Privacy Policy

Salt and Leaf Systems LLC ("Salt & Leaf", "we", "us") makes the Salt & Leaf app, a desktop app and website that runs AI automations called Flows for real-estate professionals. This Policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have.

This Policy covers the desktop app, the account website at app.saltandleafsystems.com, our other websites, discovery calls, and our emails and support.

This Policy works alongside the Terms of Service and the Data Protection and Confidentiality Addendum (the "Addendum"). For a Customer, the Addendum sets out our binding commitments about Customer Data. If this Policy and the Addendum differ about Customer Data, the Addendum controls.

These terms have the same meaning here as in the Terms of Service, which give the full definitions. In short:

• App means the Salt & Leaf desktop app and the account website, together.
• Customer means the person or business that accepts the Terms of Service and holds the Account. A Customer may be a brokerage with several Users or an individual agent.
• Account means the Customer's account in the App.
• User means an individual with a login under a Customer's Account, whatever their role (Owner, Admin or Team member).
• Flow means an automation a Customer adds and runs in the App. A Flow Spec describes what a Flow does and what it needs. A Run is one execution of a Flow. A Custom Flow is a Flow built for one Customer.
• Sapling means a Customer's request for a new Flow, from the request form through the discovery call and quote to the finished build.
• Customer Data means the data a Customer or its Users put into the App or into a Flow, including listing data, photos, documents and personal information about the Customer's own clients. It includes Sapling requests and sample files, discovery call recordings, transcripts and notes, and data we reach through an Access Authorization.
• Output means what a Flow produces from Customer Data.
• Subprocessor means a company we use to process personal information to deliver the App (listed in Section 9).

Customer Data. When a Customer puts data into the App, we process it on the Customer's behalf and only on its instructions. For this data we are the Customer's processor, or "service provider" as the California Consumer Privacy Act uses that term. The Customer decides what goes in and is responsible for having the right to share it and for giving its own clients any notices they need. If you are a client of one of our Customers, see Section 17.

Our own information. For account, sign-in, billing, signature, usage, support and similar information about Customers and Users, and for people who contact us or book a call, we decide how the information is used. For this information we are the controller, and this Policy describes what we do with it.

Account information. Name, email address, phone number, business name, role in the Account, and a tax ID if you give one for invoices. When a new workspace asks for access, we collect the details in the access request.

Sign-in and security information. Sign-in times, IP address, device and browser type, multi-factor authentication settings and session records. Passwords are stored by our sign-in provider in scrambled (hashed) form. We cannot see your password.

Electronic signature records. When you accept an agreement or sign a quote in the App, we record who accepted, the date and time (with time zone), the document version and a fingerprint of its text, your IP address and your browser. These are legal records of the agreement.

Billing information. Stripe processes all payments. Stripe collects your card details directly. We receive only the card brand, last four digits, expiry date, billing name and address, and records of charges and invoices. We never see or store full card numbers.

Usage and Run logs. Which Flow ran, when, which User started it, what it cost in usage, and whether it succeeded or failed, with error details when it failed.

Customer Data and Outputs. The inputs you put into Flows (such as listing data, photos, documents and client details) and the Outputs Flows produce. You control what you put in.

Sapling information. Your request form, the sample files you send, notes from our review, the quote and the build plan.

Call recordings, transcripts and notes. Discovery calls are recorded and transcribed as described in Section 6.

Support messages. Emails and other messages you send us, and our replies.

Desktop app diagnostics. App version, operating system version, device type, and error and crash reports, so we can fix problems.

Card numbers. Stripe holds them, not us.

Passwords for other websites. Some Flows open a third-party website (for example, a virtual tour service) in the App's browser panel. You sign in to that site yourself. The session stays on your device. We never ask for, receive or store that password.

MLS logins and shared logins. We never ask for, receive or use an MLS login, or any other personal login shared with us, including sub-logins. Where a Flow needs MLS data, we get it through a licensed data feed under our own agreement with the provider. If a build needs access to another system, the Customer creates a separate account for Salt & Leaf where that system's rules allow it. That grant is recorded in an Access Authorization and revoked at handoff.

When a Customer plants a Sapling, we hold a short discovery call on Zoom. We record and transcribe the call with Fathom so we can prepare an accurate quote.

Florida law (Florida Statutes section 934.03) requires everyone on a call to agree before it is recorded. So:
(a) the booking step asks you to agree to the recording before you can book;
(b) the calendar invite says the call will be recorded and transcribed; and
(c) our specialist says so again at the start of the call.

Anyone who does not want to be recorded can ask for an unrecorded call or for written questions instead. Just tell us before or at the start of the call.

We use recordings, transcripts and call notes only to understand the request, prepare the quote and build plan, and build the Flow.

We keep them while the Sapling is open and for 12 months after it closes, then delete them. You can ask us to delete them sooner.

We use personal information to:
(a) provide the App and run the Flows you choose, including sending Customer Data to Subprocessors so a Flow can produce its Output;
(b) review access requests and manage Accounts, Users and roles;
(c) scope, quote and build Custom Flows;
(d) take payments, apply credits, issue invoices and keep billing and tax records;
(e) keep records of what was agreed and when;
(f) send account and service emails (Section 12);
(g) answer support requests;
(h) keep the App secure, prevent misuse and fix errors;
(i) improve the App, using usage and Run logs and diagnostics rather than the content of Customer Data; and
(j) meet legal obligations and protect our rights.

