Privacy Policy

Privacy Policy for lusara.ai Effective date: October 1, 2026 This Privacy Policy explains how DND Solutions & Optimization LLC ("DND Solutions", "we", "our", or "us") collects, uses, stores, discloses, and protects personal information through lusara.ai and related Lusara services (the "Service"). Lusara is a real estate CRM, property-search, email, automation, AI, and client/seller workflow platform for real estate professionals. This Policy applies to account holders, invited users, clients or sellers whose information is entered into the Service, public onboarding visitors, and other people who interact with the Service. 1. Who We Are lusara.ai is operated by DND Solutions & Optimization LLC. Website: https://dndsolutions.io Contact: info@dndsolutions.io 2. Information We Collect We collect information you provide, information generated by your use of the Service, and information received from integrations you choose to connect or use. Depending on your use of the Service, this may include: - Account and profile information: name, email address, brokerage, market, team information, settings, email footer/signature, preferences, and account status. - Buyer/client information: client names, emails, notes, additional buyers, preferences, saved or ignored properties, search criteria, scheduled interactions, property feedback, onboarding responses, chat history, and relationship history. - Seller/lead information: seller names, emails, phone numbers, property addresses, lead messages, motivation, timeline, listing tasks, listing project data, seller documents, and related notes. - Property and search information: search criteria, saved searches, property candidates, property details, AI scores, evaluations, recommendations, bookmarks, refresh history, and provider metadata. - Communications data: email subjects, bodies, recipients, senders, timestamps, message IDs, thread IDs, delivery context, draft content, email templates, and CRM lifecycle events. - Connected email account data: OAuth account identifiers, scopes requested, authorized, or checked as needed, encrypted refresh tokens, email connection metadata, and email content accessed through Gmail or Microsoft Graph features described below. - Uploaded files: documents, photos, PDFs, images, and other files uploaded for buyer, client, seller, or listing workflows. - AI input and output: prompts, client preferences, property data, lead context, chat context, listing context, generated descriptions, suggested emails, scores, summaries, and recommendations. - Billing and subscription information: Stripe customer identifiers, subscription tier, billing status, plan metadata, credit balances, purchased credits, renewal/cancellation status, and transaction metadata. We do not store full payment card numbers. - Usage and product analytics: in-app events, feature usage, saved searches, refreshes, provider request telemetry, error events, and performance information used to operate and improve the Service. - Security and anti-abuse logs: login/signup events, reCAPTCHA verification attempts, IP address, user agent, route/action, timestamps, failure reasons, audit events, token usage, and other security-relevant metadata. - Public onboarding information: information submitted through client onboarding links, including preferences, financing/lender status, document uploads, property feedback, and related client/seller workflow data. SMS and mobile information: Mobile phone numbers, SMS consent, and SMS opt-in data will not be sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. Lusara may share mobile information with service providers that operate the messaging program, at the recipient's direction, or as required by law. Message frequency varies. Message and data rates may apply. 3. Gmail, Outlook, and Email Processing You may connect Gmail or Microsoft Outlook to use email-related features. Optional mailbox processing The mailbox controls in Settings display this notice: Connecting Gmail or Outlook lets you send messages you approve. Mailbox reading is optional and starts off. Sync reads messages to match business contacts and stores relevant conversations in your CRM. Lead import searches recent real-estate inquiries and creates CRM lead records. AI analysis sends relevant message content and CRM context to Google Gemini to suggest follow-up, analyze requests and assist property searches. You must review AI content before sending or relying on it. Each feature starts off and can be disabled here. Disabling a feature stops future processing; existing CRM records remain until you delete them. Disconnecting removes the stored access token. We record this notice and your choices with your account and timestamp. Gmail: - Current Gmail features may request Gmail permissions including gmail.send and gmail.readonly. - gmail.send is used to send email from your Gmail account when you ask Lusara to send messages. - gmail.readonly is used to sync Gmail replies and to support Gmail lead import workflows. Gmail lead import may search recent Gmail messages for real-estate lead or inquiry terms, parse lead details, and store relevant lead information in your Lusara CRM. - We may store email subject, body, sender, recipients, timestamps, Gmail message IDs, Gmail thread IDs, and