Privacy Policy

When you create an account and use MentAgent, you may provide:

• Account information — your name, email address, phone number, and profile photo. • Professional information — your real estate license number and the state or province that issued it, brokerage name, market area, specialty neighborhoods and postal or ZIP codes, property types, years of experience, team structure, and CRM platform. • Communication preferences — your preferred tone, email signatures, phrases to avoid, and spoken languages. • Payment information — processed by Stripe; we store only your Stripe customer ID, not your card details. • Custom content — custom skills, prompts, and configurations you create within the platform. • Group participation — messages and posts you contribute to group channels.

MentAgent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Creating an account with Google requests only basic profile information — name, email, and profile photo. No mail, calendar, file, contact, or task access is requested at signup. Everything described below is requested only if and when you turn on the Google Connector in Settings → Connectors, and you can revoke it in the same place at any time. MentAgent is usable without the connector; the skills that depend on it are simply unavailable until you enable it.

The Google Connector is granted in parts ("permission packs"), each with its own consent screen, so you only ever grant what you use. Connecting turns on the default packs — the identity of the account (its email address), Calendar, read-only mail, Contacts, Tasks, and files the assistant creates in Drive. Three further packs are opt-in from Settings → Connectors and are never requested unless you choose them: "Draft and send mail," "Organize mail," and "Your whole Drive." What each covers:

• Gmail — read (default) — read your mail to answer questions, summarize threads, triage your inbox, and give context to skills you enable. Read access also powers the context review described below. • Gmail — draft and send (opt-in) — create drafts in your account, and send mail as you. Google bundles sending into its compose permission, so the consent screen will say MentAgent can send mail as you. Nothing is sent without your approval. In chat, each message is held as a draft until you tap Send on a confirmation card, and the platform verifies the message reached your Sent folder before reporting it sent. You may also approve a send grant once for a named project — a standing authorization limited to named recipients, with a total cap, a daily cap, and an expiry, revocable at any time in Settings; sends under a grant skip the per-message card, and you are notified of each one. You can also schedule a send for a later time; you approve it once and can cancel it until it goes out. The AI model is never on the send path. Scheduled and unattended skills can read mail and leave drafts — they can never send. • Gmail — organize (opt-in) — archive messages and mark them read when you ask, so handled mail leaves your inbox, and create, rename, or delete your labels and move mail between them. Archiving and marking read happen only in a conversation you are present for; moving mail between your own labels is the one mailbox change a scheduled skill you set up may make, and it can never touch Inbox, Unread, Spam, or Trash. Deleting a label happens only after you confirm it in chat. The assistant never deletes mail; archived mail stays in All Mail. • Google Calendar (default) — read and write events, create or manage calendars, and manage who a calendar you own is shared with, to prepare daily briefings and coordinate showings. • Google Drive — files the assistant creates (default) — create and edit the documents, sheets, folders, and uploads the assistant makes for you. It cannot see anything else in your Drive. • Google Drive — your whole Drive (opt-in) — read and edit files already in your Drive (listing folders, disclosure packets, cover sheets) for skills and requests that work on existing files, and manage sharing on them — share a file with a specific person, change access roles, or update link-sharing settings. Broad edit-access grants (for example, giving everyone with the link edit rights) are refused unless you explicitly confirm them. When you ask, the assistant can move a file or folder to your Drive trash, and can restore it; it can never permanently delete a file or empty your trash. • Google Contacts (default) — read and write your saved contacts, so the assistant can resolve "email Dana about the offer" to the right address and, when you ask, save or update a contact. This includes read-only access to "Other Contacts," the addresses Google derives from people you have emailed but never saved. When you connect, one read of your own Google profile fills in profile fields you have left empty (phone, photo, address, birthday, gender); nothing already set is changed. • Google Tasks (default) — read and write your task lists, so the assistant can add and complete to-dos alongside your calendar.

All Google-backed skills share this one connection. A skill that needs a pack you have not granted asks for that pack, and only that pack, when you first use it; you are free to decline, and the skill simply stays unavailable. If we ever add a permission beyond the list above, your connection is marked stale and you must reconnect to grant it.

Context review. After you connect, the assistant asks you in chat whether it may review your recent mail, calendar, Drive documents, and Meet transcripts (about three weeks, or longer during a trial with a payment method on file) to learn the people, properties, and deals you are working on, and then keep that picture current as new mail arrives. If you say yes, the review runs on our servers: a model reads each thread or document and extracts structured facts — contacts, properties, transactions, vendors, dates — into a context store that belongs to your account. For each message we keep a reference (message id, date, direction, counterparties, and a one-line gist); the message body is held only for the extraction and is not stored. You can switch the ongoing review off in your Skills tab, and the whole store is deleted with your account. It is never shared with other users.

No one at MentAgent reads your Gmail, Calendar, Drive, Contacts, or Tasks content. There is no support team that opens your mailbox, no review queue, and no quality-sampling process that looks at your data. Skills run automatically with no person in the loop. In normal operation the only human who reads your Google data is you.

Two exceptions exist. Both are narrow, and both are recorded:

• You ask us to. If you report a problem we cannot diagnose any other way, an authorized staff administrator may temporarily adopt your account to reproduce what you reported, and uses that access only for the problem you raised. • A security incident. If we detect account compromise or abuse, a staff administrator may adopt your account to investigate. We will tell you, unless the law prohibits it or notifying you would tip off an attacker.

