Privacy Policy

npy.agency is a sole proprietorship based in Nevada, USA. This policy explains what we collect, why, and what you can do about it. We don't sell your data, we don't sell your leads' data, and we use the minimum information needed to run the Service.

This policy covers you if you visit npy.agency, book a discovery call, or are a paying customer. It does not cover the leads and contacts whose information our customers process through the Service.

When a real estate agent uses npy.agency to engage their leads, that agent is the data controller for those leads' information — npy.agency acts only as a service provider (data processor), and the agent's own privacy policy governs how that data is handled. If you're a lead with questions about your data, contact the agent you've been speaking with.

From prospects (you, if you book a discovery call): first name, last name, email, phone number, the free-text answer you provide about your lead-engagement challenges, and technical metadata about your visit (IP address, browser type, pages viewed, referrer).

From customers (paid subscribers): business name, brokerage, billing details (processed by Stripe; we don't store card numbers), CRM integration credentials (encrypted at rest), and configuration of your AI assistant.

From your leads (the people contacting you): names, phone numbers, email addresses, conversation content (Instagram DMs, SMS, email), and any data they choose to share. We process this on your behalf as a data processor; you are the data controller.

Automatically via cookies and similar: a GoHighLevel tracking pixel to attribute visits to bookings, and Vercel Analytics for aggregate page-view counts. We do not use third-party advertising trackers.

• To provide and improve the Service.
• To send you booking confirmations, reminders, service updates, and account-related messages.
• To respond to your inquiries and provide customer support.
• To detect and prevent abuse, fraud, and security incidents.
• To comply with legal obligations and enforce our Terms.

We use AI models (currently Anthropic Claude) to generate qualification and reply suggestions. These models process the conversation content described above. We do not use your information, or your leads' information, to train generalized or public AI models. Our AI providers are bound by commercial terms that limit their use of this data to providing the service to us — Anthropic does not train its models on data sent under those terms.

When you submit our booking form, you consent to receive calls, texts, and emails about your discovery call from npy.agency. Message and data rates may apply. Frequency varies based on your engagement.

You can opt out at any time:

• SMS: reply STOP to any text. Reply HELP for help.
• Email: click the unsubscribe link in any non-transactional email.
• Calls: tell us during the call or email team@npy.agency.

We don't sell phone numbers, and we don't share phone numbers or SMS opt-in consent with third parties for marketing or any other purpose. SMS consent is used only to contact you about your discovery call.

We share data only with the following categories of service providers (subprocessors), all bound by contract to handle data consistently with this policy:

• GoHighLevel — CRM, calendar, SMS, and email delivery.
• Anthropic — AI models for qualification and reply generation.
• Supabase — encrypted database and authentication.
• Vercel — application hosting and analytics.
• Stripe — payment processing.
• Resend — transactional email delivery (legacy stack; in active transition).

We may also disclose information when required by law (subpoena, court order) or to protect our rights and the safety of our users.

We do not sell personal information.

We keep prospect information (discovery-call submissions) for the duration of our customer relationship plus 24 months after the last interaction, so we can follow up appropriately.

We keep customer account data while the subscription is active and for 12 months after cancellation, then delete or anonymize it unless we're required to retain it longer for legal, tax, or accounting purposes.

You can request earlier deletion at any time (see “Your rights” below).

Regardless of where you live, you can email team@npy.agency to:

• Access the personal information we have about you.
• Correct inaccuracies.
• Request deletion of your data.
• Export your data in a machine-readable format.
• Opt out of marketing communications.

If you're in California (CCPA/CPRA), the EU/UK (GDPR), or another jurisdiction with specific privacy rights, you have those rights in addition to the above. We don't sell personal information and we don't use it for cross-context behavioral advertising.

We use industry-standard security practices: HTTPS everywhere, encrypted storage for credentials and PII, row-level access controls in the database, and least-privilege access for staff (currently just the founder). No system is perfectly secure; if we ever experience a breach affecting your data, we'll notify you and applicable regulators consistent with the law.

The Service is not directed to children under 18, and we don't knowingly collect information from anyone under 18. If you believe a child has provided information to us, email team@npy.agency and we'll delete it.

We operate in the United States. If you use the Service from outside the US, you understand that your information will be processed in the US, where data protection laws may differ from those in your country.

We may update this policy from time to time. The “Effective” date at the top reflects the most recent change. For material changes, we'll notify you by email or in-app before they take effect.

Questions, requests, or complaints about privacy? Email team@npy.agency. We'll respond within 30 days.