parsed lead details where needed to display conversations, support CRM history, or create lead records. Outlook: - Microsoft Graph/Microsoft Outlook integration supports Outlook.com, Hotmail, Live, and Microsoft 365 work or school mailboxes. Lusara verifies the selected account and mailbox before activating the connection. - Mail.Send is used to send messages you approve. Mail.Read is used to poll recent Inbox and Sent Items changes, place replies in the CRM timeline, detect opt-out requests, and import recent real-estate lead or inquiry messages. Lusara stores provider message and conversation identifiers, relevant email content, and parsed lead details needed for those workflows. - Lusara does not use connected Outlook mailbox data for advertising, sale of mailbox data, or training generalized AI models. OAuth and disconnect: - OAuth refresh tokens are encrypted before storage. We do not store your Gmail or Microsoft password. - You can disconnect an email account from Settings or revoke access from your Google or Microsoft account. Disconnecting deletes the stored connection token and stops future access, but email logs, CRM records, leads, audit logs, or records already created in your account may remain until deleted through product controls or retained as described in this Policy. - Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. - We do not use Gmail-derived data to serve advertisements, select sponsored vendor placements, determine creditworthiness or lending eligibility, or train or improve generalized AI models. Sponsored vendor and lending workflows remain unavailable for Gmail-imported records until the relevant information is collected separately through Lusara outside Gmail. 4. Email Open and Click Tracking Some search emails sent through Lusara include email engagement tracking: - Open tracking may use a small tracking pixel to record that an email was opened. - Click tracking may replace links with Lusara redirect links so clicks can be recorded before redirecting to the destination. - Tracking events may include the event type, timestamp, target URL for clicked links, related user/client/search identifiers, and user agent. Platform/server logs may also contain IP address or request metadata. We use this information to show engagement, support follow-up workflows, and maintain CRM activity history. Real estate professionals using Lusara are responsible for giving any required notices or obtaining any required consents from their clients, leads, or recipients before sending tracked communications. 5. How We Use Information We use information to: - Provide, secure, maintain, and improve the Service. - Create and manage accounts, authentication, settings, teams, and subscriptions. - Manage buyer clients, seller leads, listing projects, tasks, documents, and client/seller pipelines. - Search, enrich, evaluate, and refresh property data. - Draft, send, sync, track, and display communications. - Generate AI-assisted property evaluations, email drafts, listing descriptions, summaries, chat support, onboarding analysis, and recommendations. - Process billing, subscriptions, credits, invoices, cancellations, and customer portal access through Stripe. - Detect, prevent, and investigate spam, abuse, fraud, unauthorized access, and security incidents. - Maintain audit logs, provider telemetry, operational diagnostics, and compliance records. - Respond to support, legal, privacy, security, and business requests. We do not sell personal information for money. We disclose information to service providers and integrations as needed to operate the Service, as described below. 6. AI and Google Gemini Lusara uses Google Gemini and related AI workflows to help evaluate properties, draft emails, generate listing descriptions, analyze client preferences, summarize or classify leads, support chat workflows, and assist with real estate CRM tasks. AI processing may involve sending relevant property data, client preferences, seller/lead details, user instructions, chat context, email draft context, or listing context to AI providers. AI output may be inaccurate, incomplete, biased, or inappropriate for a particular use. Users must review AI-generated content before relying on it, sending it, publishing it, or using it in a real estate transaction or client communication. Lusara is not a law firm, financial advisor, lender, appraiser, broker of record, or licensed real estate advisor for users. AI output is not legal, financial, tax, appraisal, lending, brokerage, or real estate advice. 7. Third-Party Services and Subprocessors We use third-party services to operate the Service. Depending on the features you use, these may include: - Supabase: authentication, database, storage, and backend services. - Vercel: hosting, deployment, logging, and infrastructure. - Stripe: checkout, subscriptions, billing portal, invoices, credits, and payment processing. - Google services: Google OAuth, Gmail API, Gemini/Generative AI, reCAPTCHA, Maps/geocoding, and related APIs. - Microsoft services: Microsoft OAuth and Microsoft Graph for Outlook.com, Hotmail, Live, and Microsoft 365 email sending, Inbox/Sent synchronization, and lead import. - Property data providers: RapidAPI, RealtyAPI, Zillow-related data sources, Google Maps/geocoding, and other property/search/enrichment providers used by the platform. - Email and infrastructure providers used to deliver, secure, monitor, or support the Service. These providers process information under their own terms, privacy policies, data processing terms, and security practices. We may also disclose information when required by law, to protect rights or safety, to prevent abuse or fraud, in connection with a business transaction, or with your direction or consent. 