Aureum AI, LLC · Last Updated: ; company adoption, the approved provider register, factual verification and operational gates in th
Public notice Version 1.0 — completed release candidate. PUBLICATION HOLD: not effective; company adoption, the approved provider register, factual verification and operational gates in the companion plan remain required. Prepared Oct 6, 2026.
Aureum AI LLC (Aureum, we or us) provides relationship-management software for real estate professionals. This policy explains how information is handled through our website, CRM, account setup, demonstrations, support, connected services and enabled AI or communication features. A feature mentioned here is not a promise that it is available in every account. For records a real estate professional places in Aureum, that professional or their organization normally decides why the information is collected and used. We process those records for them under their instructions and our Data Processing Addendum. We separately handle our own account, billing, support, security and legal records. If you are an agent’s client or contact, you may contact that agent about their practices or contact us for help routing a request. This is a notice, not blanket consent to communications, recording or a new use of information. Required permissions must be obtained separately. Questions and privacy requests may be sent to support@aureumai.co.
Account and business information: name, email address, telephone number, company or brokerage, role, business contact details, authentication information, account permissions and account status. Applications and consultations may include your current CRM, client volume, business needs, booking details and feedback. Customer CRM information: contact details, property or transaction context, relationship history, notes, preferences, tags, tasks, commitments, reminders, calendar events and information imported or entered by authorized users. Communications can include message bodies, recipients, replies, attachments where supported, timestamps, delivery results and consent or opt-out evidence. Call activity is handled only for offered and enabled calling functions. Recording or transcription requires a separately enabled feature and required notices or permissions. Connected-service and AI information: data within permissions you grant to an integration; relevant prompts and source records; generated drafts, summaries, recommendations, inferred information and action records. A summary or inference about a person can itself be personal information. Signing in with Google is different from granting Gmail or Calendar access. Billing and verification information: billing contact details, plan, invoices and transaction references when billing is enabled; business identity, EIN or other information specifically required for approved messaging registration; use case, opt-in method, sample messages and registration results. Payment information is handled through the applicable payment service. Do not place complete card details, passwords or unnecessary sensitive identifiers into CRM notes or support messages. Technical and support information: IP address, browser or device information, session and authentication information, requested pages or actions, diagnostic and security events, support requests and feedback. Sources include you, authorized account users, people communicating with those users, integrations you authorize, providers supporting the service and activity on our services.
We use information to provide and support the functions requested: account access, CRM records, search, communication, scheduling, tasks, briefs, account-specific AI assistance and permitted automation. We also use relevant information to troubleshoot and maintain reliability, protect accounts, prevent abuse, administer billing, register permitted messaging services, respond to requests, enforce agreements and satisfy legal obligations. Customer contact information is not a prospect list for Aureum. We do not use customer-controlled records to advertise our business or unrelated products to those contacts. An invitation, demonstration request or existing relationship does not automatically authorize every form of later marketing. Where a law requires a specified basis, we rely on the basis appropriate to the particular activity, such as performing our agreement, complying with law, consent where required, or legitimate operational interests where that basis is available and does not override protected rights. Customer-controlled processing also depends on the Customer’s lawful instructions. We obtain any additional permission required before a materially different use.
Navius and enabled specialist agents may use relevant account records to identify commitments, prepare briefs, recommend actions, maintain supported relationship information and carry out permitted work. Enabling a defined automation may allow routine actions without approving each one. Applicable channel permission, opt-out, account restriction, pause and human-takeover rules still govern. AI can make incorrect inferences or produce inaccurate content. A score or inference is not a verified fact, and a follow-up recommendation is not a housing, lending or eligibility determination. Users can correct records and should review matters requiring professional judgment. We do not authorize using the service to make unlawful discriminatory or otherwise prohibited consequential decisions. We do not use customer-controlled personal information to train general-purpose AI models or authorize our AI providers to do so. Relevant information may be processed by approved providers for account-specific inference and authorized features. Provider retention and access are governed by the applicable service arrangement; we do not promise zero retention unless specifically verified and agreed. Google information has the additional restrictions below.
You choose whether to connect an optional service and grant its requested permissions. Depending on the functions and scopes enabled, Gmail data may include message content, participants and metadata, and permitted send or modify actions; Calendar data may include event details and authorized event actions. We use this information for the disclosed functions you request. Connecting an account alone is not authorization for unrestricted automatic sending. Aureum’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace user data and developer policy where applicable. Covered derived data remains protected. We do not use Google data for advertising, data brokerage, creditworthiness or lending decisions, or prohibited generalized model training. Human access to protected Google data is limited to the applicable permitted exceptions, such as specific recorded user authorization, necessary security or legal work, or permitted aggregated and anonymized internal operations. Transfers for a merger or asset sale involving protected Google data require Google’s specified prior explicit user consent. A general business-transfer clause does not override that requirement. You can revoke access through the connected provider’s account controls and request disconnect assistance from support@aureumai.co. Disconnecting stops future access under that connection but does not necessarily delete previously imported records or the provider’s own copies. You can request deletion separately. Provider-specific cache and deletion restrictions also apply.
