Privacy Policy

This policy explains how Attune Technologies, Inc. ("Attune," "we," "us," or "our") collects, uses, discloses, and protects personal information through Sorted. Sorted includes our websites, web and native applications, AI assistant, connected CRM, capture, messaging, and lead capture features. This policy also applies to people who communicate with a Sorted Customer through the service, sign in on a Sorted Customer's open-house page, or submit a form a Sorted Customer connects to Sorted.

Who this policy covers

• Sorted Customer. An individual real estate professional, brokerage, team, or other organization that subscribes to or receives access to Sorted.
• Sorted User. A person whom a Sorted Customer permits to use its Sorted account, such as an employee, agent, or contractor.
• Contact. An end consumer, such as a current or prospective client or lead, whose information a Sorted Customer manages or with whom it communicates through Sorted.

Information we collect

The information we collect depends on the features a Sorted Customer enables:

• Account and organization information. Names, email addresses, authentication identifiers, organization membership, roles, and account settings.
• CRM and contact information. Connected CRM credentials and records such as contacts, phone numbers, email addresses, lead details, and account metadata.
• Communications and notes. Emails; SMS, MMS, and other messages; attachments; call and meeting metadata; notes; prompts; responses; and conversation history.
• Sign-in and lead information. The name, phone number, email address, and answers a Contact gives on a Sorted Customer's open-house sign-in page or kiosk, or in a website form the Sorted Customer connects to Sorted; the open house or form it came from and when; whether the Contact allowed text messages, with the exact wording shown; and, for connected forms, the submitted data as received.
• AI and enrichment information. Assistant conversations, tool results, compacted conversation history, and information returned from public-web searches.
• Device and capture information. Device tokens, app configuration, and, when capture is enabled, messages, emails, and call records made available from an authorized device or connected account.
• Location and device information. When a Sorted User shares location from a device, the device's precise location, or its approximate location where the Sorted User allows only that, sent with each message to the assistant: its coordinates, how accurate they are, when the device measured them, and, from the iPhone and Mac apps, whether precise location is allowed and a place name such as a neighborhood and city. Each message to the assistant also says which Sorted app and kind of device sent it and, when it carries no location, why: for example, that the device is still finding its position, could not find it, or does not share location with Sorted.
• Service and technical information. IP address, browser or device type, session and security events, error details, and service usage metadata.

Sorted is designed for ordinary CRM and client-relationship information. Do not submit passwords, payment-card data, government identification numbers, health information, or other regulated sensitive data.

Where information comes from

We receive information directly from you, from the organization that provides your Sorted account, from other people who communicate through Sorted, from Contacts who sign in at a Sorted Customer's open house or submit a form the Sorted Customer connects to Sorted, from connected services and authorized devices, and from public sources used for lead enrichment. A Sorted Customer is responsible for having authority to provide information about its contacts and personnel.

How we use information

We use this information to:

• Provide, authenticate, personalize, maintain, and support Sorted.
• Connect and synchronize CRM data and enrich contacts from public sources.
• Transmit, store, search, and organize communications across enabled channels.
• Generate AI responses, summaries, recommendations, titles, and requested actions.
• Protect accounts, prevent abuse, troubleshoot failures, and enforce our terms.
• Administer private-beta and paid-pilot relationships.
• Comply with applicable law and enforce our agreements.

AI processing and product improvement

Sorted sends the content needed for an AI request to the selected AI provider and may use temporary secure computing environments for requested tool work. By default, we use providers and settings that do not permit content from a Sorted Customer to train shared provider models. If we offer an option with different provider data-use terms, we will disclose those terms and require the Sorted Customer to choose that option before enabling it.

Attune may create and retain aggregated or de-identified information to analyze, secure, and improve Sorted, including its models and product behavior. We do not use identifiable content from a Sorted Customer to train shared models. We may retain genuinely de-identified information indefinitely and will not attempt to re-identify it.

Location

Sharing location is optional, and each device asks separately through its own or its browser's permission. While it is on and the Sorted app is open, Sorted reads the device's location and sends it with each message to the assistant, so the assistant can make recommendations near the Sorted User, such as nearby open houses, travel times between showings, and places to meet. Sorted stores the location with the message, and it reaches the AI provider as part of that conversation. When the assistant centers a Google Maps place search on a Sorted User's shared location, Sorted sends that location to Google with the search. Sorted does not read location in the background or between uses of the app, and does not use it for advertising. A Sorted User can stop sharing at any time in the device's or browser's settings; locations already sent remain with their conversation.

