Who we are and what this covers
Rhome Exchange Inc., a Delaware corporation ("RhomeX," "we," "us," or "our") operates the RhomeX platform, including SuperAgent, DealVault, and Jarvis, available at rhomex.com, through our mobile applications, and through related services (together, the "Services").
This policy explains how we collect, use, share, and protect personal information when you visit our website or use the Services. RhomeX is built for working professionals; much of the data on the platform is information our members bring about their own clients and transactions, and this policy covers that data too.
AI on this platform
RhomeX uses artificial intelligence. We say so plainly here because you should not have to infer it.
What the AI does
Jarvis, our assistant, can draft messages and documents, organize and summarize your records, transcribe and summarize phone calls, answer inbound calls where a member enables that feature, score and flag records, and carry out tasks a member directs inside the platform.
What the AI never does alone
Jarvis prepares; humans decide. It never signs a document, never gives the advice or opinion a licensed professional is responsible for, and never moves money. Drafts wait for a human to review and send them, and actions the AI takes are logged.
How AI involvement is disclosed
- On phone calls, the assistant identifies itself as Jarvis. It truthfully confirms it is an AI assistant whenever it is asked, and it identifies itself as automated proactively where state law requires that disclosure.
- Recording disclosures: on inbound calls to a line with recording enabled, a disclosure is played before the call is connected. On outbound calls placed by the AI dialer, a recording disclosure is given where the recipient's state requires all-party consent.
- AI-drafted content is presented to the member as a draft for review before it goes anywhere.
Which AI providers are involved
AI features are delivered with Google (Gemini models) for assistant reasoning and drafting, OpenAI for the realtime voice path, and ElevenLabs for speech synthesis. Content is sent to these providers to process your request and is not used by us to train AI models on your personal content.
Information we collect
Information you provide
- Account and profile: name, email, password (held by Firebase Authentication, never stored by us in plain text), phone, brokerage or company, professional title, location, license number, and website.
- Work content: contacts, deal data, documents, listing photos, messages, campaign content, agent website content, and file uploads.
- E-signature data: signatures, signer names and emails, and the audit trail described below.
- Payment details: entered directly with Stripe on Stripe-hosted pages. We receive and store only tokenized metadata such as card brand, last four digits, and expiry.
- Newsletter signup: your email address and where on the site you signed up. Nothing else.
Information collected automatically
- Visit data on our website: IP address, browser and device information, referrer, UTM and click identifiers, screen size, timezone, language, and page performance timings, tied to a first-party visitor and session identifier. This is sent only to our own servers.
- Usage data in the product: features used, access times, and diagnostic events.
- E-signature audit data: signing IP address, browser user agent, timestamps, and verification status, kept as the legal audit trail for the signed document.
- Google Analytics (GA4) collects site usage data for our analytics property (measurement ID G-P9NQRYQSRM). It is the only third-party analytics tag on our site. We use no advertising pixels.
Information members bring about others
Members upload information about their clients and transaction parties: contact records, documents, and communications. Members are responsible for having the right to bring that data onto the platform; we process it to provide the Services to the member, under our Terms of Service.
How we use information
- Provide, maintain, secure, and improve the Services.
- Process payments and manage subscriptions.
- Enable collaboration: deal workspaces, messaging, invitations, and e-signatures.
- Power AI features as described in Section 2.
- Send transactional notifications such as deal updates and signature requests, and, if you subscribed, the newsletter (you can unsubscribe any time).
- Provide support and respond to inquiries.
- Analyze aggregate usage to improve the platform.
- Detect and prevent fraud, abuse, and security incidents.
- Comply with legal obligations and enforce our Terms.
The data inventory
One table, the whole picture: each category of data we handle, why we handle it, and who processes it.
| Category | What | Why | Processed by |
|---|---|---|---|
| Account and profile | Name, email, phone, company, title, license number; IP address at signup is held separately in short-lived fraud-prevention logs, not on your profile | Run your account, prevent fraud | Google (Firebase Authentication and Firestore) |
| Contacts and deals | CRM contacts, deal records, documents, messages, milestones | The core product | Google (Cloud infrastructure); visible to deal participants you invite |
| E-signature records | Signature, signer identity, IP, device, timestamps | Legal audit trail for signed documents | Stored on our infrastructure with the document record |
| Payments | Card brand, last four digits, expiry, billing status | Subscriptions and billing | Stripe (card entry happens on Stripe; full card numbers never reach us) |
| Calls and texts | Phone numbers, message content, call metadata, recordings and transcripts | Phone, SMS, and dialer features | Twilio; AI providers below for transcription and summaries |
| Platform email | Recipient addresses, message content, delivery events | Notifications, e-sign requests, campaigns | Mailgun |
| Connected inboxes | Gmail or Outlook messages and calendar events, encrypted OAuth tokens | Inbox and calendar features you connect | Google (Gmail, Calendar), Microsoft (Outlook via Graph) |
| Video calls | Room and participant metadata, call media | Deal video chat and huddles | LiveKit |
| AI processing | Content you submit to Jarvis, call audio for transcription | AI features (Section 2) | Google (Gemini), OpenAI (realtime voice), ElevenLabs (speech synthesis) |
| Identity verification | Government ID and selfie data, in lending flows that require it | Know-your-customer verification | Persona |
| Direct mail | Recipient mailing addresses, mail piece content | Print campaigns and address verification | Lob |
| Property research | Property records, ownership and contact data | Market data and research features | RealEstateAPI |
| Website delivery | Network traffic and IP addresses in transit to rhomex.com | DNS and content delivery network in front of our site | Cloudflare |
| Site analytics | Visit and usage data on rhomex.com | Understand site traffic | Google Analytics (GA4, measurement ID G-P9NQRYQSRM); first-party visit tracking goes only to our own servers |
| Newsletter | Email address and signup source | Sending the newsletter you asked for | Stored on our infrastructure; sent via Mailgun |
| File uploads | Documents, photos, audio, site assets | Storage for product features | Google (Firebase Storage) |
Connected email and calendar
Members can connect their own Gmail or Microsoft Outlook account to use their inbox and calendar inside the platform. When you connect an account:
- We access messages and calendar events only to provide the features you connected the account for: reading and sending mail from the platform and syncing calendar events.
