Privacy Policy

Depending on the Services used, RoRo may process information including:

• Names, email addresses, telephone numbers, and contact information
• Brokerage, company, office, and professional information
• Account information, roles, and permissions
• Client, lead, and prospect information
• Listing and transaction information
• Communications, notes, tasks, and workflow information
• Documents and files, including documents submitted for e-signature or identity verification
• Marketing materials and communications
• Invoice, commission, and accounting-related information
• Information provided through authorized integrations, including Google user data if you choose to connect your Google account (see Section 5)
• Device, browser, IP address, login, and usage information
• Security, audit, diagnostic, and error information
• Other information submitted by Customers and authorized users in connection with the Services

Information, content, and materials provided by a Customer through RoRo constitute “Customer Data” under the applicable Customer Agreement.

Customer Data is proprietary to the Customer. RoRo does not acquire ownership of Customer Data merely by processing or storing it through the Services.

Where Customer Data contains Personal Data that Company processes on behalf of a Customer, processing is governed by the applicable Customer Agreement and DPA. The DPA provides that Company processes Customer Personal Data for the purpose of performing the Services and in accordance with the Customer’s instructions.

We may process information as necessary to provide, operate, and maintain RoRo, and for the purposes below. Our use of Customer Personal Data is also subject to the restrictions in our DPA. Google user data is used only for the purposes listed in Section 5.2, and not for any other purpose in this list.

• Create and administer accounts
• Authenticate users and manage permissions
• Provide client, lead, agent, listing, and transaction management functionality
• Perform market analysis and reporting
• Provide workflow and task automation
• Generate or assist with marketing content
• Provide communications and email functionality
• Facilitate document workflows
• Provide invoice, commission, and accounting-related functionality
• Operate authorized third-party integrations
• Provide artificial intelligence and machine learning functionality
• Provide customer support
• Secure and monitor the platform
• Prevent fraud and unauthorized activity
• Maintain platform reliability and performance
• Comply with applicable legal and contractual obligations

Certain RoRo Services use artificial intelligence and machine learning technologies to provide market insights, analysis, generated content, workflow assistance, and other functionality, including the RoRo AI assistant.

Providing these features may require information submitted to RoRo to be processed by Company and by authorized technology providers that support these functions, such as OpenAI. These providers process the information only to deliver the requested feature and are not permitted to use it to train their own models.

Any use of Customer Data for de-identification, analytics, or artificial intelligence learning or improvement is governed by the applicable Customer Agreement and DPA. This never applies to Google user data, which is never used to develop, improve, or train generalized or non-personalized AI or machine learning models (see Section 5).

This section applies to data we receive from Google APIs when a user chooses to connect their Google account in RoRo Settings > Integrations (“Google user data”). Connecting Google is optional and is never required to use the core Services. Where this section differs from any other part of this Privacy Policy, the Customer Agreement, or the DPA, this section controls.

5.1 Data we access

We access only the following Google API scopes, and only after the user explicitly authorizes the connection:

• https://www.googleapis.com/auth/gmail.send — send email from your Gmail address on your behalf, used only when you write, approve, or schedule a specific message in RoRo
• https://www.googleapis.com/auth/contacts.readonly — read the names and email addresses in your Google Contacts, used only to match them against your existing client records and to fill in recipients when you address a message
• https://www.googleapis.com/auth/calendar.events.owned — view, create, and manage events on Google Calendars you own, used only to show your upcoming showings, meetings, and closings inside RoRo and to create events you ask RoRo to schedule
• https://www.googleapis.com/auth/userinfo.email — view the email address of the Google account you connected, used to show you which account is connected

If you use “Sign in with Google” only to log in, we receive just your name and email address to authenticate you. That login does not give us access to your Gmail, Calendar, or Contacts.

5.2 How we use it

We use Google user data only to provide these user-facing features to the user who connected it:

• Sending an email from the user’s Gmail address when they write, approve, or schedule that email.
• Showing and syncing Google Calendar events, and creating events the user asks RoRo to schedule.
• Matching Google Contacts against the user’s existing client records, and filling in recipients when the user addresses a message.
• Answering requests the user makes to the RoRo AI assistant that need this data (for example, “email Jane about Thursday’s showing”).

We do not use Google user data for any other purpose. In particular, we do not:

• sell Google user data, or transfer it to data brokers or information resellers;
• use it for advertising, including personalized, retargeted, or interest-based advertising;
• use it for marketing, market analysis, or reporting, or add it to marketing lists or campaigns;
• use it to determine creditworthiness or for lending purposes;
• use it to build databases for any purpose other than providing the features above to the user; or
• use it to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models.

5.3 How we share it

We share Google user data only:

• with our cloud hosting provider, which stores and processes it on our behalf to run the features in Section 5.2;
• with OpenAI, only the minimum data needed to answer a request the user makes to the RoRo AI assistant. OpenAI processes it only to generate that answer and is not permitted to use it to train its models;
• when needed to comply with applicable law or to protect against fraud, abuse, or security threats; or
• as part of a merger, acquisition, or sale of assets, with notice to affected users, and subject to this Privacy Policy continuing to apply.

We do not share Google user data with any other third party, including marketing platforms, document and e-signature providers, identity-verification providers, accounting integrations, or voice-generation providers.

5.4 How we protect it

• Google access and refresh tokens are encrypted at rest and are never stored in plain text.
• All data is encrypted in transit using TLS.
• Synced Google user data is accessible only to the authenticated user it belongs to.
• Our employees, contractors, and agents do not read Google user data, except: with the user’s explicit consent; where necessary for security purposes (such as investigating abuse); to comply with applicable law; or when the data has been aggregated and anonymized for internal operations.

