Your business data is yours. This Privacy Policy explains what AgentOS collects, how we use it, who we share it with, and the rights you have over it. We do not sell personal information for money. We do use advertising tools on our marketing website and send a small number of advertising conversion events from our servers, and you can opt out of both on our Your Privacy Choices page or by sending the Global Privacy Control signal. This Privacy Policy is incorporated into the AgentOS Terms of Service Agreement (the "Agreement"); capitalized terms not defined here have the meanings given in the Agreement.
AgentOS is a software platform for real estate professionals operated by NSJ Technologies LLC, a North Carolina limited liability company doing business as AgentOS, located at 3030 Asbury Church Rd, Lincolnton, NC 28092. This policy covers our marketing website (www.getagentos.io), the AgentOS web application (app.getagentos.io), our iOS application, and the public pages our customers share through the Platform, such as client portals, seller reports, offer pages, showing booking pages, open house sign-in pages, home value pages, and OnePage agent sites.
AgentOS handles personal information in two different roles, and your rights work differently under each.
Data we control. For your account information, billing records, support communications, product usage data, and marketing website visits, AgentOS decides how and why the data is used. We are the "business" or "controller" for this data, and you can exercise the rights in Section 9 directly with us.
Data we process for our customers. When an agent or brokerage uses AgentOS to store contacts, transactions, documents, messages, showing records, open house sign-ins, homeowner portals, or survey responses, that customer is the controller and AgentOS is their service provider or "processor." We use that data only to provide the Platform, under the Agreement and our Data Processing Addendum (the "DPA"). If you are a home buyer, seller, or client of an agent who uses AgentOS and you want your information accessed, corrected, or deleted, contact that agent or brokerage. We support them in honoring your request, and if you contact us directly we will forward your request to them.
Agents and brokerages use AgentOS to publish pages such as open house sign-in sheets, showing booking forms, offer submission forms, and agent websites with a contact form. When you fill one out, the information you enter (typically your name, email address, phone number, and sometimes your home address, brokerage, or offer details) goes to the agent or brokerage that published the page. They decide how to use it and are responsible for the notice and consent the law requires. AgentOS stores it for them and does not use it for our own marketing.
If a page asks for your phone number and offers to text you, texts are sent only if you check the consent box, and you can reply STOP at any time to end them. Message and data rates may apply. Some pages embed third-party content such as maps, videos, and scheduling tools; see Section 8.
Account information: name, email address, phone number, organization name, role, profile photo, branding assets, and password credentials (stored as salted hashes). If you enable multi-factor authentication, we store the authenticator secret or send one-time codes to your email.
Customer Content: as defined in the Agreement, the information you and your team put into the Platform, including contact and lead records, transaction and property details, uploaded documents (for example executed contracts, disclosures, and compliance paperwork), notes, tasks, messages, showing and open house records, expense records and receipts, homeowner portal content, and marketing materials. This content can include personal information about your clients. Email sent to a lead inbox, showing feedback inbox, or support address you connect is also stored as Customer Content.
Voice: if you use voice memo or voice assistant features, your recording is transcribed by the providers described in Section 6. In the web application the audio is sent for transcription and is not stored. In the iOS application, voice commands may be transcribed using Apple's speech recognition.
Payment information: subscriptions are processed by Stripe. We receive your plan, billing status, billing name and address, and the last four digits and brand of your card. Full card numbers never touch our servers.
Usage and device information: log data, IP address, browser and device type, pages viewed, features used, clicks, and in-app events, collected through our own logging and through PostHog inside the application. PostHog session replay records how the interface is used with all typed input and all on-screen text masked before it leaves your browser. We associate this data with your account and organization so we can support you and understand which features matter.
Marketing and advertising data: on our marketing website, the Meta pixel collects device identifiers, pages viewed, and campaign parameters such as UTM tags and click identifiers, unless you have opted out. When you create an account or start a paid subscription, we send a conversion event to Meta from our servers that includes a hashed version of your email address, your IP address, browser information, and Meta cookie identifiers if present. We keep the campaign parameters that brought you to us on your organization record. We never send Customer Content or your clients' information to advertising partners.
Integration data: if you connect Google Drive, Microsoft OneDrive, Dropbox, or a social media account, we access only what is needed to provide the integration you asked for, under each provider's consent flow. Google Drive access is read-only. OneDrive access is read-only for files and your basic profile.
