Privacy Policy

1. Introduction

Phantom ("we," "us," or "our") provides an AI-powered email and communications platform designed for real estate professionals. This Privacy Policy explains how we collect, use, store, and share your information when you use our website, application, and related services (collectively, the "Service").

By creating an account or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Password (stored securely via Firebase Authentication; we never store plaintext passwords)
• Phone number (optional)
• Brokerage or company name (optional)

2.2 Gmail Data

If you choose to connect your Gmail account, we request access to your email through Google's OAuth 2.0 authorization flow. We request the following permissions (scopes):

• Read-only access to your Gmail messages (gmail.readonly) — to fetch your inbox and sent emails for analysis and inbox management features.
• Send email on your behalf (gmail.send) — to send emails you compose or approve through the Service.
• View your email address (userinfo.email) — to identify your connected Google account.

When connected, we access and process:

• Email message content (subject lines, body text, sender and recipient addresses, dates)
• Email metadata (message IDs, thread IDs, labels)
• Sent email history (up to the past year) for writing style analysis

We store your Gmail OAuth tokens (access token and refresh token) securely on our servers to maintain your connection. We do not store complete source-email bodies in pending responses. Source messages are processed for the requested feature, while reply-routing metadata, a bounded preview, generated drafts, and derived data such as writing style metrics may be persisted.

2.3 Writing Style Data

When you enable writing style analysis, we analyze your sent emails to extract patterns including:

• Formality, warmth, and brevity scores
• Preferred greetings and sign-offs
• Common phrases
• Average word count and sentence length

These aggregated metrics are stored in your account to personalize AI-generated communications. Individual email content is not retained after analysis.

2.4 Tax Intel Conversation Data

When you ask Tax Intel a question, we process and store your question and response under your account, organized by reporting year. Recent messages may be included with later questions for context, including mileage information you previously shared. Saved conversations, including historical tax-assistant conversations, remain associated with your account until you delete them or the account.

2.5 Contract Document Data

When you use Contract Intel, we store the contract files or contract photos you upload, document versions you create, links to your listings and business opportunities, and structured AI-generated insights such as dates, terms, risks, and action items. If you add a text or signature mark, we also store the resulting document version and basic revision metadata.

2.6 Mileage and Location Data

If you opt in to the Mileage Tracker beta in an eligible native build, Phantom may collect precise foreground and background device location, timestamps, reported accuracy, speed, motion classification, device-session identifiers, and synchronization status while tracking is enabled. Tracking is persistent until you pause it, stop it, revoke permission, sign out, or delete your account. Mobile operating systems may suspend capture after force-quit, permission downgrade, loss of connectivity, or battery-management events, and Phantom surfaces those gaps rather than representing the day as complete.

We also process addresses and coordinates for Linked Properties, saved work places, and manual route stops; suggested and confirmed trip classifications; business purpose; distance; route geometry; and review history. The web application does not perform background location tracking. It displays server-authoritative results captured on mobile and lets you enter or edit trips manually.

Location samples are first placed in owner-scoped encrypted device storage before authenticated upload. Raw server-side samples are deleted within 24 hours after successful processing and no later than seven days after receipt if processing continues to fail. Before locally queued samples expire after seven days, Phantom replaces them with an encrypted, coordinate-free marker containing the capture-session, device, time zone, affected time/date range, and optionally a sample count—but no coordinates, addresses, or sample identifiers. That marker is retained and retried until the server records the affected days as incomplete, then deleted from the device. Simplified trip geometry, capture-gap history, and the record fields you confirm or leave unreviewed are retained as mileage history until you delete them or your account.

2.7 Usage Data

We automatically collect standard usage information such as browser type, device information, pages visited, and interaction timestamps to improve the Service.

2.8 Subscription and Billing Data

When you select a paid plan, Stripe collects and processes your payment details. Phantom stores provider identifiers and status needed to operate your access, including your Stripe customer identifier, selected products, subscription and item status, paid-period dates, cancellation state, and limited invoice references. We do not store complete card numbers or card security codes.

