Privacy Policy

This Privacy Policy explains how Xrep.AI LLC, operating as Xrep.AI ("Xrep", "we", "us"), collects, uses, shares and protects personal information when you visit our website or use the Xrep.AI platform (the "Service").

Xrep.AI is sold to real estate brokerages and the licensed professionals who work with them. In most cases your brokerage is the party that decides what goes into the Service and how long it is kept; we process that information on the brokerage's behalf. Where a brokerage's own policy conflicts with this one for information they control, theirs governs your relationship with them.

1. Information we collect

Information you give us

• Account information — name, work email address, phone number, brokerage or company name, role and seat assignment.
• Demo and contact requests — the fields you submit on our demo request form, including your message and your SMS and terms consent choices.
• Contract and transaction content — the documents you upload, create or fill in the Service, and the values written into them: party names, property addresses, prices, deposits, dates, legal descriptions, parcel identifiers, escrow and title details, signature blocks and any notes or attachments you add.
• Messages to the assistant — the text you type in the chat window, and audio you speak during a voice session.

Information we receive from services you connect

• Email — if you connect Gmail or Outlook, we receive an OAuth access token and the message content needed to summarize a thread or draft and send a message you ask for. We do not use the contents of your mailbox for advertising, and we do not sell it.
• MLS data — property records and listing sheets you import or that we retrieve to fill a contract, which may include listing agent details.
• E-signature — signer names, email addresses, signature status, timestamps and the signed document returned by the signing provider.

Information collected automatically

• Session and security data — a session cookie, a CSRF token, IP address, browser user agent, and timestamps of sign-in and of actions taken on a contract.
• Audit records — an append-only log of who did what to a contract and when. This is a core feature of the Service and cannot be selectively switched off for an individual action.

2. How we use information

• To provide the Service: filling, editing, reviewing, routing, signing and tracking contracts, and delivering notifications about them.
• To generate contract values, summaries and drafts using an AI model, based on what you supply and the records you import.
• To authenticate you, keep organizations separated from one another, and detect and investigate abuse or security incidents.
• To maintain the audit trail and review history that brokerages rely on for compliance and dispute resolution.
• To respond to a demo request, support question, or other message you send us.
• To send transactional email about your account, your contracts, and signature events. These are not marketing messages and cannot be unsubscribed from while your account is active.
• To send SMS messages, only where you have given the separate consent described below.
• To comply with law and enforce our agreements.

3. AI processing

The Service sends the content you provide — your messages and the contract, MLS and email content relevant to your request — to a third-party large language model provider in order to generate a response or fill a field. Output is generated by a model and can be wrong. You remain responsible for reviewing every value before a document is sent, signed or relied on. See our Terms of Service for more.

4. Text messages

If you check the SMS box on our demo request form, you consent to receive SMS or text messages from Xrep.AI at the number you provided, regarding updates, offers and customer care. Message and data rates may apply and message frequency varies. Reply HELP for help and STOP to cancel at any time. Consent to receive marketing text messages is not a condition of purchase. Mobile opt-in data and consent are not shared with third parties for their own marketing.

5. How we share information

We do not sell personal information. We share it only as follows:

• Within your organization — with the brokerage that administers your seat, and with the members of it who are entitled to see a given contract. Your brokerage's administrators can see your seat, role and activity.
• With counterparties you choose — when you send a contract for review, share it with the agent on the other side, or route it for signature, the document and the message you write go to the people you name.
• With service providers that operate parts of the Service on our behalf, under contract and only for that purpose:

Provider	Purpose
OpenAI	AI model that powers the assistant and field filling
Dropbox Sign; Documenso	Electronic signature collection and signed-copy retention
Google (Gmail); Microsoft (Outlook)	Optional email connection you authorize
LiveKit; Deepgram	Live voice sessions and speech transcription
Resend; SendGrid	Outbound transactional email
Amazon Web Services	Document, image and database storage and hosting
MLS data providers	Property records used to fill contracts

• For legal reasons — where we believe disclosure is required by law, subpoena or other legal process, or is necessary to protect the rights, safety or property of Xrep.AI, our customers or the public.
• In a business transfer — in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

6. Retention

We keep contract records, audit logs and signed documents for as long as your brokerage's account is active, and afterwards for as long as needed to meet legal, accounting, or record-retention obligations that apply to real estate transactions. Because the audit trail is append-only and exists to establish what happened to a document, entries in it are not deleted on request while the underlying record must be retained.

When a member is removed from a brokerage, their contracts and templates are transferred within the organization rather than deleted, and the audit log keeps the original attribution.

7. Security

We use Argon2 password hashing, server-side sessions, CSRF protection on state-changing requests, hardened security headers, encrypted transport, and organization-scoped queries designed so that there is no fallback path that returns another organization's records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

• You can access and correct most of your account information in the Service, or by contacting us.
• You can disconnect a connected Gmail or Outlook account at any time in settings, which revokes our access token.
• You can withdraw SMS consent by replying STOP, and withdraw consent to electronic records as described in our eSign Consent.
• Depending on where you live, you may have the right to request access to, deletion of, correction of, or a portable copy of your personal information, and to appeal a refusal. Where your information is held on a brokerage's behalf, we will refer your request to that brokerage and support them in responding.
• We do not discriminate against you for exercising these rights.

To make a request, email info@xrep.ai.

9. Cookies

We use strictly necessary cookies only: a session cookie that keeps you signed in and a CSRF token that protects state-changing requests. We do not use advertising cookies or third-party tracking pixels on the Service.

10. Children

The Service is for licensed professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children.

11. Changes to this Policy

We may update this Policy. When we do, we will revise the "Last updated" date above, and for material changes we will provide additional notice through the Service or by email.

12. Contact

Xrep.AI LLC
6709 East Ave, Chevy Chase, MD 20815
info@xrep.ai