8. Cookies, reCAPTCHA, and Analytics We use cookies and similar technologies for account sessions, authentication, preferences, security, and necessary Service functionality. We also use Google reCAPTCHA to protect against bots and abuse. reCAPTCHA and related security checks may process IP address, user agent, action, route, score, hostname, challenge timestamp, error codes, and related request metadata. The Service uses internal product analytics and operational telemetry to understand feature usage, provider performance, and service health. 9. Data Retention and Deletion We retain personal information for as long as needed to provide the Service, maintain accounts, comply with legal obligations, resolve disputes, enforce agreements, secure the Service, prevent abuse, maintain billing records, and support legitimate business purposes. You may delete certain client, seller, search, document, and account data through the Service. Account deletion and data deletion workflows remove many user-owned application records and connected email tokens. However, deletion is not always immediate or absolute. We may retain: - Security audit logs, reCAPTCHA attempts, abuse-prevention records, and provider telemetry. - Stripe billing, invoice, subscription, tax, chargeback, and accounting records. - Records needed for legal compliance, dispute resolution, fraud prevention, or enforcement. - Terminated seller-file archives and their audit evidence for the applicable brokerage or jurisdiction retention period. Ending paid archive access does not shorten a required retention period. - SMS message content for five years by default, after which the stored message body is removed. Consent, suppression, delivery, billing, and compliance evidence may be retained separately for an applicable legal, carrier, dispute, or approved brokerage retention period. - Backup copies until they expire through ordinary backup cycles. - Data retained by third-party providers under their own policies. - De-identified, aggregated, or non-personal analytics. Disconnecting Gmail or Outlook deletes the stored connection token and stops future access, but it does not automatically delete CRM records, email logs, leads, or communications already stored in your Lusara account. 10. Security We use administrative, technical, and organizational safeguards designed to protect personal information. Current safeguards include HTTPS, Supabase authentication, row-level security, private storage buckets, service-role separation for privileged operations, encrypted OAuth refresh tokens, reCAPTCHA on sensitive actions, audit logging for destructive account actions, and Stripe-hosted payment handling. No method of transmission, processing, or storage is completely secure. We cannot guarantee absolute security. 11. Your Privacy Rights Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent. You may also have rights under U.S. state privacy laws, GDPR-style laws, or other applicable privacy laws. You can manage many records directly in the Service. You can revoke Gmail access from your Google account or from Lusara Settings. You can disconnect Outlook in Lusara Settings to stop this application's future access and remove its stored connection token. To revoke the permission granted to Lusara in Microsoft, remove Lusara from your Microsoft account's app permissions or ask your work or school administrator. To make a privacy request, contact info@dndsolutions.io. We may need to verify your identity before fulfilling a request. 12. Children The Service is intended for real estate professionals and is not directed to children under 18. Do not use the Service or submit personal information if you are under 18. 13. International Data Transfers We and our service providers may process information in the United States and other countries. Where required, data transfers may rely on contractual, legal, or technical safeguards used by the relevant provider or by us. 14. Updates to This Policy We may update this Privacy Policy from time to time. When we update it, we will post the revised version on this page and update the effective date. If changes are material, we may provide additional notice through the Service, email, or another reasonable method. 15. Contact Us lusara.ai is operated by DND Solutions & Optimization LLC. Website: https://dndsolutions.io Contact: info@dndsolutions.io 16. TikTok Connection and Publishing If you connect TikTok, Lusara receives and stores the connected profile's open ID, display name, avatar and granted permissions to identify the account you select. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM and are used to maintain the connection, obtain permitted profile information and carry out publishing requests you approve. Lusara stores the video, caption or caption notes, publishing settings, approval and delivery status, provider publishing identifiers, timestamps and errors needed to prepare and track your request. For Direct Post, Lusara sends the video, caption and selected settings to TikTok, including privacy, comments, duet, stitch and commercial or AI-content disclosures where applicable. For Send as Draft, Lusara sends the video to TikTok's inbox. Caption notes remain in Lusara; you finish the caption, privacy choices and publication in TikTok. Lusara does not publish a draft on your behalf after inbox delivery. A completed disconnect revokes TikTok access, removes active stored credentials and cancels unsent work. If revocation or local cleanup cannot be confirmed, Lusara shows an error and you may need to retry Disconnect. During account removal or connection cleanup, encrypted credentials may remain temporarily in a retry queue until revocation completes or the grant expires. You can also remove Lusara's access in TikTok. A delivery already accepted or processing at TikTok may still complete. Disconnecting does not remove previously published TikTok content or videos already delivered to TikTok's inbox. Manage those items in TikTok under TikTok's policies. Disconnecting does not automatically erase local connected-profile details, publishing history, approval records, status or errors. We retain these records as needed to provide the service, resolve delivery or billing issues, meet legal obligations and handle deletion requests under this Policy. Temporary abandoned uploads and files for completed, failed or canceled jobs become eligible for cleanup after 24 hours, subject to download-link expiry. Pending or processing jobs age out after seven days from their scheduled time or creation time. Cleanup timing depends on processing and scheduled cleanup; eligibility is not a guarantee of immediate deletion from every system or backup. You can request deletion through account deletion or by contacting info@dndsolutions.io. Content held by TikTok remains subject to TikTok's retention and deletion controls. 17. Website and Native Assistant, Google Calendar and Voice Input The Lusara iPhone app uses the same account and permitted workspace records as the website. With Google Calendar connected and the relevant permission enabled, Lusara reads events from your primary and selected calendars, including shared calendars you can read, to show your schedule and answer calendar questions. Lusara checks busy times and writes confirmed Lusara appointments only to its dedicated app-created Google calendar. Access remains subject to your account, organization, calendar selection and connection permissions. When you allow AI sharing and submit an Assistant question, Lusara may send your question and relevant permitted calendar events, appointments, dated tasks, contact preferences, saved inbox excerpts, deals, marketing records or account basics to Google Gemini. The same sharing choice covers permitted Revenue Radar findings and their supporting evidence, and factual account billing information described below. Source receipts identify the records used and any access or result limits. This does not authorize an unrestricted scan of your mailbox. Existing mailbox AI choices also apply to imported mailbox content and derived findings used for answers. Native appointment changes require a separate explicit confirmation of the displayed proposal. Website appointment changes remain in Scheduler. Dated tasks and follow-ups used by the Assistant are records saved in Lusara. Google Calendar access covers calendar information and permitted appointment synchronization. You can withdraw Google access through your Google account; disconnecting Calendar in Lusara stops future reads and synchronization through that connection. Those actions do not recall information already submitted for processing. Revenue Radar answers use findings and supporting evidence you are permitted to access, subject to the account's existing feature entitlement. They may describe follow-ups, open deals, marketing activity or other recorded items needing attention. They are not a guaranteed revenue forecast. Billing answers may include your stored plan and access status, subscription period dates, platform credit balances and pending reservations, the current workspace's individual SMS segment-credit wallet, and account credit/debit or open-invoice balances from your linked billing customer. Relevant verified amounts and dates may be sent to Google Gemini to answer the question. Platform credits, SMS credits and monetary balances are distinct. Payment-card details, billing credentials and purchase links are not provided to the Assistant. These reads do not initiate payments, purchases, subscription changes, credit refills or billing-account creation. Missing or incomplete results do not establish a zero balance or that nothing is owed. Native voice input requires microphone and speech-recognition permission. The app requests on-device recognition through Apple's Speech framework. If on-device recognition is unavailable, dictation does not fall back to server speech recognition. Audio is used for transcription and is not uploaded to Lusara or Gemini by this dictation feature. In ordinary Dictate mode, the resulting text remains editable and is sent to