Every such session is limited to staff holding the administrator capability, expires automatically after one hour, and is written action-by-action into your own audit history — tagged so you can tell it apart from what you did yourself. Adopting another administrator's account additionally requires the super-admin permission, held by one person, and a fresh passkey re-authentication. Section 7 sets out these controls in full. If you want to know whether your account has ever been adopted, email privacy@mentagent.ai and we will tell you.

We use Google user data only to deliver the features you have turned on. We do not sell it, use it for advertising, or use it to train AI models — ours or anyone else's. The only outside parties that see it are the AI model providers performing inference for the request you made, under contracts that prohibit training on customer data; the email service that delivers your own briefs and reports to you; any service you direct us to send it to (for example, your CRM when you add a contact, or the recipients of mail you send); and any disclosure the law compels from us.

Raw email, calendar, and file content is fetched on demand and is not stored as a separate searchable copy. What we retain is the conversation history and the outputs you produce (summaries, drafts, generated documents), the context store described above, and skill outputs — subject to the retention periods in Section 8.

You can connect other services from Settings → Connectors. Each is optional, used only for the features you turn on, and can be disconnected there at any time:

• Follow Up Boss (CRM) — you paste your own Follow Up Boss API key, which we store encrypted under a customer-managed key. The assistant reads and updates your leads, contacts, tasks, and notes, and adds a contact to your CRM when you ask. Your CRM data is never shared with other users. • Zenlist — you enter your Zenlist email and password, stored encrypted under a customer-managed key, and the assistant signs in to Zenlist's own app interface as you to read your listing activity a few times a day. This access is read-only by construction — it cannot post, mark anything read, or otherwise change your Zenlist account — and you can pause or disconnect it at any time. • Canva — an OAuth connection used to fill your brand templates and export the resulting designs when you ask. • monday.com — an OAuth connection the assistant uses, as you, to read and update your boards, items, updates (comments), files, docs, and workspaces — for example, to keep a transaction board current. Archiving or deleting anything in monday happens only after you confirm it in chat, and monday keeps archived and deleted items recoverable for 30 days. Files the assistant attaches are stored by monday. • Telegram — if you link a Telegram account, messages you send to the assistant there are processed like chat messages. • MentAgent for Mac — if you install the Mac app, it uploads the activity of your iMessage and SMS conversations (who, when, and which direction) into your account's context so the assistant knows who you are in touch with. Message text is uploaded only where the app is set to send it.

Credentials for third-party websites that have no API (the site-credential vault) are described in Section 4.

When you use MentAgent, we automatically collect:

• Device and browser information — IP address, browser type, operating system, and device identifiers. • Usage records — features used, skills run, tokens and browser minutes consumed, and interaction timestamps, kept for billing, reliability, and abuse prevention. • Email open signals — the briefings, reports, and notices we email to you contain a small invisible image. When your mail app loads it, we record that the email was opened and when. We use this only to learn which of our emails you find useful and to improve them. It is never placed in email you send to other people through the Service, and it is never used for advertising. You can prevent it by turning off automatic image loading in your mail app. • Push notification tokens — Firebase Cloud Messaging and web push tokens for delivering alerts to your devices.

We do not use third-party analytics services.

The following data is stored and processed in the United States on Google Cloud Platform (GCP) regardless of your business jurisdiction, because it supports global platform operation:

• Authentication and login credentials (Firebase Authentication). • Account and profile information (name, email, license number, brokerage). • Billing and subscription records (Stripe customer data). • Platform-wide skill definitions and community skill library.

Data generated through your use of assistant skills is stored in the jurisdiction that matches your business activity. This includes:

• Assistant logs and interaction history. • Generated content (email drafts, summaries, listing descriptions). • OAuth tokens for connected services (Google, Canva) and encrypted credentials for Follow Up Boss, Zenlist, and stored site logins. • The context store captured from your connected sources (people, properties, deals, source records). • Custom skills and prompts you create. • Group messages and assistant-to-assistant communications.

At launch, MentAgent supports United States residency (GCP us-west1, Firestore nam5). Canadian and European Union residency are planned as we expand internationally. When you create your account, we ask you to confirm your primary jurisdiction of business; this determines where your interaction data is stored once residency for that jurisdiction is available. If you operate across multiple jurisdictions, your data is stored in the jurisdiction where you are primarily licensed.

Canadian users — what this means today. Canadian data residency is planned but not yet available. Until it ships, your interaction data, like your platform data, is stored and processed in the United States. Using the Service therefore involves a cross-border transfer of your personal information to the United States, where it is subject to U.S. law and may be accessible to U.S. courts and government authorities under that law. We make these transfers in compliance with PIPEDA and applicable provincial privacy legislation, and we require our service providers by contract to protect the information to a comparable standard. If you are not comfortable with your information being stored outside Canada, please do not use the Service until Canadian residency is available. The subprocessors listed in section 10, and their processing locations, apply to Canadian and U.S. users alike.

• Cloud Firestore for user profiles, skills, groups, and interaction logs (region varies by tier as described above). • GCP Cloud Run for application hosting. • GCP Secret Manager for API keys and sensitive configuration.

• OAuth tokens and API keys are stored server-side only and are never exposed to the client application. • Firestore security rules enforce role-based access control — users can only read and write their own data. • Role and plan fields are protected and cannot be modified by users through the client. • Firebase Authentication handles identity verification with support for Google Sign-In and email/password. • All data is transmitted over HTTPS/TLS encryption. • Firebase API keys are restricted to authorized domains only.