Our staff look at Customer Data only when needed to deliver the App, to fix a problem, to build a Custom Flow, or when you ask us to.

Flows use Anthropic's Claude models. When a Flow runs, the inputs it needs are sent to Anthropic, and the Output comes back to your Account.

We do not train AI models on Customer Data. Anthropic processes it under its commercial terms, which do not permit it to train its models on that data.

We choose the model and settings each Flow uses and may change them to keep quality and cost right.

Subprocessors. We share personal information only with the Subprocessors below, which process it on our behalf to deliver the App:

New Subprocessors. We give Customers 30 days' notice before a new Subprocessor starts processing their data. A Customer that objects may close its Account, as the Addendum explains.

Legal reasons. We may disclose information when the law, a court order or a valid legal request requires it, or where needed to protect the rights, property or safety of Salt & Leaf, our Customers or others.

If the business changes hands. If Salt & Leaf is merged, sold or reorganized, information may pass to the new owner, who must keep honoring this Policy for the information it receives. We will tell Customers before that happens.

Nothing else. We do not share personal information with anyone else unless you ask us to.

We do not sell personal information. We do not share it for targeted or cross-context behavioral advertising. We do not use it for profiling that has legal or similarly significant effects on anyone.

The website and desktop app use only the cookies and local storage needed to keep you signed in, keep your session secure and remember your settings.

We use no advertising trackers and no third-party advertising cookies. If we ever add analytics, we will update this Policy first.

Because we do not track you for advertising, we have nothing to switch off when your browser sends a "Do Not Track" or Global Privacy Control signal. We treat such a signal as a request to opt out of any sale or sharing, which we do not do anyway.

We send account and service emails: sign-in and security messages, receipts and invoices, usage and expiry reminders, Sapling and build updates, notices of changes to our agreements, prices or Subprocessors, and replies to your messages. These are part of the service, and you cannot opt out of them while your Account is open.

If we send product news, each message will have an unsubscribe link, and unsubscribing will not affect your Account.

While the Account is open, we keep Account information, Customer Data, Outputs and Run logs so the App works and you can see your history.

After the Account closes, we delete Customer Data and Outputs, or return them if the Owner asks before closure, within 30 days. If we closed the Account at once, the Owner may ask for that return within 14 days after closure. We delete or de-identify other Account information and Run logs within the same 30 days, except the records in 13.3.

Legal records. We keep billing, tax and payment records, electronic signature records, and signed agreements and quotes for 7 years after the Account closes, or longer if the law requires.

Call recordings follow Section 6.5.

Security logs are kept for up to 12 months, unless needed longer to investigate a security issue.

Declined requests. If we decline an access request, or a Sapling closes without a build, we delete its request details and sample files within 30 days, except any call recording, which follows Section 6.5.

Backups. Deleted data can remain in our backups until they roll off on their own schedule, within 35 days. We do not use restored backup data for anything except recovering the service.

We protect information with:
(a) encryption in transit and at rest;
(b) least-privilege access, so only people who need data for their work can reach it;
(c) multi-factor authentication on Salt & Leaf systems; and
(d) credentials kept only in a password manager, never in code.

No system is perfectly secure. Keep your own sign-in details private, turn on multi-factor authentication, and tell us at once if you think someone has used your Account without permission.

If we confirm a breach of security that affects a Customer's data, we will tell that Customer within 72 hours of confirming it, explain what we know, and help it with any notices it must give.

Where Florida Statutes section 501.171 applies, affected individuals are notified within 30 days after the breach is determined, either by us or by the Customer, as the Addendum explains.

We offer these rights to everyone, wherever you live:
(a) Access: ask what personal information we hold about you and get a copy.
(b) Correction: ask us to fix information that is wrong. You can also edit most Account details yourself in the App.
(c) Deletion: ask us to delete your personal information. We will delete it except where we must keep it (Section 13.3) or need it to finish something you asked for.
(d) Portability: get your information in a common, machine-readable format. The Owner can also export the Account's data in the App.
(e) Opt out: of product news emails, and of any sale, sharing or targeted advertising (we do none of these).
(f) No discrimination: we will not charge you more, give you a worse service or treat you differently for using any of these rights.

How to ask. Email titus@saltandleafsystems.com and tell us what you want. We may need to confirm your identity first, usually by asking you to reply from the email address on the Account. You may use an authorized agent; we may ask for proof that the agent is acting for you.

How long it takes. We respond within 45 days. If we need more time, we will tell you why within those 45 days and take no more than another 45 days.

If we say no. We will explain why. You can ask us to reconsider by replying to our answer, and we will give you our final decision within 45 days.

Customer Data. For personal information inside a Customer's Customer Data, we act for the Customer. We pass the request to that Customer and help it respond (Section 17).

If you are a client of a real-estate professional who uses Salt & Leaf, your information is in the App because that professional put it there. They decide how it is used.

To access, correct or delete that information, please contact that professional. If you contact us instead, we will pass your request to them and help them respond.

The App is for adults using it for work. It is not for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you think we have, contact us and we will delete it.

Salt & Leaf is based in the United States, and we and our Subprocessors process information in the United States. If you use the App from outside the United States, your information will be transferred to and processed in the United States.

When we change this Policy, we publish the new version in the App with its version number and effective date.

For material changes, we email Customers at least 30 days before the change takes effect.