the Assistant only when you tap Send. Optional Voice email mode requires a separate in-app choice to allow AI and start listening. In that mode, each completed spoken instruction is submitted automatically to Google Gemini to prepare or revise an email, with the draft and relevant permitted client information. Existing mailbox AI permissions still apply. Lusara displays the recipient, sender, subject and full draft before sending. A spoken send request opens review; a separate, fresh spoken confirmation is required to send that displayed email through the connected mailbox. A drafting or polishing request alone does not send email. You can pause or cancel voice, switch to the regular composer, and manage microphone and speech permissions in iOS Settings. Voice commands stop when the app leaves the foreground. Audio stays on device; unsent email drafts use protected local storage, and confirmed send requests use the existing email delivery records. Website dictation uses the browser's speech-recognition service with microphone permission. Depending on the browser and speech provider, audio may be processed remotely under that service's terms and privacy practices. Lusara does not claim that website dictation runs on device. The resulting text remains editable and is sent to the Assistant only when you press Send. You can stop dictation and manage microphone permission in your browser. This dictation feature does not send recorded audio to Lusara or Gemini and does not read answers aloud. Assistant chat transcripts are held in the running app or page's memory. They are cleared on sign-out and are not restored after the native app process ends or the website page reloads. Briefly switching apps or leaving and returning to the same running page can preserve the conversation. Clearing the local chat does not change retention of underlying account records, confirmed appointment changes or information already processed by a provider under the other provisions of this Policy. 18. YouTube API Services YouTube connection is optional. Lusara requests https://www.googleapis.com/auth/youtube.readonly to identify your authorized channel and read upload status, and https://www.googleapis.com/auth/youtube.upload to upload videos you explicitly approve. We access the connected channel ID, name and avatar. Access and refresh tokens are encrypted with AES-256-GCM in server-only storage tied to the authorizing user and workspace. We do not ask for or store your Google password. We process your video link and video bytes, title, description, privacy, category, tags, made-for-kids and altered-content choices to prepare the upload you review. After confirmation and any required administrator approval, we send the video and those settings to YouTube. We store an encrypted resumable upload address while uploading, then the returned video ID, processing status, visibility and delivery errors to recover interruptions without duplicating an upload. You can select a video file from your device or provide a public video link. Selected files are temporarily stored in private Lusara storage for validation, review and approved delivery. The uploading user and authorized workspace approvers can preview them. Unsubmitted uploads expire after two hours; abandoned files become eligible for automated removal after one day. Uploaded files can be scheduled up to 30 days ahead. An unfinished delivery expires seven days after its scheduled time, or after preparation when no time was selected. Source files become eligible for removal one day after delivery reaches a terminal state. Cleanup runs periodically, so deletion may occur later. These source files are not kept as a permanent video library. If you provide a public link instead, its host may receive browser preview and server download requests. Authorized workspace members can see connected channel details and delivery information according to their role; credentials and upload-session addresses are not exposed to them. YouTube data is used to operate this connection and approved publishing, not to train generalized AI models or for personalized advertising. Google processes data it receives under the Google Privacy Policy at https://policies.google.com/privacy. Opening channel images, source previews or YouTube links also contacts the corresponding hosts. Disconnect through Marketing → Social → Channels → YouTube to remove active encrypted credentials and stop affected unpublished deliveries. Lusara requests revocation with Google and retries if Google is temporarily unavailable. You can also revoke access directly at https://security.google.com/settings/security/permissions. Videos already received or published remain on YouTube; delete or manage them in YouTube Studio. Stored channel details and video-status data are refreshed weekly while access remains available, or removed before 30 days. On disconnect or detected revocation, the cleanup worker removes cached Google data after active requests finish. Encrypted revocation retries are kept for no more than six days. A closed local delivery record remains so removed data cannot cause another upload. Contact the privacy contact listed in this Policy for deletion of stored YouTube data or questions about these practices. Account deletion also removes account-owned integration records through Lusara's account-cleanup process. User-authored drafts, approval records and platform-credit accounting follow the other retention provisions in this Policy. 19. Buyer Reminders and Optional Marketing Insights You can record a mortgage pre-approval expiration date and reminder window in a buyer's file. Lusara uses these dates to flag approaching or past expiration. For supported homes a buyer likes above the recorded budget, Lusara can retain the listing identifier, address, liked price, budget and later provider observations to identify price drops. A property alert confirms only the recorded price and listing evidence, not financing eligibility or every buyer requirement. Reminders and suggested follow-ups require the agent's review; these features do not send messages automatically. These records remain until removed with the client or account, subject to the other retention provisions in this Policy. Marketing insights is optional for each connected social account. When you select Enable insights, Lusara reads the available metrics for posts published through Lusara and the connected account's audience size. Depending on the platform and granted permissions, this includes impressions, video views, reactions or likes, comments, shares or reposts, and follower or subscriber counts. YouTube statistics are read using the existing youtube.readonly permission; this supplements the channel identification and upload-status uses described above. LinkedIn post statistics require r_member_postAnalytics, and TikTok video statistics require video.list, with user.info.stats for follower counts. Provider approval and your authorization may be required. Unavailable metrics are not represented as zero. Lusara stores dated metric snapshots for up to 30 days, with periodic cleanup; snapshots older than that are excluded from product reads. Disabling insights removes cached snapshots and stops future collection without changing publishing access. Disconnecting or replacing the connected identity also removes these snapshots. Account deletion removes account-owned insight data. Backup copies follow ordinary expiry cycles. Metrics are used to show account performance and suggest content to consider; they are not sold, used to serve personalized advertising, or used to train generalized AI models. Current content suggestions compare recorded metrics without sending them to a generative AI provider. Results from different platforms are kept separate, and recommendations do not promise future reach or revenue. You may import reports from an outside marketing company after reviewing the reporting periods and figures and confirming permission to add them. Lusara stores the confirmed provider, campaign, platform, dates and aggregate counts in your account; the source CSV file is processed for preview and import and is not retained as an uploaded file. Imported reports are identified separately from provider-verified statistics and are not combined with them. Reports remain until you remove them or delete your account, subject to the other retention provisions in this Policy. Importing a report does not grant its author access to your Lusara account or authorize publishing or messages. 20. Support Requests and Evidence When you contact Lusara support, we collect your account identifier, name, verified contact email, phone number, selected category, message, conversation and optional image or video evidence. Phone collection does not authorize marketing or SMS. The contact address can differ from your sign-in address; proving control of it does not change your sign-in credentials or grant account access. Authorized Lusara support staff can review your ticket and limited account diagnostics needed to investigate, such as account type, organization membership, subscription and credit status, connection status and the coarse app section, locale and time zone supplied by your browser. Support diagnostics do not include OAuth tokens, passwords, full payment details or your connected mailbox contents. Internal staff notes, assignments and audits are separate from customer-visible conversations. Organization administrators do not automatically gain access to individual support tickets. Evidence is held in private storage, checked for malicious or invalid content and made available through short-lived access links. Rejected files cannot be downloaded through support. We use account limits and short-lived keyed IP/address abuse-control identifiers, and Google reCAPTCHA helps protect submission. Do not include passwords, codes or unnecessary client information in your request. Public help searches run in your browser and are not retained as search-query analytics by this feature. Resend delivers support verification codes, receipts, reply and closure emails, and staff notifications using the recipient address and the notification content. Private support evidence is stored in Supabase and processed by the attachment security worker hosted on Railway before it can be opened through support. Tickets remain available in the signed-in portal if email is delayed. Replies to these notification emails are not added to the ticket. A separately verified contact-address change applies only to future notifications for that ticket. Redaction