Privacy Policy

1. Who We Are

Cerzo is a private internal tool for real estate advisors affiliated with The Mead Group, Engel & Völkers. It is not open to the general public. Access is by invitation only.

Contact: Eric.Mead@evrealestate.com

2. Information We Collect

We collect the following categories of information:

• Account information: Your name, email address, password (stored as a bcrypt hash — never in plain text), role, office affiliation, and Terms of Service agreement timestamp provided at registration
• Property data: Property addresses, listing details, pricing information, and client context entered into the Platform by advisors
• Usage data: Records of which AI tools were used, timestamps, and request counts per office for billing, capacity planning, and platform improvement
• Technical data: IP address, browser type, and session data collected automatically when you use the Platform
• Consent records: The date, time, and version of the Terms of Service and Privacy Policy you agreed to at registration

3. How We Use Your Information

Information collected through the Platform is used to:

• Authenticate your identity and maintain your secure session
• Generate AI-powered marketing content, market analyses, buyer profiles, and listing copy
• Track AI tool usage per office for billing and capacity planning
• Deliver your weekly seller intelligence digest every Monday morning
• Improve the Platform and add new features based on usage patterns
• Communicate with you about your account, Platform updates, or security notices
• Comply with our legal obligations including data breach notification under Washington State law

4. How Your Data Is Stored

Database and application hosting

Your data is stored in a PostgreSQL database hosted by Render (render.com). Your application and database are deployed in the US West (Oregon) region, running on AWS infrastructure in Oregon, United States. All data remains within the United States and is not transferred internationally except where described in Section 5.

Data security

Render maintains industry-standard security controls including encryption at rest (AES-256) and encryption in transit (TLS 1.2+). Your data is further protected by:

• All passwords hashed using bcrypt with a cost factor of 12 — never stored in plain text
• Authentication managed via HttpOnly cookies that are inaccessible to JavaScript — protecting against cross-site scripting attacks
• Session tokens that expire after 14 days and can be immediately invalidated by administrators
• Rate limiting on all API endpoints to prevent automated attacks
• Per-office data isolation — agents can only access data assigned to their office

Authentication token storage

Authentication tokens are stored in HttpOnly cookies — a browser security feature that prevents JavaScript from accessing your session token. This protects your session against cross-site scripting attacks. Cookies expire after 14 days of inactivity and are cleared when you log out.

5. Third-Party Services

5a. Anthropic (Claude AI) — Confirmed commercial data protections

Specifically, the following protections apply to your data under Anthropic’s commercial API terms:

• No training use: Your prompts and the content generated from them are never used to train Anthropic’s AI models. This applies regardless of September 2025 consumer policy changes — those changes explicitly do not apply to commercial API customers.
• 7-day log retention: Anthropic retains API interaction logs for 7 days for safety and abuse monitoring only, then deletes them automatically. This is shorter than most comparable providers.
• Safety classifier retention: Anthropic retains the results of automated safety checks (not the content itself) to enforce their usage policies. This is standard practice and does not involve your client data.
• No EU data transfer by default: API requests are processed in the United States.

What we send to Anthropic: When you use an AI tool, the content you enter in that tool’s form fields is sent to Anthropic’s API. This may include property addresses, general client context, and market information you choose to enter. It does not include your account credentials, payment information, or data from other parts of the Platform that you have not specifically entered into an AI tool field.

Our recommendation: Do not enter Social Security numbers, financial account numbers, government ID numbers, or other sensitive personal identifiers into AI tool fields. The Platform displays a privacy notice on every AI tool page as a reminder.

anthropic.com/legal/privacy · anthropic.com/legal/aup

5b. Render — Infrastructure provider

Render (render.com) is our application hosting and database provider. Your data is stored on Render’s infrastructure in the US West (Oregon) region. Render operates on AWS infrastructure and maintains SOC 2 Type II compliance. For Render’s privacy policy, visit render.com/privacy.

5c. Customer portal — What clients can and cannot see

The Platform includes a client-facing portal where your clients can log in to view their transaction progress. The portal uses strict field-level access controls — clients can only see a defined subset of their record.

Advisors can use the Preview portal view button on any customer profile to see exactly what that client would see before inviting them to the portal.

