ShowSmartly.ai is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services.
Our Products
ShowSmartly provides four integrated products on a single platform: (1) automated showing-reply email automation, (2) multi-offer AI analysis, (3) team KPI benchmarking and forecasting, and (4) DISC profile analysis. The data we collect and how we use it depends on which features you enable.
Information We Collect
- Email address, name, and other contact details provided during signup or contact form submission.
- OAuth credentials and access tokens for Gmail and Microsoft Outlook when you enable email automation features. These are stored encrypted at rest.
- Email metadata from showing confirmation messages (sender, subject, date/time) that we monitor and process.
- Extracted showing details: property address, showing date/time, buyer agent name and contact information.
- Real estate property information including addresses, MLS numbers, and commission details you provide.
- Agent directory data you provide for our automation services.
- Offer documents (PDFs and related files) you upload for multi-offer AI analysis, including extracted price, terms, contingencies, and buyer/agent information.
- Team performance data synced from Follow Up Boss when you connect that integration: deals, pipeline stages, appointments, calls, texts, notes, and agent assignments used to compute KPIs and forecasts.
- DISC assessment data: responses, generated profile results, and any prospect/buyer/team-member contact information you associate with a DISC profile.
- Usage data for site analytics and product improvement.
Gmail and Outlook API Usage
When you connect your Gmail or Microsoft Outlook account, ShowSmartly accesses your email only for the following specific purposes:
- Find showing confirmation emails: We search for emails with subject lines containing "SHOWING CONFIRMED" to identify showing appointments.
- Extract showing details: We use AI to extract the property address, showing date/time, and buyer agent contact information from confirmation emails.
- Send commission disclosure emails: We send automated replies containing your commission information to listing agents.
- Send commission request emails: When commission information is not on file, we send requests to listing agents on your behalf.
We do NOT:
- Read, access, or process any emails other than showing confirmation messages.
- Store full email bodies long-term — we extract and retain only showing metadata and commission values.
- Sell, rent, or trade your email content or personal data to any third party.
- Use your email content for advertising, marketing, or profiling purposes.
- Share your Gmail or Outlook data with third parties except the processors necessary to provide the service (listed below).
How We Use Your Information
- To provide and maintain our showing automation services.
- To monitor your email inbox for showing confirmation messages when you enable email automation.
- To process email content using AI technology to extract relevant showing and commission information.
- To automatically generate and send personalized commission disclosure responses to listing agents on your behalf.
- To analyze, parse, and rank uploaded offer documents and produce seller-ready multi-offer summaries.
- To compute team KPIs, conversion funnels, and seasonality-aware forecasts from Follow Up Boss activity and deal data.
- To generate DISC personality profiles and related communication recommendations for prospects, buyers, and team members.
- To query third-party APIs (Follow Up Boss) for deals, pipeline activity, appointments, calls, texts, notes, and commission/listing data when you enable that integration.
- To communicate with you about your account, service updates, or support inquiries.
- To improve and personalize our offerings based on usage patterns.
Data Retention
- Showing metadata: Property address, showing date/time, agent contact information, and commission values are retained while your account is active.
- Email logs: We log showing email processing events (message IDs, timestamps, status) for troubleshooting and audit purposes.
- Full email content: We do NOT store full email bodies. Content is processed in memory, relevant data is extracted, and the original email content is discarded.
- Offer documents: Uploaded offer files and the extracted structured data are retained while the related property is active. You can delete uploaded offers at any time.
- Team KPI & FUB data: Synced deal, pipeline, and activity data is retained while your Follow Up Boss connection is active and used to compute historical trends and forecasts.
- DISC profiles: Assessment responses and generated profile results are retained while your account is active and can be deleted per profile.
- OAuth tokens: Encrypted access and refresh tokens are stored only while your email connection is active.
- Account data: Your profile, settings, and property information are retained until you request deletion.
Data Security
- Encryption at rest: OAuth tokens, API keys, and sensitive credentials are encrypted using PostgreSQL encryption functions before storage.
- Encryption in transit: All data transmission uses TLS/HTTPS encryption.
- Row-Level Security (RLS): Database policies ensure users can only access their own data.
- Role-Based Access Control: Admin functions are protected by role verification using security definer functions.
- Webhook verification: Inbound webhooks are secured using HMAC-SHA256 signature verification with timestamp freshness checks.
- XSS Prevention: All user-generated content is sanitized using DOMPurify before rendering.
Signature Images and Logos
- Storage: Images are stored in a publicly accessible storage bucket so email clients (Gmail, Outlook, etc.) can display them to recipients.
- URL Obscurity: Files are stored with unique paths containing your user ID and timestamps.
- Access Control: Only you can upload, update, or delete files in your folder.
- Recommendation: Only upload professional logos and signatures — do not include sensitive personal information in signature images.
Third-Party Processors
- OpenAI / Lovable AI Gateway: AI processing for email content extraction, multi-offer analysis, DISC profile generation, and team KPI insights. Content is processed via API and not retained for training.
- Google (Gmail API) and Microsoft (Graph API): Email access, authentication, and sending automated replies.
- Supabase: Encrypted data storage, user authentication, and edge function hosting.
- Resend / Mailgun: Transactional email delivery and inbound webhook processing.
- Follow Up Boss: Optional integration syncing deals, pipeline stages, appointments, calls, texts, notes, and commission/listing data for KPI benchmarking and team analytics.
- Stripe: Subscription billing and payment processing.
Your Rights and Choices
- Disconnect email: Disconnect Gmail or Outlook at any time through Settings. This immediately revokes our access and deletes stored OAuth tokens.
- Disable monitoring: Pause email automation at any time without disconnecting your account.
- Access your data: Request a copy of all data we hold about you by contacting us.
- Delete your account: Permanently delete your account and all associated data from your Profile settings (Profile → Danger Zone).
- Revoke OAuth access: Revoke ShowSmartly's access directly through your Google or Microsoft account security settings.
Email Automation Consent
By enabling email automation features and connecting your Gmail or Outlook account, you consent to our monitoring of your email inbox for showing confirmation messages and the automated processing of this content as described above.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last updated" date.
Contact
If you have any questions or wish to exercise your data rights, please contact support@showsmartly.ai.