Privacy Policy

Introduction

CloudCoord is a transaction coordination platform built for licensed real estate professionals. This privacy policy explains what data we collect, how we use it, how long we keep it, and the rights you have over it. CloudCoord is operated by Cloud Coordinator, LLC from Vermont, United States, and the service is offered only to real estate professionals located in the United States. We do not offer CloudCoord in the European Union, the European Economic Area, or the United Kingdom, and this policy does not describe rights arising under the laws of those jurisdictions. Cloud Coordinator, LLC is the data controller for your account data (a “business” under California law); for the personal data of third parties contained in your transactions, CloudCoord acts as a data processor on your behalf (a “service provider” under California law — see Section 4).

Information We Collect

CloudCoord collects four categories of data:

• Account information you provide: your name, email address, brokerage affiliation, license number, and authentication credentials.
• Transaction data you create or upload: purchase and sale agreements, addenda, transaction details, contact information for buyers/sellers/agents/attorneys/lenders, deadlines, communications, and any documents you upload to a transaction.
• Gmail data accessed via OAuth (if you connect Gmail): email contents, sender/recipient information, attachment contents (especially PDFs), and metadata such as message IDs and timestamps. To identify which messages relate to your transactions, CloudCoord processes incoming messages in your connected mailbox — determining relevance requires reading the message. Messages that turn out not to relate to a transaction are held in a review queue so you can file or dismiss them, and are retained under the schedule in Section 5. We do not use them for any purpose other than transaction matching.
• Usage data: standard application logs, security audit events, performance metrics, and aggregate page-view analytics (Vercel Web Analytics). The analytics are cookieless and set nothing on your device. Before a page view leaves your browser we remove the entire query string and replace transaction, document and access-token identifiers in the page address with a placeholder, so what is recorded is the shape of the page (for example /transactions/[id]) and never which transaction. We do not use advertising trackers, and we do not sell or share your data with advertisers.

How We Use Google User Data

When you connect your Gmail account, CloudCoord requests these scopes:

• gmail.readonly — to read transaction-related emails and PDF attachments
• gmail.compose — to create drafts in your Gmail account and send messages with your per-message approval
• userinfo.email — to read the email address of the Google account you connect, so we can identify the connected mailbox and link it to your CloudCoord account. This is a sign-in identity scope only; it does not grant access to your email contents.

CloudCoord uses Gmail data exclusively to:

1. Determine whether an incoming message relates to one of your transactions (classification and matching)
2. Extract transaction details (parties, deadlines, prices, conditions) and store them in your transaction record
3. Extract and store PDF attachment contents (purchase agreements, addenda, disclosures) to build your transaction memory
4. Create draft emails for your review before sending
5. Send approved emails on your behalf through your Gmail account

CloudCoord's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to:

• Train any artificial intelligence or machine learning models (CloudCoord uses the Anthropic Claude API; Anthropic does not train models on API-submitted data)
• Serve advertising
• Sell, rent, or share with third parties for any commercial purpose
• Allow humans to read your data, except (a) with your explicit consent, (b) to comply with applicable law, (c) to investigate abuse or security incidents, or (d) when data has been aggregated and anonymized

How We Use Your Data

CloudCoord uses your account, transaction, and usage data to:

• Provide the transaction coordination service
• Send you product communications, security alerts, and required service notices
• Improve product reliability and performance
• Detect and prevent abuse, fraud, and security incidents
• Comply with legal obligations including real estate licensing record-keeping requirements

For the personal data of buyers, sellers, agents, attorneys, and lenders contained in your transactions, you (the agent or brokerage) are the data controller and CloudCoord acts as your data processor, processing that data on your documented instructions. You are responsible for having a lawful basis to provide that data to CloudCoord.