Support and staff access: when you contact support, we keep the correspondence. When our staff access your account to help you, as permitted by Section 3.4 of the Agreement, we log the session.
Acceptance records: we record the date and version of the Agreement and this policy that you accepted.
We do not intentionally collect sensitive categories of personal information such as government identifiers, financial account numbers, health information, biometric data, or precise geolocation, and the Agreement asks that you not upload them except where a real estate document genuinely requires it.
We collect information directly from you; automatically from your use of the Platform, the iOS application, and the website; from your teammates within your organization; from visitors to public pages you share; from integrations you connect; from email sent to inboxes you connect; from service providers such as Stripe and advertising platforms that tell us how you found us; and, at your request, from public sources and data providers as described in Section 6, for example public social media profiles found by web search, and property records, sale history, and value estimates from property-data providers.
We use information to: (a) provide, maintain, secure, support, and improve the Platform; (b) set up and manage accounts, organizations, and roles; (c) process subscriptions, billing, and referral credits; (d) provide support, including staff access to your account when needed; (e) send transactional notifications you and your team configure, such as deadline reminders, compliance alerts, and showing requests; (f) send product tips, announcements, and offers to account holders, including team members who are invited to an organization, each of which has a one-click unsubscribe; (g) measure and improve the product through analytics; (h) provide AI-assisted features as described in Section 6; (i) advertise AgentOS, including measuring campaigns and showing ads to people who visited our marketing website, subject to your opt-out rights; (j) detect abuse, including blocking disposable email domains and duplicate accounts at signup; (k) create aggregated, de-identified data that does not identify you, your organization, or any person, as permitted by Section 5.2 of the Agreement; and (l) comply with legal obligations and enforce the Agreement.
We do not use your data, or your clients' data, to make automated decisions that produce legal or similarly significant effects about anyone. Property value estimates and "likelihood to sell" indicators are informational tools for you as our customer; you decide what to do with them. We do not use Customer Content to train artificial intelligence models.
Some features use artificial intelligence or external data lookups. When you use them, the relevant content is sent to the provider named here and the result is returned to your account.
REx assistant, contract extraction, lead email parsing, generated insights and drafts: processed by Anthropic. To answer you, REx may receive a summary of your organization's records (contacts, transactions, tasks, goals, and reports) for the duration of the request.
Social profile lookup: when you ask REx to find a contact's public social profiles, the contact's name and the details you have recorded (location, email, phone, and how you met) are sent to Anthropic with a web search tool. The search queries are sent to a third-party search engine. Results are links to public profiles with a confidence estimate; you should verify them before acting.
Voice transcription: in the web application, audio is transcribed by OpenAI (Whisper) and the audio is not stored. In the iOS application, voice commands may be transcribed by Apple's speech recognition service under Apple's privacy policy.
Property intelligence: when you look up a property, the address is sent to RentCast for value estimates, characteristics, and sale history, and AgentOS computes an informational "likelihood to sell" estimate from that data. Results are cached for your organization for 30 days.
Listing statistics: when you ask for portal view counts, comparable sales, or listing photos, the listing address or URL is sent to HasData, Scrapfly, RapidAPI, and DuckDuckGo to retrieve public listing information.
Address geocoding and maps: addresses you enter for service areas, OnePage sites, and referral profiles are sent to OpenStreetMap Nominatim and the United States Census Bureau geocoder to obtain coordinates, and maps are drawn with Google Maps.
Under our agreements with Anthropic and OpenAI, content submitted through their business APIs is not used to train their models. AI outputs can be inaccurate and are drafts for your review, not professional advice, as Section 8 of the Agreement explains.
We do not sell personal information for money. We share information only as described here.
Service providers (subprocessors). Companies that process data on our behalf, limited to what their function requires and bound by contracts that restrict their use of your data. The current list, with each provider's purpose and the data it receives, is published at www.getagentos.io/subprocessors and is incorporated into this policy. As of the date above it includes: Vercel (hosting); Supabase (database, authentication, file storage, and functions); Cloudflare (network, inbound email routing, and bot protection); Stripe (payments); Brevo (email delivery and our product email list); GoHighLevel (text message delivery, which stores the recipient's phone number and name as a contact record); Microsoft (our support mailbox on Microsoft 365, and OneDrive); PostHog (in-app analytics and masked session replay); Anthropic and OpenAI (AI features); PDFShift (PDF generation); RentCast, HasData, Scrapfly, RapidAPI, and DuckDuckGo (property and listing data); OpenStreetMap Nominatim and the United States Census Bureau (geocoding); Google (Maps, Fonts, sign-in, and Drive); Apple (push notifications, speech recognition, and the App Store); Dropbox (file integration); and Loom (training videos). We update the list before adding a provider that processes Customer Content. These are the same Third-Party Services described in Section 11 of the Agreement.