removes retained support content but cannot recall email already delivered. Unfinished uploads expire after approximately 50 hours, allowing resumable upload permissions to expire safely. Evidence normally expires 90 days after closure; reopening cannot restore evidence already expired. Closed tickets and associated conversations, diagnostics, audits and delivery records are normally removed after 24 months, with periodic cleanup. Account deletion can remove account-owned support records earlier through the existing deletion process. Short-lived verification and abuse-control data expire on their operational cleanup schedules. Backup copies follow ordinary expiry cycles. Support information is used to provide and protect support, not to train generalized AI models or serve personalized advertising. 21. Facebook and Instagram Publishing When you connect a Facebook Page or Instagram professional account, Lusara receives the authorized account or Page identifiers, name, username and profile image where available, granted permissions and authorization expiry. Facebook may return the Pages you can publish to so you can choose the destination inside Lusara. Credentials for these temporary Page choices are encrypted, accessible only to the server and removed after the short selection window. Lusara uses the corresponding account authorization to publish only content you explicitly approve through the applicable workspace approval process. This includes captions, links where supported, photos or Instagram Reels, schedules, media processing containers, publication identifiers, links, delivery status and errors. This connection does not request private messages, comment management or Instagram insights. Facebook Page engagement access supports the Page publishing connection; this feature does not collect Meta performance analytics. Access credentials are encrypted on the server and scoped to the connected account and Lusara workspace. Instagram authorization can be renewed before it expires; unavailable or revoked permissions require reconnection. Credentials are never placed in member-readable social-account records. Private delivery copies of approved media are shared with Meta through temporary download links and normally removed after 24 hours. Photos may be converted to JPEG with embedded metadata removed for provider compatibility. Disconnecting removes active stored credentials and stops unpublished deliveries that have not already been sent. If Meta cannot be reached, an encrypted revocation record is retained only to retry removing authorization. Facebook Pages sharing the same authorization may disconnect together. Reconnecting does not automatically approve canceled posts. A request already sent can complete after disconnection; an uncertain result is held for review rather than automatically published again. When Meta sends a valid deauthorization or data-deletion request, Lusara validates its signature using the corresponding application secret. Deletion removes the affected connected profile details, credentials and Meta-derived publication identifiers and processing state. Prepared delivery files are queued for removal after a short grace period for in-progress transfers; the confirmation page shows when file cleanup is still pending. Minimal deletion confirmation and authorization-invalidation records remain to demonstrate completion and prevent replay or recreation of removed data. Backup copies follow ordinary expiry cycles. Content already published remains on Facebook or Instagram unless you remove it there. Original drafts and source files you created in Lusara remain part of your workspace until removed through the applicable controls or retention process. Contact Lusara support for help with your account or a deletion request. 22. Account Verification, Feedback and Trial Reviews Lusara uses emailed verification codes for sign-in and protected account or organization actions where required. Resend receives the delivery address and code email for these account checks. Verification records include account and session identifiers, code digests, attempt counts and delivery or expiry timestamps. Optional Face ID, Touch ID or device-passcode unlock on iPhone is separate; Lusara does not receive biometric templates. Buyer intake verification sends a code to the buyer email address saved by the agent through the agent's connected Gmail or Outlook account. A verified session is required for protected intake answers and documents. We retain verification digests and short-lived session records to enforce expiry and prevent replay. Verification does not subscribe the recipient to marketing. Optional product surveys collect the answers, ratings, workflow preferences and suggestions you submit, linked to your account so the Lusara team can understand product feedback. Trial reviews are saved with your account and the one-time extension outcome. Reviews can be positive or negative; completing the survey or posting a public review is not required. Submitting feedback or a trial review does not itself publish it as a testimonial. These records follow the account retention and deletion provisions of this Policy. Use support tickets for issues that need a reply, and leave unnecessary client or other private information out of feedback. 