Privacy Policy

1. Scope

This Privacy Policy describes how BCAgentOutreach ("we," "us," "our") collects, uses, and shares information when you visit our marketing site at bcagentoutreach.com, sign up for an account at app.bcagentoutreach.com, or otherwise use our service (collectively, the "Service").

This policy applies to people who use the Service as customers ("you"). For listing agents whose public contact information is surfaced by the Service for our customers' outreach, see Section 6.

2. What we collect

We do not collect: government IDs, social security numbers, biometric data, health data, sensitive demographic data, or any data classified as "sensitive" under California or EU law.

3. Why we collect it

• To operate the Service. Run scrapes, draft emails, send outreach, route replies, bill subscriptions, enforce ZIP exclusivity.
• To support you. Answer questions, troubleshoot issues, and (with your knowledge) view your data when you contact us.
• To improve the Service. Aggregate usage analytics tell us which features matter and where the platform is slow or broken.
• To prevent abuse. Detect and block fraudulent signups, payment fraud, and policy violations.
• To comply with law. Tax records, payment-card regulation, fraud reporting, and legal process.

4. How we share data

We share your data with three categories of recipients, and only as described below:

• Service providers. Companies that help us run the platform — billing, hosting, email delivery, AI text generation, etc. They only get the data they need to do their job, and they're contractually required to handle it accordingly. See Section 5 for the full list.
• Legal & safety. If we receive a valid legal request, or if we reasonably believe disclosure is necessary to investigate fraud, prevent harm, or enforce our Terms.
• Business transfers. If we're acquired, merged, or sell substantially all of our assets, your data may transfer to the successor — subject to a privacy policy at least as protective as this one.

We do not sell your personal information. We do not share it with advertisers, data brokers, or any third party for their own marketing.

5. Service providers we use

The Service runs on a small number of third-party platforms. Each is listed here with the role it plays:

We may add or change providers as the Service evolves. We update this list when we do; the current list always lives at this URL.

6. Listing-agent data

The Service surfaces information about real-estate listing agents — names, brokerage affiliation, and email addresses — drawn from public real-estate listing platforms and directories. We do not buy contact databases or use leaked sources. Email addresses, when available, are derived from public sources and are not guaranteed to be accurate.

A listing agent who wishes to opt out of receiving outreach from any of our customers can email hello@bcagentoutreach.com with the subject line "Opt out" and the email address(es) they want suppressed. We'll add the address to a platform-wide suppression list within 5 business days and our customers won't be able to send to it through the Service from that point on. We also operate an automated unsubscribe endpoint at app.bcagentoutreach.com/api/webhooks/unsubscribe that takes an email parameter and immediately marks every matching lead row across the platform as unsubscribed.

Our customers — not us — choose what to send to listing agents. Each customer is the legal sender of record for the emails sent on their behalf and is responsible for compliance with CAN-SPAM, TCPA, and any other applicable laws (see our Terms of Service, sections 7 and 8), including providing an unsubscribe mechanism and a physical postal address in every commercial email they send through the Service.

Implementation note for customers: as of the date above, the Service does not yet auto-insert an unsubscribe link or List-Unsubscribe header into every outbound email — customers are responsible for including these themselves in the email body (or in their AI-prompt template) until that auto-insertion ships. We will update this section as the rails change.

7. Cookies & analytics

The Service uses a minimal set of cookies and similar technologies:

• Strictly necessary cookies — auth session cookies (set by Supabase), CSRF tokens, and short-lived state cookies needed for sign-in and checkout. These can't be disabled without breaking the Service.
• Product analytics — basic in-app usage metrics derived from our own database (which campaigns ran, which features were used, queue throughput). We do not run any third-party analytics SDK (no Google Analytics, no PostHog, no Mixpanel, no Plausible, no Segment, no Hotjar). This data is aggregated for internal product decisions and is never sold or shared with advertisers.
• Error monitoring — when the app crashes, Sentry collects the stack trace and (if relevant to the bug) a small amount of context. We don't deliberately log credentials, payment data, or message bodies.

We do not use third-party advertising cookies and we don't run cross-site tracking.

8. How long we keep data

• Account data — kept for as long as your account is active.
• Billing records — kept for the period required by tax and accounting law (typically 7 years in the U.S.) regardless of whether your account is active.
• Customer content — kept for as long as your account is active. On deletion, we purge your content from production within 30 days; backups age out under standard retention (max 90 days).
• Inbound replies and conversation threads — same as customer content.
• Aggregated platform metrics — counts and totals derived from the database for product and operational reporting may be retained indefinitely once they are no longer linked to an individual account.
• Suppression list (opt-out emails from listing agents) — kept indefinitely so we don't accidentally re-contact someone who opted out.

9. Security

We protect your data using industry-standard controls: encryption in transit (TLS 1.2+) and at rest (provider-side disk encryption), authenticated API access, role-based access controls inside our infrastructure, and least-privilege service credentials. Payment-card data is held entirely by Stripe — we never see, transmit, or store full card numbers.

No system is perfectly secure. If we discover a breach affecting your data, we'll notify you without undue delay and, where required, the relevant authorities.

10. Your rights & controls

You have the following rights regarding your data, regardless of where you live:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update inaccurate or incomplete information directly in Settings, or by emailing us.
• Deletion: Request deletion of your account and customer content (subject to retention exceptions for billing and legal compliance).
• Export: Request a machine-readable copy of your customer content.
• Objection / restriction: If you live in a region with these rights (EU/UK/California), object to or restrict our processing.
• Withdraw consent: Where we rely on consent, withdraw it at any time. Withdrawal doesn't affect prior processing.

To exercise any of these rights, email hello@bcagentoutreach.com. We'll respond within 30 days. We won't charge a fee unless your request is excessive or repetitive.

11. International transfers

BCAgentOutreach operates from the United States. Our service providers are primarily based in the U.S. but may store and process data in other regions (including the EU). If you're outside the U.S., your data will be transferred to and processed in the U.S. By using the Service you consent to that transfer.

Where applicable law requires safeguards for such transfers (for example, the EU's Standard Contractual Clauses), we rely on those mechanisms with our service providers.

12. Children

The Service isn't directed to anyone under 18 and we don't knowingly collect personal data from children under 18. If you believe we've collected data from a child under 18, contact us and we'll delete it.

13. California (CCPA / CPRA)

If you're a California resident, you have specific rights under the California Consumer Privacy Act and the California Privacy Rights Act in addition to those listed in Section 10:

• Right to know the categories of personal information we collect, the categories of sources, the business purpose, and the categories of third parties we share with — all of which are described in this policy.
• Right to delete personal information we hold about you, subject to legal retention exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing": we don't sell or share your personal information for cross-context behavioral advertising as those terms are defined under California law. There's nothing to opt out of.
• Right to limit use of sensitive personal information: we don't collect "sensitive personal information" as defined under California law.
• No discrimination for exercising any of these rights.

To exercise these rights, email hello@bcagentoutreach.com. We may need to verify your identity before responding.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the most recent version. For material changes, we'll give at least 14 days' notice (by email or in-app) before the change takes effect. Continued use after the effective date constitutes acceptance.

15. Contact

Questions, requests, or complaints about this policy go to:

hello@bcagentoutreach.com

Mailing address: [BUSINESS MAILING ADDRESS — fill in].