5.5 How long we keep it, and how to delete it

• We keep synced Google user data only while the Google account is connected and the RoRo account is active, so we can provide the features in Section 5.2.
• Users can disconnect Google at any time from RoRo Settings > Integrations, or by revoking RoRo’s access at myaccount.google.com/permissions. When a user disconnects, we immediately delete the stored Google access and refresh tokens and stop all syncing through that connection (see Section 5.7 for access authorized by a Google Workspace administrator).
• To delete Google user data we have already synced, email Legal@rodlandprivatemembers.com. We delete it within 30 days of the request. When a RoRo account is deleted, all of its Google user data is deleted with it.

5.6 Limited Use

5.7 Access authorized by a Google Workspace administrator

Separately from the “Connect Google” permissions above, a brokerage that uses Google Workspace may have its own Workspace administrator authorize RoRo, in the Google Admin console, to provide the RoRo Inbox (showing an agent’s own Gmail thread metadata and previews to that agent), Calendar, Contacts, and email-sending features for that brokerage’s own Workspace accounts. This access is granted and controlled by the brokerage’s administrator, applies only to accounts in that brokerage’s Workspace domain, and can be revoked by the administrator at any time. Data received this way is Google user data and is subject to every restriction in this Section 5.

Company may disclose Personal Data as necessary to provide the Services, including to the categories of recipients below, as well as when required by applicable law, legal process, or governmental authority, or where reasonably necessary to protect the rights, security, or integrity of Company, our Customers, users, or the Services. Company does not sell Customer Personal Data or disclose Customer Personal Data for targeted or cross-context behavioral advertising, as provided in our DPA. Google user data is disclosed only as described in Section 5.3.

• Authorized users of the applicable Customer account, based on roles and permissions
• Cloud hosting and infrastructure providers
• Email and communications providers
• Document and electronic-signature providers
• Identity-verification providers
• Marketing platforms
• Accounting and financial-management integrations
• Artificial intelligence and machine learning providers
• Voice-generation providers
• Security and technical-service providers
• Other subprocessors authorized in accordance with the applicable DPA

Company uses third-party subprocessors to help provide the Services.

Our DPA authorizes Company to engage subprocessors and requires Company to impose contractual data-protection obligations on them that are substantially similar to the obligations imposed on Company.

Depending on the Services and integrations used, subprocessors may provide cloud infrastructure, authentication, email delivery, document and electronic-signature functionality, identity verification, marketing services, accounting functionality, artificial intelligence processing, voice generation, and other technical services.

Personal Data may be processed in countries other than the country in which a Customer or data subject is located.

Where required by applicable data protection law, Company uses appropriate mechanisms for cross-border transfers. Our DPA provides mechanisms for transfers governed by the EU GDPR, UK GDPR, and Swiss data-protection requirements, including applicable Standard Contractual Clauses.

Company maintains reasonable and appropriate technical and organizational measures designed to protect Personal Data. These measures include, as applicable:

• Encryption of data in transit and at rest
• Role-based access controls
• Vulnerability scanning and auditing
• Secure authentication practices
• Data minimization and retention practices

Additional protections for Google user data are described in Section 5.4.

In accordance with the applicable DPA, Company will notify affected Customers without undue delay after becoming aware of an accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, Customer Personal Data constituting a security incident.

Company will make commercially reasonable efforts to investigate and mitigate the effects of such incidents and will provide reasonable assistance to Customers in meeting applicable legal obligations.

Company retains Personal Data as necessary to provide the Services and satisfy applicable contractual and legal requirements.

For Customer Personal Data governed by a DPA, Company will, upon termination or expiration of the applicable agreement or upon Customer request, return or delete Customer Personal Data as provided by the DPA, except where retention is required by applicable law. Additional retention and data-transfer provisions may be contained in the applicable Customer Agreement.

Retention and deletion of Google user data is described in Section 5.5.

RoRo may use cookies, local storage, session identifiers, and similar technologies for authentication, account security, preferences, platform functionality, performance measurement, and analytics.

Some of these technologies are necessary for RoRo to operate. Disabling them in your browser may prevent certain features from working properly.

Depending on applicable law, individuals may have rights relating to their Personal Data, including rights to request access, correction, deletion, portability, restriction, or objection to certain processing. To make a request, contact us at the address in Section 17.

Where Company processes Customer Personal Data solely on behalf of a Customer, individuals should generally direct requests about that information to the applicable Customer. Company will provide Customers with reasonable assistance in responding to data subject requests as required by applicable data protection law and the DPA.

You may opt out of marketing communications by using the unsubscribe link in the communication or by contacting the sender.

Transactional, security, account, or service-related communications may continue where necessary to provide the Services.

RoRo is a business platform and is not intended for use by children. We do not knowingly provide RoRo accounts to, or collect Personal Data from, anyone under 16.

We may update this Privacy Policy periodically to reflect changes to our Services, technology, legal requirements, or data practices. We will post the updated version at rodlandintelligence.com/privacy-policy and update the “Last updated” date above. Material changes will be communicated to registered users by email or in-app notice.

Questions about this Privacy Policy or Company’s privacy practices may be directed to:
Rodland Private Members LLC
600 Third Avenue, 42nd Floor, New York, NY 10016, United States
Email: Legal@rodlandprivatemembers.com