23. X and LinkedIn Publishing When you connect X or LinkedIn, Lusara stores the authorized profile identifier, name, username where available, profile image, granted permissions, connection status and authorization expiry. Account-specific access credentials, and refresh credentials where provided, are encrypted on the server and scoped to the connected account and workspace rather than exposed in member-readable social-account records. For an approved delivery, Lusara sends the caption, supported link or media and applicable publishing settings to the selected provider. Lusara keeps drafts, schedules, human approvals, provider publication identifiers, post links, delivery status, errors and credit receipts to operate and troubleshoot publishing. X supports text, images and video; LinkedIn personal-profile publishing supports text, a link or one image. These publishing connections do not authorize reading private messages. Optional marketing insights use the separate controls described above. Disconnecting removes active local credentials and cancels affected unpublished deliveries that have not already been sent. X authorization revocation can require an encrypted retry record if the provider is unavailable. Expired or revoked authorization can require reconnecting. You can also remove Lusara through the provider's connected-app controls. A delivery already accepted by a provider may finish; disconnecting does not delete published posts. Manage published content at the provider. Local drafts and publishing records remain subject to this Policy's retention and deletion provisions. 24. Deal Conversations and External Collaborators When an agent invites a lender, title contact, attorney or client, Lusara stores the invitee's name, email, role, invitation status and the linked deal and organization. Verification and access records include code digests, attempt counts, hashed network identifiers and short-lived guest session records. The guest link alone does not authorize access. Verification email contents are encrypted while queued for delivery. We store messages, author names, timestamps, document requests, completion states and deliberately shared files in Supabase. Authorized members of the agent's organization and that deal's invited collaborators can read shared content. Internal notes are available only to authorized organization members. Existing deal documents are not automatically shared. Collaborators can see the deal's property address, stage, shared conversation, document requests and collaborator names and roles; this invitation grants no access to other deals or the agent's mailbox and client directory. Resend receives recipient addresses and the contents of invitation, verification and update emails. Update emails contain a link rather than the message body or document attachments. Uploaded PDFs and images are stored privately and processed by the Railway security worker before they can be shared or downloaded. Security checks reduce risk but cannot guarantee that a file is safe or accurate. Access-controlled download links expire after one minute. Invitations can be revoked by the agent's organization. Leaving the organization or beginning account deletion revokes invitations that agent issued. Deal-owned conversation history can remain with the organization after an individual account is removed. Deleting a deal or its organization removes its conversation records and queues associated files for deletion, retried if storage is unavailable. Unattached uploads expire after 24 hours and are removed by scheduled cleanup. Expired verification records and older delivery records are removed through scheduled retention. Copies already downloaded or retained by another participant are outside Lusara's deletion controls. These records remain subject to the retention and rights provisions of this Policy. Housing-search safety classification When enabled, Lusara sends the search preferences, requested location, budget and constraints supplied for a property search to TypeSafe (Jev) to check whether the request uses objective property criteria, needs clarification, or requests discriminatory targeting. Search notes can include personal context you enter; include only what is needed for the search. This classification does not determine a person's eligibility for housing, verify a legal exception, or replace agent review. Lusara does not include the client's name, email address, mailbox, attachments, conversation history or retrieved listing records in this classification request. Personal details typed into the search notes are part of those notes. Searches running under the existing Gmail or Outlook AI authorization keep their existing processing and are not sent to Jev under that authorization. Developer email experiments are separate from live mailbox imports. Lusara records the decision, model/rubric version, reason codes and a hash of the reviewed text in its safety audit, rather than storing the query in that audit. A low-confidence or ambiguous classification asks for clarification; a failed safety check or unavailable classifier can stop the search. Generated property evaluations remain subject to separate checks and human review. TypeSafe's privacy information is available at https://typesafe.ai/privacy.