
• Comply with legal obligations and respond to lawful requests
• Enforce our Terms & Conditions and other applicable policies

We do not sell personal information.

We do not use customer CRM data, client information, transaction data, communications, documents, or MLS/IDX data to train general-purpose artificial intelligence or machine learning models for commercial distribution.

Any artificial intelligence functionality provided through Coordy is intended solely to assist authenticated and authorized users with permitted platform activities, including communication drafting, summarization, workflow assistance, productivity recommendations, reporting, document organization, and operational insights.

Coordy processes MLS/IDX data solely to provide features authorized by participating users, brokerages, applicable MLS organizations, and governing data-license agreements.

To the extent applicable under data protection laws (including GDPR), we rely on the following legal bases to process your personal information:

• Contract performance — processing necessary to deliver the Services you have subscribed to
• Legitimate interests — security, fraud prevention, platform improvement, and abuse detection
• Legal obligation — compliance with applicable laws, regulations, and lawful authority requests
• Consent — where you have provided explicit consent, such as for optional integrations or marketing communications

We do not sell or rent your personal information. We may share information in the following circumstances:

Brokerages, admins, and team leaders may have access to activity and operational data associated with agents and users under their account, as described in our Terms & Conditions.

We may share information with vetted third-party service providers that assist us in operating the Services, including infrastructure providers, database providers, authentication providers, payment processors, communication providers, artificial intelligence service providers, and cloud storage providers authorized by the customer.

These providers may process information only as necessary to perform services for Coordy or the customer and remain subject to applicable contractual, security, confidentiality, and data-protection obligations.

We may disclose information where required by law, subpoena, court order, or regulatory authority, or where we believe in good faith that disclosure is necessary to protect the safety, rights, or property of Coordy, our users, or the public.

In the event of a merger, acquisition, asset sale, or restructuring, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

The Services may include integrations with third-party platforms and providers, including Microsoft OneDrive, Microsoft 365, Google Drive, Gmail, Google Calendar, communication providers such as Twilio, MLS/IDX data providers, payment processors, electronic signature providers, artificial intelligence service providers, and other supported services.

Coordy accesses only the information and permissions reasonably necessary to provide the specific integration authorized by the user or their organization. Users may revoke supported integrations through Coordy, the applicable provider, or both, subject to the provider's own controls and technical requirements.

When you connect a third-party service:

• You authorize Coordy to access relevant tokens, metadata, and permitted data needed to provide the integration.
• Third-party account credentials remain with the third-party provider and should not be disclosed directly to Coordy.
• That third party's own privacy policy governs their handling of your data on their platform.
• Revoking an integration stops future authorized access, subject to processing delays and the third party's own systems.
• Revocation does not automatically delete information previously stored in Coordy where retention is still permitted or required.
• Documents stored in a customer-connected storage provider remain controlled by that customer and subject to the provider's own policies and security systems.

Coordy is not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies before authorizing any integration.

Google API Services Limited Use Compliance. Coordy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace and Gmail user data is used only to provide user-facing features authorized by the user. Coordy does not sell Google user data, use Google user data for advertising, or use raw, aggregated, or derived Google Workspace or Gmail user data to train, develop, or improve generalized artificial intelligence or machine-learning models.

We use cookies and similar tracking technologies to operate the Services, maintain authentication sessions, remember preferences, and analyze platform usage. Categories of cookies we use include:

• Strictly necessary — session authentication, security tokens, and core platform functionality
• Functional — user preferences, UI state, and personalization settings
• Analytics — aggregated usage statistics and feature adoption metrics (no cross-site tracking)

You may configure your browser to refuse cookies; however, doing so may limit your ability to use certain features of the Services. We do not currently respond to browser Do Not Track signals.

Coordy retains account information, CRM records, communication logs, operational metadata, integration metadata, security records, and other information for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and protect platform integrity.

Documents and files uploaded, created, or accessed through Coordy may remain stored within a supported cloud storage provider selected and connected by the customer, such as Microsoft OneDrive or another supported provider.

Customers control the retention, deletion, backup, access permissions, and lifecycle of documents stored within their connected storage provider, subject to that provider's own terms, settings, and legal obligations.

If a customer disconnects, revokes authorization to, deletes, or otherwise removes access to a connected storage provider, documents stored within that provider may no longer be accessible through Coordy.

Following account cancellation or termination, Coordy may retain information for the period reasonably necessary to satisfy legal, regulatory, contractual, fraud-prevention, security, dispute-resolution, and legitimate business requirements. Information may later be deleted, de-identified, or anonymized in accordance with applicable law and internal retention practices.

We implement commercially reasonable technical and organizational security measures to protect your information, including:

• Use of HTTPS/TLS for platform traffic in deployed environments
• Encrypted storage of third-party integration tokens (AES-256-GCM)
• Role-based access controls and permission scoping
• Operational diagnostics and infrastructure monitoring where configured

Documents stored within customer-connected cloud storage providers remain subject to the security controls, availability, permissions, retention settings, and account protections of those providers.

Customers are responsible for maintaining the security of their connected storage accounts, including passwords, multi-factor authentication, user access, sharing permissions, backup settings, and retention policies.

Coordy uses authorization-based integrations and accesses connected services only within the permissions granted by the customer, the third-party provider, and applicable agreements.

No method of transmission, storage, or electronic processing is completely secure, and Coordy cannot guarantee absolute security.

No security system is impenetrable. We cannot guarantee the absolute security of your information. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

Depending on your jurisdiction, you may have rights with respect to your personal information, including the right to:

• Access a copy of the personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data (subject to legal retention obligations)
• Object to or restrict certain processing activities
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with a data protection authority (for EEA/UK users)

To exercise any of these rights, contact us at support@coordycrm.com. We will respond within the timeframe required by applicable law. We may need to verify your identity and authority before fulfilling a request.

Where the Services include access to MLS or IDX information, that information is obtained through approved MLS organizations, IDX providers, API platforms, participating brokerages, or other authorized data sources.

MLS/IDX information remains subject to the applicable vendor agreements, data licenses, IDX rules, MLS rules, display requirements, confidentiality requirements, refresh obligations, and other restrictions imposed by the relevant MLS or data provider.

Coordy accesses, stores, displays, and processes MLS/IDX information only as permitted under applicable agreements and only to provide authorized Services to participating users and organizations.

Coordy does not sell MLS/IDX data, independently redistribute it outside authorized contexts, use it to train general-purpose AI models, or use it for purposes beyond those permitted by the applicable MLS, IDX provider, data provider, or licensing agreement.

Users, brokerages, and organizations accessing MLS/IDX functionality through Coordy remain responsible for maintaining any required membership, authorization, brokerage approval, licensing status, and compliance obligations applicable to their use.

The Services are intended for adults aged 18 and older operating in a professional real estate context. We do not knowingly collect personal information from children under 13 (or under 16 where required by applicable law). If we learn that we have collected personal information from a minor, we will take steps to delete that information promptly. If you believe a minor has submitted information through the Services, please contact us at support@coordycrm.com.

Coordy is operated from the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. Data protection laws in those countries may differ from those in your jurisdiction.

By using the Services, you consent to the transfer of your information to the United States and other countries as described in this Notice. Where required by applicable law, Coordy will use appropriate legal or contractual safeguards for international transfers.

We may update this Privacy Notice from time to time. When we make material changes, we will update the Effective Date at the top of this page and, where appropriate, notify you via in-platform notice or email. Your continued use of the Services after any update constitutes your acceptance of the revised Notice.

For privacy-related questions, requests, or concerns, please contact us: