Privacy Policy

AgentFlex is used by real estate agencies to prepare proposals and property websites. This policy explains what personal information the service holds, why, and how it is protected.

Your agency's role and ours

For the client, vendor and property information your agents enter, your agency is the data controller and we act as its data processor: we hold and process that information only to provide the service to your agency, on its instructions. For your agents' own account details, your agency and we each hold the information needed to run the account.

What is collected

• Account details: name, email address, role and agency, for each user.
• Workspace content: proposals, property details, vendor and client names, phone numbers and email addresses, comparables, photographs, brand assets and generated websites.
• Usage and technical information needed to operate and secure the service, such as sign-in events and errors.
• Billing details, handled by our payment provider. We do not store card numbers.

Why it is held

To provide the workspace, generate documents and websites, send the emails your agency asks us to send, manage subscriptions and support requests, and meet legal obligations.

Access to your data

Each agency's workspace is separated from every other agency's. Staff at one agency cannot see another agency's proposals, clients, photos or websites, and neither can their administrators. Our own access is limited to what is necessary to operate and support the service: when your agency asks us to investigate a specific issue, to respond to a security incident, or where disclosure is required by law. We do not browse customer content for any other purpose, and we do not sell it or use it for advertising.

Who else is involved

• Our application and database hosting provider, which stores the workspace data.
• Our payment provider, for subscriptions and invoices.
• AI and file-processing services, when your agency uses features such as extracting property data from an uploaded appraisal or generating copy.
• Email delivery, for proposals and notifications your agency sends.

These providers process information on our instructions. Some are located outside New Zealand, so information may be stored or processed overseas.

Google account access (sending email)

An agent may choose to connect their own Google account so that proposals are emailed from their own address rather than a shared agency address. This is optional: it is only connected if the agent completes Google's sign-in and consent screens, and it can be disconnected at any time.

When an agent connects a Google account, we request two permissions:

• Send email on your behalf (gmail.send). This is used for one purpose: sending the proposal email that the agent has composed and confirmed in the app. We cannot read, search, delete or modify the contents of the mailbox, and we do not have access to any message other than the ones the agent sends through AgentFlex.
• Email address (userinfo.email). This is used only to show the agent which address is connected, and to record it as the sender on proposals they send.

We store the access token Google issues, so that the agent does not have to sign in for every email. It is held with our connector provider, is used only to send the email the agent requested, and is deleted when the agent disconnects the account or when their agency's workspace is deleted. We do not store copies of sent messages beyond the proposal record the agent created.

Google user data is not sold, is not used for advertising or profiling, is not used to train artificial intelligence models, and is not transferred to any third party except the infrastructure providers that host and operate the service on our instructions, or where the law requires it. No person reads it except as described under "Access to your data" above. AgentFlex's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

An agent can revoke access at any time by pressing "Use a different address" under Team → Your sending email, or from Google's permissions page. Revoking access stops further sending; it does not affect the agent's AgentFlex account. To have the stored token and sender record deleted, contact us and we will remove them.

How long it is kept

Workspace content is kept while your agency's subscription is active. After cancellation it is available for export for 30 days, then deleted, except records we must keep for tax or legal reasons.

Security

Access is restricted by agency and by role, data is encrypted in transit, and access to administrative functions is limited. No system is perfectly secure, but we take these steps to protect the information held for you.

Your rights

Individuals may ask to see or correct personal information held about them. Because your agency controls its client and vendor records, requests about that information should go to the agency first; we will assist them. Requests about your own account can be sent to us directly. If you are not satisfied with our response you may contact the Office of the Privacy Commissioner.

Breach notification

If a privacy breach occurs that is likely to cause serious harm, we will notify affected agencies and the Privacy Commissioner as required by the Privacy Act 2020.

Contact

Privacy questions can be sent to the address on our contact page.