5d. OpenAI

OpenAI is used for meeting note summarization, audio transcription, and buyer profile generation features. Data processed through OpenAI’s API is governed by OpenAI’s privacy policy and API usage terms. For OpenAI API customers, data submitted via the API is not used for training by default. For OpenAI’s privacy policy, visit openai.com/privacy.

6. Data Sharing

We do not sell or share personal information with third parties for marketing purposes. Data is shared only with the third-party services listed above as necessary to operate the platform. We may disclose information if required by law or valid legal process.

7. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, your personal information will be removed within 30 days as required by Washington State law (RCW 19.255.010).

• Account data: Retained while your account is active. Deleted within 30 days of a deletion request.
• AI usage logs: Retained for 12 months in anonymized form for billing and analytics, then deleted automatically.
• Password reset tokens: Expire after 1 hour and are purged from the database automatically.
• Session invalidation records: Retained for 14 days (matching the maximum JWT lifetime) then purged automatically.
• Anthropic API logs: Retained by Anthropic for 7 days then automatically deleted. See Section 5a.
• Consent records: The timestamp and version of your Terms of Service agreement are retained for the lifetime of your account for legal compliance purposes.

8. Your Rights

You may:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your personal data
• Opt out of non-essential processing where applicable
• Receive a copy of your data in a portable format
• Know the specific fields visible to clients in the customer portal (see Section 5c)

We will acknowledge all privacy requests within 5 business days and provide a full response within 15 business days. For complex requests we may extend this period by an additional 15 business days with notice. To submit a privacy request, email Eric.Mead@evrealestate.com with the subject line “Privacy Request” and describe your request clearly.

9. Cookie and Local Storage Policy

The Platform uses browser cookies and localStorage as follows:

• Authentication cookie (HttpOnly): Your session token is stored in a secure HttpOnly cookie that expires after 14 days. This cookie is inaccessible to JavaScript — it cannot be read by any script running on the page, protecting your session against cross-site scripting attacks.
• User preferences (localStorage): Non-sensitive information such as your name, role, and office name is stored in localStorage to personalize the interface. This does not include your authentication token or any client data.
• Privacy notice dismissal (localStorage): A record of whether you have dismissed the AI data privacy notice is stored in localStorage and resets every 30 days.

We do not use third-party tracking cookies or advertising cookies. We do not use cookies to track your activity across other websites.

10. Security

We take the following technical and organizational measures to protect your data:

• HTTPS encryption on all connections
• Passwords hashed with bcrypt (cost factor 12) — never stored in plain text
• Authentication via HttpOnly cookies — session tokens inaccessible to JavaScript
• Immediate session invalidation capability for terminated or deactivated accounts
• Per-office data isolation — agents cannot access other offices’ data
• Rate limiting on all API endpoints
• Time-limited, per-office registration codes to prevent unauthorized access
• Terms of Service consent logging with timestamp and version

No system is completely secure, and we cannot guarantee absolute security. In the event of a data breach, we will notify affected users within 30 days as required by Washington State law.

11. Data Breach Notification

In the event of a security breach affecting your personal information, The Mead Group will notify affected users within 30 days of discovery as required by Washington State law (RCW 19.255.010). Notification will be sent to the email address associated with your account and will include: the nature of the breach and how it occurred, the categories of personal data affected, the steps we are taking to contain and remediate the breach, and steps you can take to protect yourself. If a breach affects more than 500 Washington State residents, we will also notify the Washington State Attorney General within the same timeframe.

12. Cross-Border Data Transfers

Your data is stored and processed in the United States (Oregon, US West). The Platform is designed for use by real estate professionals operating in the United States. If you access the Platform from outside the United States, your data will be transferred to and processed in the US. By using the Platform you consent to this transfer. We do not currently serve clients subject to the EU General Data Protection Regulation (GDPR). If you have GDPR-related questions, contact Eric.Mead@evrealestate.com.

13. Children’s Privacy

The platform is intended for real estate professionals only. We do not knowingly collect data from anyone under 18 years of age.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users. Continued use of the platform after notice constitutes acceptance of the updated policy.

15. Contact

Eric Mead
The Mead Group, Engel & Völkers
Eric.Mead@evrealestate.com
206-250-3580

For Anthropic data inquiries: privacy@anthropic.com
For Render data inquiries: privacy@render.com