Advertising partners. Our marketing website uses the Meta pixel to measure our ads and show ads to people who visited our site, and our servers send signup and subscription conversion events to Meta as described in Section 3. This shares limited data (device information, pages viewed, campaign identifiers, hashed email, IP address) with Meta Platforms. Some state laws treat this as a "sale" or "sharing" of personal information, or as "targeted advertising." You can opt out at Your Privacy Choices, and we honor the Global Privacy Control signal; both apply to the pixel and to the server-side events. We do not share Customer Content or your clients' information with advertising partners, and we do not show ads inside the application.
Within your organization. Your name and activity are visible to your team according to your organization's roles, and owners and administrators can see organization data, including documents submitted for compliance review, as Section 3.2 of the Agreement describes.
Our staff. AgentOS support staff may access your organization's account to diagnose a problem you reported, investigate suspected abuse or a security concern, or at your request. Staff access requires multi-factor authentication, is time-limited, is logged, and cannot be used to make payments or change billing.
At your direction. When you share a portal, report, offer, showing, or open house link, publish a OnePage site, embed a public social post, send a text or email through the Platform, configure a webhook, subscribe to a calendar feed, or connect an integration, the recipients and providers you chose receive the relevant data.
Referral Network. If you opt in to the Referral Network, the profile you choose to publish (name, brokerage, service areas, contact details, bio, and links) is visible to other AgentOS customers. You can opt out at any time in Settings.
Legal, safety, and business transfers. We may disclose information to comply with law, respond to lawful requests, protect rights and safety, or in connection with a merger, acquisition, reorganization, or sale of assets as permitted by Section 23 of the Agreement, in which case this policy continues to apply until updated.
Application. The web application uses cookies and local storage for sign-in sessions, security, and your preferences, and runs PostHog analytics as described in Section 3. The application does not load advertising trackers; the only advertising-related activity connected to your account is the server-side conversion event sent when you sign up or subscribe.
Marketing website. Our marketing website does not use analytics cookies. It uses the Meta pixel for advertising as described in Section 7, and loads fonts from Google Fonts.
iOS application. The iOS application does not use advertising trackers or request permission to track you across other companies' apps. It uses the same first-party session and analytics tools as the web application.
Opt-out signals. We honor the Global Privacy Control signal and browser Do Not Track as an opt-out of advertising sharing: when either signal is present, the advertising pixel does not load and we do not send conversion events for your account. You can also opt out manually on Your Privacy Choices; that choice is stored in a cookie for getagentos.io and its subdomains. Blocking all cookies in your browser will prevent sign-in from working.
Embedded content on shared pages. Pages our customers share with their clients may embed content from third parties, including Google Maps, Meta (for public Facebook and Instagram posts), YouTube, Vimeo, Loom, Calendly, and Google Fonts. Those providers receive your IP address and may set their own cookies under their own privacy policies when the embedded content loads.
Wherever you live, we extend the same core rights to you for data we control: you may access a copy of your personal information, correct inaccurate information, delete your information, receive a portable copy, and opt out of targeted advertising. We do not discriminate against you for exercising any right.
How to exercise rights: email support@getagentos.io from the email address on your account (or with enough information for us to verify you), or use the in-app tools: you can edit your profile, export your contacts, transactions, and tasks from Settings, and delete your user account. For a complete copy of your organization's data, email us and we will provide it in a common format within 30 days, as Section 14.3 of the Agreement provides. Authorized agents may submit requests on your behalf with proof of authorization. We respond within 45 days and will tell you if we need a 45-day extension.
Appeals: if we decline a request, you may appeal by replying to our decision with "Appeal" in the subject line. We answer appeals within 60 days. If you are unsatisfied, you may contact your state attorney general.