Google account data

You choose whether to connect Google accounts to Sorted. Google sign-in provides your account identity. Connecting Gmail and Calendar, or separately connecting Google Drive, lets Sorted access the services and permissions you authorize.

• Gmail. Sorted's sync imports existing correspondence involving the contacts you choose and retrieves new messages in your connected mailbox to find further correspondence with them. It stores only that correspondence, including message content, attachments, and participant information, so you can search correspondence, see contact history, and ask the assistant for summaries. When you ask, the assistant can also search your connected Gmail and read messages, threads, drafts, and supported attachments, including mail involving people outside your contacts. Content and attachments used in an assistant conversation may remain in its history and stored files. With your approval and the relevant permissions enabled, Sorted can send, reply to, and forward emails with attachments; create, update, and discard unsent drafts; create and rename labels; change labels, stars, importance, and read status; archive messages, return them to the inbox, and move messages to or from Trash. Sorted does not permanently delete Gmail messages or manage Gmail filters or account settings.
• Google Calendar. Sorted reads events from calendars you connect and stores meetings involving the contacts you choose and meetings you create through Sorted. With the relevant permissions enabled, you can create, update, cancel, and respond to meetings. Changes may send Google invitation or update emails to attendees.
• Google Drive. When you connect Files, Sorted searches file metadata and reads supported file contents on request. With your approval and the relevant permissions enabled, it can create and update files or move them to Trash. Sorted does not change Drive sharing permissions or permanently delete files. Drive content is fetched on demand; content used in an assistant conversation may remain in that conversation's history.

Sorted processes Google data on its servers and sends the content needed for your requested features to its service providers, including AI providers for answers and summaries. Enabled CRM integrations may receive supported calendar updates at your direction. Pipedream manages Sorted's Google authorization and relays Sorted's requests to Google, including message content and attachments. Pipedream holds the Google access and refresh tokens; Sorted does not retrieve them, and they are not given to the assistant, your browser, or its temporary tool workspace.

Sorted's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only for the permitted, user-facing features you authorize. We do not use Google data, including derived or de-identified data, to create, train, or improve general-purpose or shared AI models. The product-improvement and optional provider data-use terms elsewhere in this policy do not override this restriction.

Transfers of Google data are limited to providing or improving permitted user-facing features with your consent, security purposes, legal requirements, or a merger, acquisition, or sale of assets with your explicit prior consent. Human access is limited to your documented permission to view specific data, security purposes, legal requirements, or aggregated and anonymized data for internal operations as permitted by Google's policy. We do not use Google data for advertising, sell it, or use it to assess creditworthiness or lending eligibility.

You can turn individual permissions off or disconnect a Google account in Sorted Settings. Disconnecting stops future access through that connection; it does not automatically erase imported correspondence, meetings, or assistant history. You can also revoke access in your Google Account connections: remove the Pipedream grant, and any older Sorted grant. To request deletion or an export of Google data already stored in Sorted, contact team@attunehq.com. Stored data follows the retention periods below and the Google restrictions in this section. These restrictions take precedence over any broader use or disclosure described elsewhere in this policy.

How we disclose information

We disclose information as needed to operate Sorted:

• Sorted Customers, Sorted Users, and Contacts. A Sorted Customer controls its account and directs which Sorted Users and Contacts participate. Participants can see the information exchanged with them.
• AI model providers. Depending on the features a Sorted Customer enables, we may use OpenAI OpCo, LLC; Anthropic, PBC; X.AI LLC; or Meta Platforms, Inc. to process the content needed for an AI request.
• Other key service providers. Clerk, Inc. provides authentication; Railway Corporation provides hosting and database infrastructure; Daytona Platforms Inc. provides temporary tool sandboxes; Pipedream, LLC manages Google authorization and relays requests to Google; SideGuide Technologies, Inc. d/b/a Firecrawl provides public-web search and extraction; Cloudflare, Inc. protects sign-in pages from automated abuse; Google LLC provides Google Maps place search and place details, and a search sends Google its words and any location it centers on, such as a Sorted User's shared location or a Contact's address; and Apple Inc. and Google LLC provide sign-in, device, or notification services. These providers process information for the services they provide to us.
• Connected data systems. Sorted may integrate with CRMs and other data systems used by a Sorted Customer. We use access provided by the Sorted Customer and interact with each connected system according to its terms and policies.
• Legal and safety needs. We may disclose information when law requires it or when reasonably necessary to protect people, rights, systems, or the service.
• Business transactions. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.