- OAuth tokens are stored encrypted, and access ends when you disconnect the integration.
- RhomeX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Calls, texts, and recordings
- Calls and texts made through the platform run on Twilio. We keep call metadata, message content, and delivery status so your communication history works.
- Where a member enables call recording: on inbound calls, a recording disclosure is played before the call is connected; on outbound calls placed by the AI dialer, a recording disclosure is given where the recipient's state requires all-party consent. Recordings may be transcribed and summarized by the AI providers in Section 2.
- The platform maintains do-not-call handling and calling-hours safeguards; members remain responsible for their own compliance with telemarketing laws.
Security
- Encryption in transit (TLS) for all traffic, and encryption at rest on Google Cloud infrastructure (AES-256 by default).
- Role-based access rules on every record: deal data is visible only to the workspace members and invited participants a role permits.
- OAuth tokens and integration credentials stored encrypted; service secrets held in Google Cloud Secret Manager, not in code.
- Complete audit trails on e-signatures, and logging of actions AI features take.
- Raw card numbers never touch our systems; card entry happens on Stripe-hosted pages.
No system is completely secure, and we cannot guarantee absolute security. If you find a vulnerability, tell us at [email protected].
How long we keep information
| Data | Kept for |
|---|---|
| Account data | Until you delete your account |
| Deal data | Life of the workspace, plus 7 years |
| E-signature records | Minimum 7 years (regulatory audit trail) |
| Communication logs | Your subscription, plus 90 days |
| Newsletter subscription | Until you unsubscribe or ask us to delete it |
| Site visit records (IP address, device details, pages viewed, linked account where signed in) | [OWNER: set and confirm a retention or deletion schedule for these records; none is currently enforced in code] |
| Aggregated usage statistics | Aggregated data with no individual identifiers, kept indefinitely |
After you cancel, your workspace data remains exportable for 90 days (see the Terms). Data held by our processors (for example, call recordings at Twilio and analytics at Google) is retained under those vendors' settings and agreements.
Your rights and choices
- Access: request a copy of the personal information we hold about you.
- Correction: fix inaccurate information, in your account settings or by asking us.
- Deletion: request deletion at rhomex.com/data-deletion. We complete deletion requests within 30 days, subject to the regulatory retention periods above.
- Portability: export your data in a machine-readable format.
- Marketing choices: every newsletter and marketing email includes an unsubscribe link.
To exercise any right, contact [email protected]. We respond within 30 days.
California privacy rights
If you are a California resident, the CCPA as amended by the CPRA gives you these rights:
- Know and access: what categories of personal information we collect, use, and disclose (Section 5 is that list), and a copy of your data.
- Delete: request deletion of your personal information.
- Correct: request correction of inaccurate personal information.
- Opt out of sale or sharing: we do not sell personal information. We use Google Analytics for traffic measurement only, with its advertising features, Google Signals, and Google data sharing disabled. If we ever sell personal information or share it for cross-context behavioral advertising, we will update this policy and provide the required opt-out first.
- Limit sensitive personal information: we use sensitive information (such as account credentials or identity-verification data) only to provide the Services.
- Non-discrimination: we will not discriminate against you for exercising any of these rights.
Submit requests at rhomex.com/data-deletion or by emailing [email protected]. You may use an authorized agent; we will verify the request either way.
European privacy rights
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on these legal bases: performing our contract with you, our legitimate interests in operating and securing the Services, your consent where we ask for it, and compliance with legal obligations.
You have the rights of access, rectification, erasure, restriction, portability, and objection described in Section 12, and the right to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.
Children
The Services are built for working professionals and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact [email protected] and we will delete it promptly.
International transfers
We are based in the United States and our servers are located there. If you use the Services from outside the United States, your information is transferred to and processed in the United States. We protect it as described in this policy wherever it is processed, and where the law requires transfer safeguards we rely on appropriate mechanisms such as standard contractual clauses with our processors.
Changes to this policy
We may update this policy from time to time. We will post the updated version here and change the date at the top; for material changes we will also notify you by email or in-app before they take effect. Continued use of the Services after a change takes effect constitutes acceptance.
Contact
Questions about privacy or this policy:
- Privacy: [email protected]
- Security: [email protected]
- Data deletion: rhomex.com/data-deletion