California notes: the categories of personal information we collect are listed in Section 3, our sharing is described in Section 7, and our advertising opt-out satisfies the "Do Not Sell or Share My Personal Information" requirement via Your Privacy Choices and GPC. In the last 12 months we have collected the categories in Section 3 and shared identifiers and internet activity with Meta for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16, do not use sensitive personal information beyond permitted purposes, and do not offer financial incentives in exchange for personal information. We do not disclose personal information to third parties for their own direct marketing.
Client data held for an agent: as explained in Section 2, requests about data an agent or brokerage stores in AgentOS are forwarded to that customer, who decides them as controller.
While your organization is active, we keep your data so the Platform works. Some records are trimmed on a schedule: text message and email delivery logs, and security and staff-access logs, are kept for 24 months.
If your subscription lapses, your organization's data is retained and your shared pages stop working until the subscription is restored, as Section 4.5 of the Agreement describes.
Deleting your user account (in Settings, or in the iOS application) removes your login and profile immediately and cannot be undone. Customer Content you created inside your organization remains with the organization and available to its remaining members, and the organization's administrators may reassign or delete it, as Section 5.3 of the Agreement provides. If you are the only member, deleting your account leaves the organization without an owner; ask us to delete the organization as well.
Deleting an organization happens when an organization owner asks us to delete it, or when an organization has had no subscription and no activity for 12 months, after email notice, as Section 14.2 of the Agreement provides. Organization deletion removes all of its Customer Content, files, and members. Deleted data is removed from our live systems within 7 days and from backups within 30 days. After deletion we retain only aggregated, de-identified data that identifies no organization or person, billing records required by tax and accounting law (typically seven years), and records we must keep to comply with legal obligations or resolve disputes. The license in Section 5.2 of the Agreement does not extend our retention of identifiable Customer Content beyond these periods.
Export before you delete. Deletion is not reversible. Use the export tools or request a complete copy first.
We use industry-standard safeguards: encryption in transit and at rest, role-based access controls with row-level database security and tenant isolation, private document storage with short-lived signed links, salted password hashing, multi-factor authentication (available to every account and required for our staff), bot protection on sign-in, rate limiting, logging of staff access, and monitoring. You are responsible for enabling multi-factor authentication and the other security features available to you, for protecting your credentials, and for the people you admit to your organization, as Sections 3 and 17.4 of the Agreement explain. No system is perfectly secure. If a breach affects your personal information, we will notify you and any affected customer (as controller) without undue delay and in any event consistent with breach notification laws in all U.S. states, and we will notify customers under the DPA within 72 hours of confirming a breach of their clients' data.
AgentOS is operated from the United States and our service providers process data in the United States. We offer the Platform only to persons and organizations in the United States and do not offer it to persons in the European Economic Area, the United Kingdom, or Switzerland. If you use AgentOS from outside the U.S., you understand that your information is processed in the U.S. and that this policy, not the law of your country, describes your rights with us.
AgentOS is a business tool. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal information, contact us and we will delete it.
AgentOS can display publicly available social media posts, including Facebook and Instagram posts, on client-facing seller reports and agent sites using Meta's official oEmbed API. This retrieves only public post content (such as images, text, and engagement counts) for display. We do not request access to private account information and do not store personal data from Meta users. When an embedded post is displayed, Meta's software runs in the viewer's browser and may set Meta cookies under Meta's privacy policy. To request removal of embedded content, email support@getagentos.io.
We may update this policy as the product and the law evolve. We will post the new version here with an updated date, and for material changes we will also notify you by email or in-app notice at least 30 days before the changes take effect, consistent with Section 20 of the Agreement. The subprocessor list at www.getagentos.io/subprocessors is updated separately as described in Section 7.
Questions about your privacy, or want to exercise a right? Email support@getagentos.io or write to NSJ Technologies LLC, 3030 Asbury Church Rd, Lincolnton, NC 28092. See also the Terms of Service Agreement, the Data Processing Addendum, and Your Privacy Choices.
Questions about your privacy, or want to exercise a right? Reach us at support@getagentos.io. See also our Terms of Service Agreement, our Data Processing Addendum, our Subprocessor List, and Your Privacy Choices.
Join hundreds of agents who replaced chaos with clarity. Setup takes five minutes. Results start immediately.
7-day free trial · no credit card · 5-minute setup