Privacy Policy

This policy explains what CREXOS Technologies, LLC ("CREXOS", "we") collects through the CREXOS platform, who receives it, and how to get it corrected or removed. It was written from how the system actually behaves.

Who this is about

Two groups of people appear in CREXOS, and each is owed a different explanation.

• Account holders are brokers and staff who sign in. If that's you, you gave us your details yourself.
• Everyone else (property owners, company contacts, decision-makers) never signed up. Information about them is compiled from public records and commercial data providers, so that a broker can decide whether to get in touch. Most of the personal data in this product is about this second group. The rest of this page says so plainly, rather than describing only the people who agreed to be here.

What we hold about account holders

• Your email address and display name, supplied at sign-up or by Microsoft if you sign in with a work account.
• A password, if you set one. It's stored hashed by our authentication provider, and we never see it.
• Sign-in records: when you last signed in, plus a session cookie that keeps you signed in.
• Terms acceptance records: which version of the Terms you accepted, when, and the IP address and browser type (user agent) you accepted from. We keep these as evidence of acceptance, including after an account is closed.
• The work you do in the product: your lists, notes, logged calls, campaigns, and which records you own.
• Mailbox content, only if you connect a mailbox. Replies to your campaigns are pulled in so they appear in your inbox. Disconnecting the mailbox stops this.
• Calls, only if your organization turns on call capture. Recordings, transcripts and summaries of calls made through a connected phone system. This is off by default, and it only turns on after the organization confirms that every call plays a recording disclosure.
• An activity log of changes to records: who created, changed or deleted what, and when. It's kept for security and accountability.

We don't run analytics or advertising trackers in this application: no Google Analytics, no advertising pixel, no session recording. The only cookies we set are the ones that keep you signed in.

What we hold about people who aren't account holders

We hold business contact information and property records: names, business email addresses and phone numbers, job titles, employers, and the properties an entity owns or occupies. It comes from public registries, tax and property records, licensing and permit records, government award records, published company websites and news, and commercial data providers.

This is compiled for business-to-business outreach about commercial property. We don't knowingly collect information about consumers in a personal capacity, and we don't build profiles of private individuals outside their business role.

Accuracy. Much of this comes from tax rolls and registries that are themselves wrong or out of date, and matching is imperfect. If information about you here is wrong, tell us and we'll correct or remove it.

How we use information

• To provide the Service to the organization that licenses it: showing records, sending the outreach its users direct, and generating drafts, summaries and matches.
• To keep the Service secure, prevent abuse and enforce our Terms.
• To honor opt-outs across the product.
• To improve the Service. We use aggregated or de-identified information for this.
• To keep our database of companies, properties and contacts accurate and current, using public records and data providers. Examples: a company's location or size, a property's characteristics, or a contact's role and business contact details. We never add one customer's client relationships, deal terms or communications to that database.

Who else receives it

CREXOS isn't one system. Service providers process data on our behalf, each for a stated reason:

• Running the product: web and API hosting, database and authentication providers. These hold account data and everything in a workspace.
• Sending and receiving email on your behalf: email-sending platforms, and your own Microsoft 365 mailbox if you connect it. Only when you connect a mailbox or run a campaign.
• Calls: your organization's phone system, if it connects one.
• Building and checking contact and property data: commercial data, verification, search and property-records providers. They receive a company name, domain, address or email in order to return information about it.
• Generating text: an AI model provider, reached through a monitoring gateway. Prompts may contain data from your workspace. The provider does not use it to train its models.
• Syncing your CRM, if you connect one.
• Error monitoring and logs: to find and fix problems, and to know when the Service is down. Error reports are configured not to include IP addresses, cookies or request contents, and there is no session recording. Application logs are kept for a limited period.
• Maps: property pages embed a Google map. Loading it tells Google you viewed the page.

A current list of our service providers by name is available to customers under their data processing terms, or on request to privacy@crexos.io.

We do not sell personal information, and we don't share it for advertising.

How long we keep it

Account data and your work stay for as long as the account exists. When a workspace is closed, the organization has 60 days to export its data. After that, we delete or anonymize it within a reasonable period, except where a record must be kept. For example, we keep proof that someone asked not to be contacted, so that we can keep honoring it. Call transcripts are kept for 365 days by default, unless the organization sets a shorter period or deletes them sooner.

Asking us to stop, correct or delete

Write to privacy@crexos.io. You can ask what we hold about you, ask us to correct it, ask us to delete it, or ask us not to contact you again. You don't need an account to ask, and you don't need to give a reason. We'll respond within 30 days. We may need to confirm you are the person the request is about.

Every outreach email sent through the product includes a way to unsubscribe. An unsubscribe is applied to that address across the whole product, not to a single campaign.

Where the data is about someone a customer contacted: the organization that sent the message is responsible for it, and we help that organization honor your request.

Security

Traffic is encrypted in transit, and our database provider encrypts stored data at rest. Access to a workspace requires sign-in, and records are scoped so that members of one organization can't see another's. We are not making a certification claim: CREXOS holds no security certification, and this page will say so until that changes.

Children

CREXOS is a business tool. It isn't directed to anyone under 18, and we don't knowingly collect their information.

Where data is processed

CREXOS is operated from the United States, and our service providers process data primarily in the United States.

Changes

If this page changes in a way that affects you, we'll say so, rather than quietly editing the date at the top.

Contact

CREXOS Technologies, LLC · privacy@crexos.io