Data Retention

We retain different categories of data for different periods:

• Account data: retained while your account is active and for 30 days after cancellation
• Active transaction data: retained while your account is active and for 30 days after cancellation
• Closed or terminated transaction records: anonymized and retained after the close or termination date for the record-retention period required by the real estate licensing law of the agent’s state, up to a maximum of 7 years. Once that retention period elapses, these records are permanently deleted.
• Gmail data extracted by CloudCoord: same retention as the transactions it relates to
• Audit logs: retained for 7 years for security and compliance purposes
• Usage logs: retained for up to 12 months

If you cancel your subscription, your account enters a 30-day grace period during which you can reactivate or request a copy of your data by emailing privacy@cloudcoordinator.io. After 30 days, your account is deleted following our standard deletion process.

Your Rights and Controls

You have the following rights regarding your data:

• Disconnect Gmail: Settings → Account & Data Controls → Disconnect Gmail. You may optionally delete Gmail-derived data tied to active transactions at the same time; closed/terminated transaction records are retained for the legally required period.
• Delete your account: Settings → Account & Data Controls → Delete Account. This deletes your account, active transaction data, and Gmail-derived data tied to active transactions. Closed/terminated transactions are anonymized and retained for the legally required 7-year period.
• Cancel subscription: Settings → Account & Data Controls → Cancel Subscription. Account becomes read-only for 30 days, then is automatically deleted.
• Reactivate: During the 30-day grace period after cancellation, you can reactivate your account from Settings.
• Download your data: Settings → Your data → Download my data exports a portable, machine-readable copy of your personal data instantly. If you cannot access your account, email privacy@cloudcoordinator.io with your account email and we will respond within 30 days.
• Request data deletion if you cannot access your account: Email privacy@cloudcoordinator.io with subject “Data Deletion Request” and your account email. We will verify your identity and complete the deletion within 30 days.

If you are a California resident, you have additional rights under the CCPA/CPRA, including the right to know what personal information we collect and how we use it, the right to access and delete it, the right to correct inaccurate personal information, and the right not to be discriminated against for exercising those rights. Email privacy@cloudcoordinator.io to exercise these rights, and we will respond within 30 days. You may use an authorized agent to submit a request on your behalf.

How We Protect Your Data

CloudCoord protects user data through:

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• Row-Level Security (RLS) policies enforced at the database layer, so tenant isolation is enforced independently of application code
• A five-layer document security pipeline including input sanitization, prompt injection detection, instruction boundaries, output schema validation, and rate limiting
• OAuth tokens stored encrypted; revocation flows fully implemented
• Hosted on professional cloud providers with SOC 2 Type II compliance
• Audit logging of security-relevant events

See our Security page for additional detail.

Third-Party Services

CloudCoord shares data with the following service providers, each only to the extent needed to operate the service:

• Anthropic (Claude API) — processes documents and emails to generate transaction summaries and draft communications. Under Anthropic’s commercial terms, API inputs and outputs are not used to train their models and are automatically deleted within 30 days (retained longer only where required to enforce their usage policy or by law).
• Supabase — managed Postgres database, authentication, and encrypted file storage for your account and transaction data. SOC 2 Type II compliant.
• Vercel — application hosting and serverless compute. SOC 2 Type II compliant.
• Stripe — subscription payment processing. Card data is handled directly by Stripe; we never store full payment card numbers.
• Resend — delivery of transactional email (account notifications and security alerts) only.

Each provider receives only the data needed to perform its function, under a Data Processing Addendum with contractual data-protection terms. See our full sub-processor list for each provider’s purpose, the data it processes, its location, and its data-protection terms. We do not sell user data to any third party, and we do not share user data for advertising purposes.

Children's Privacy

CloudCoord is a professional tool for licensed real estate agents. The service is not directed to anyone under 18. We do not knowingly collect data from anyone under 18.

International Users

CloudCoord is operated from the United States. If you access the service from outside the U.S., your data will be transferred to and processed in the U.S. Where we transfer personal data of individuals in the EU, UK, or Switzerland, we rely on appropriate safeguards — including the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) incorporated into our agreements with our sub-processors.

Changes to This Policy

We will notify you of material changes to this policy by email and by posting a notice in the application at least 30 days before changes take effect.

Contact

For privacy questions or requests:

privacy@cloudcoordinator.io

For security issues:

security@cloudcoordinator.io

Cloud Coordinator, LLC
[Mailing address available upon request]