We process communication content, routing, delivery status, replies and preferences to provide and protect the enabled communication service. Customers must have the authority required for each contact and purpose. Purchased-list blasting, scraped-contact campaigns and bypassing suppression are not permitted. SMS recipients can reply STOP to withdraw permission for the covered messages or HELP for assistance. They may also communicate a restriction to their agent or to support@aureumai.co; valid withdrawal methods are not limited to a keyword. A later restart requires the permission applicable to the communication. An automation switch does not restore withdrawn consent. Message frequency varies and message or data rates may apply. Email marketing opt-outs must be honored through the supplied unsubscribe method or another legally valid method. Account service notices and a customer’s client correspondence may have different purposes and applicable rules. We retain minimal restriction records where needed to prevent renewed unwanted contact. Do Not Disturb, a waiting period, automation pause and recipient withdrawal are different controls. Messaging registration may require disclosure of business information to Signal House where used, telecommunications providers, carrier-registration partners and compliance vendors. We use registration details for the requested setup, verification, compliance, troubleshooting and related security purposes, not unrelated marketing. Number assignment and release follow service and provider rules; this policy does not promise ownership or permanent non-reassignment of a number.
We disclose information to providers performing approved functions such as hosting, database and storage, authentication, security, email delivery, messaging, AI processing, billing and support. Information supplied must be proportionate to the task and subject to appropriate contractual restrictions. Our approved Subprocessor Register identifies providers processing customer-controlled records on our behalf. A provider’s own terms may separately govern its independent carrier, payment, security or legal duties. Authorized account users may access records according to their permissions. We disclose to a destination or integration when an authorized user directs it. We may disclose necessary information to advisers, courts, regulators or law-enforcement authorities where legally required or appropriate to protect rights, address fraud or resolve a dispute, subject to applicable restrictions. For an actual business transaction, necessary information may be disclosed subject to confidentiality, applicable law and continuing data protections. Protected Google information requires the additional consent described above. We do not sell personal information or share it for cross-context behavioral advertising, and we do not authorize providers to use customer-controlled information for unrelated advertising. Mobile opt-in consent is not disclosed to another business for that business’s independent marketing.
Upon adoption of this policy, Aureum will operate a release configuration that permits cookies and similar storage needed for sign-in, session security, remembered preferences and requested service operation. It does not permit advertising pixels, cross-site behavioral advertising or session replay. Optional tracking requires a separate assessed implementation and an accurate notice before activation. Browser settings may let you block or remove cookies; doing so can disrupt sign-in or other requested functions. Under the release configuration described above, Aureum does not engage in cross-site behavioral tracking. We do not change necessary session, security or preference storage in response to legacy Do Not Track signals. Where applicable law requires honoring an opt-out preference signal, including Global Privacy Control, we honor the signal for the activities it covers. These signals do not automatically disconnect an integration, cancel a subscription or replace a direct privacy request. When you follow a link to another organization’s site or authorize an external service, that organization’s own practices also apply. The choices in Aureum do not control independent activity on that external service.
When this policy takes effect, we will keep information only for the period justified by its purpose, applicable instructions and legal obligations. Customer-controlled CRM records are maintained during service unless lawfully deleted sooner. After termination, the customer export window is 30 days, with active-system deletion completed no later than 60 days after termination unless an earlier valid deletion instruction applies. The Data Processing Addendum explains the applicable process and exceptions. Identifiable AI memories, summaries and related stored copies are included in deletion. Isolated disaster-recovery copies may remain until scheduled expiry, no later than 90 days after active deletion under our adopted processing terms. A backup is not an alternative source for ordinary continued use, and deletion restrictions must be reapplied if a backup is restored. Different purposes can justify limited retention of invoices and transaction records, consent or suppression evidence, security events, verified legal holds or dispute records. We restrict such records to the remaining purpose and review them for deletion. We do not keep an entire customer history merely because one compliance record is needed. Provider obligations and a valid legal exception may affect specific records; we explain applicable limits when responding to a request unless law prohibits disclosure.
You may contact support@aureumai.co to request access, correction or deletion, ask how to export information, manage an integration, or raise a privacy concern. Depending on the law and facts, you may also have rights to portability, restriction, objection, withdrawal of consent, an authorized representative, appeal, and an appropriate regulator complaint. We do not penalize you for exercising a protected right. We verify identity and authority proportionately and request only information needed to process the request safely. We respond within the applicable legal deadline and explain a permitted denial or limitation. If a legal appeal right applies, reply with “Privacy appeal” so we can review the decision and provide the required response and regulator route. You need not use that exact subject line for a valid request. If your information belongs to an agent’s CRM account, we may coordinate with the responsible agent, who determines the relevant purposes. We will not use that relationship to avoid obligations that apply directly to us. Deleting information needed for a function may make that function unavailable. Account cancellation, an email unsubscribe, an SMS opt-out and deletion are separate requests.
When this policy takes effect, Aureum will maintain safeguards appropriate to the data and risks, including access restrictions, confidentiality obligations and secure service configurations. No service can promise perfect security. Protect your login and report suspected unauthorized access to support@aureumai.co. We investigate and provide notices required by law and applicable contracts. Aureum is a United States company. Authorized providers or personnel may process information in locations identified through our approved provider and access records. Where a cross-border transfer requires safeguards, those safeguards must be in place before the transfer. This notice does not certify Aureum under an international privacy framework or itself establish an international transfer mechanism. Aureum is intended for adult business users and is not directed to children. We do not knowingly seek personal information directly from children under 13. Contact us if you believe a child supplied information so we can investigate and take appropriate action. Customers should minimize information about children and household members in their records and obtain any authority required for lawful processing.
We identify the effective date and revision date of the published policy and provide appropriate notice of material changes. Where a new use requires consent, we obtain it before that use begins. Continued use alone does not waive privacy rights or authorize processing that requires a separate permission. Aureum AI LLC — Privacy contact: support@aureumai.co. Customers can also use this address to request the applicable DPA, approved provider information or assistance exercising privacy choices.