We do not sell personal information, share it for targeted advertising, or disclose it to third parties for their own marketing.

Retention

We keep information while an account is active and as needed to provide Sorted. After an account or organization ends, we delete or de-identify its content within 30 days, unless we must retain information for security, legal compliance, an unresolved dispute, or an enforceable agreement. Residual copies may remain in backups until overwritten through the normal backup cycle.

During the 30-day period, a Sorted Customer may request a reasonable machine-readable export of its content. De-identified information may be retained as described above.

Security

We use administrative, technical, and physical safeguards designed to protect the information we hold. These include access controls, encrypted transport, tenant and member boundaries, and credential protection. No transmission or storage system is completely secure.

Your privacy choices

You may ask to access, correct, export, or delete personal information by contacting the Sorted Customer responsible for your record or by emailing team@attunehq.com. We may verify your identity and coordinate with the responsible Sorted Customer before completing a request. We may retain information when the law permits or requires it.

Communications with Contacts

Sorted Customers may use Sorted to communicate with Contacts by email, and to capture the phone calls and the SMS, MMS, and other messages they exchange with Contacts through their own devices and accounts. We process the content, participants, and related metadata needed to provide the features the Sorted Customer selects.

A Sorted Customer may pair a Mac with Sorted. With the Sorted Customer's own messaging account signed in on that Mac, Sorted reads the text messages (including attachments and reactions) and the call records the Sorted Customer exchanges with the Contacts the Sorted Customer selects, and stores them in Sorted. Sorted reads nothing for a Contact the Sorted Customer has not selected, and the Sorted Customer chooses for each selected Contact whether messages and call records from before the selection are included. The Sorted Customer can stop syncing a Contact or disconnect the Mac at any time. Records already stored remain subject to this policy.

Sorted may draft a text message for a Sorted User. The Sorted User reviews the draft and chooses whether to send it through the user's own communication account or device. Sorted does not send text messages. The Sorted Customer and Sorted User are responsible for the message's content, recipient, legal basis, and any required consent or opt-out handling.

The Sorted Customer determines whom to contact and why. The Sorted Customer must provide required notices, obtain and preserve any required consent, and honor each Contact's communication preferences.

Open-house sign-ins and website leads

A Sorted Customer can publish open-house sign-in pages at an address on pages.keepsorted.ai, show the same sign-in form on its own device, and send leads from its website forms or automation tools to a private Sorted address. Each sign-in page names the Sorted Customer, its brokerage, and its license number, and links to a short notice explaining how the Sorted Customer uses the information. We process sign-in and lead information on the Sorted Customer's behalf to add or update the Contact in the Sorted Customer's account and to notify the Sorted Customer.

Allowing text messages is optional, and the box is unchecked unless the Contact checks it. Sorted keeps a record of the Contact's permission or refusal, the wording shown, where it came from, and when, so the Sorted Customer can honor the Contact's choice. Recording a permission does not cause Sorted to send a text message.

Sign-in pages set no cookies. To protect them from automated abuse, we use Cloudflare Turnstile, which processes the visitor's IP address and browser and device signals under Cloudflare's own privacy terms, and we limit repeated sign-ins using a one-way keyed hash of the visitor's IP address rather than the address itself. A Contact can ask to see, correct, or delete sign-in information as described under "Your privacy choices."

Calls

Sorted does not record, transcribe, or summarize calls. When a Sorted Customer captures a call from its own device, Sorted stores the call's metadata (the participants, direction, outcome, duration, and time) and may prompt the Sorted Customer for a note. That note is the Sorted Customer's content and receives the protections and retention treatment described in this policy.

U.S. service and children

Sorted is currently offered in the United States and is intended for business users who are at least 18 years old. It is not directed to children.

Changes to this policy

We may update this policy as Sorted changes. We will post the revised policy here, update its effective date, and provide additional notice when required by law.

Contact us