For Contract Intel, we also store a billing-period usage ledger containing conservative cost reservations, settled token usage and cost, warning state, and opaque provider response identifiers. This data is used to enforce the AI allowance, prevent duplicate paid work, investigate ambiguous provider requests, and offer an informed limit increase.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Connect to your Gmail account and facilitate email reading and sending
• Analyze your writing style to personalize AI-generated emails and messages
• Classify incoming emails and generate suggested responses
• Answer Tax Intel questions using your financial summaries, tax estimates, and recent conversation; include an aggregate mileage summary only when you select that option for the question
• Store, organize, analyze, and prepare contract documents you choose to upload
• Resolve work addresses, reconstruct routes, detect likely work visits, calculate traveled distance, and prepare mileage records you can review and export
• Enrich communications with relevant real estate market data
• Provide customer support
• Comply with legal obligations

4. Third-Party Services and Data Sharing

We share your information with the following categories of third-party service providers, solely to operate and deliver the Service:

4.1 Google (Firebase & Gmail API)

We use Google Firebase for authentication and data storage, and the Gmail API to access your email. Your use of these features is also subject to Google's Privacy Policy. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4.2 Anthropic (AI Processing)

We use Anthropic's Claude AI to power email generation, classification, response suggestions, and Tax Intel answers. Depending on the feature you use, the following data may be sent to Anthropic for processing:

• Your writing style profile (aggregated metrics, not raw emails)
• Your name, email, and brokerage (for personalization)
• Email thread context relevant to the communication
• Incoming email content (for classification and reply generation)
• For Tax Intel questions, your question, minimized profit-and-loss aggregates, expense category totals, transaction counts, record-quality indicators, tax estimates, and recent messages from the applicable reporting year
• If you select Include mileage summary for a question, aggregate mileage totals, reporting periods, deduction-record exclusions, and applicable IRS mileage rates. Trip routes, coordinates, and locations are not automatically attached to this summary. Questions and previous messages may contain information you chose to share.
• Contract files or contract photos you explicitly submit to Contract Intel, plus limited linked-transaction context needed to identify relevant terms or inconsistencies

Anthropic processes this data according to their Privacy Policy. Data sent to Anthropic's API is not used to train their models.

4.3 Resend (Email Delivery)

We use Resend as a transactional email service for certain system communications. Recipient email addresses and message content are shared with Resend for delivery purposes.

4.4 Stripe (Subscription Billing)

We use Stripe to create customers, host Checkout, process recurring subscription payments, issue subscription invoices, and provide billing management. Stripe receives the account and transaction information needed to perform those services and processes it under Stripe's Privacy Policy.

4.5 Mapbox (Address and Route Processing)

We use Mapbox to permanently resolve addresses you submit, calculate routes between ordered stops, and match eligible mobile traces to the road network. Mapbox receives the address or coordinate data needed for that operation and processes it under its Privacy Policy. Phantom uses separate restricted map-display credentials and server-only processing credentials and does not include Mapbox tokens in operational logs.

4.6 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

5. Google API Services — Limited Use Disclosure

Phantom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use access to Gmail data to provide and improve user-facing features of the Service.
• We do not use Gmail data for advertising or to serve ads.
• We do not allow humans to read your email content unless you have given affirmative consent for specific messages, it is required for security purposes, or it is required by law.
• We do not transfer Gmail data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent.

6. Data Storage and Security

Your account data is stored using Google Cloud Firestore and private contract files are stored using Google Cloud Storage, which provide encryption at rest and in transit. We implement industry-standard security measures including:

• Secure, HTTP-only session cookies for authentication
• Server-side storage of OAuth tokens (never exposed to the client)
• HTTPS encryption for all data in transit
• Firebase Security Rules to restrict data access

While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your data as follows:

• Account data: Retained while your account is active. Account access closes immediately after a verified deletion request, and Phantom targets deletion of live account data within 24 hours.
• Deletion audit records: Minimal job and receipt records used to verify or repair deletion may be retained for up to 180 days. These records do not contain your product content.
• Gmail tokens: Stored while your Gmail account is connected. Tokens are revoked and deleted when you disconnect your Gmail account.
• Writing style data: Retained while your account is active, even if you disconnect Gmail, so your personalization preferences are preserved.
• Historical assistant conversations: Retired assistant history is retained while your account is active so you can access or delete the saved account record.
• Contract documents and versions: Retained while your account is active or until you remove them, subject to backup, security, and legal retention requirements.
• Raw mileage location samples: Deleted within 24 hours after successful processing and within seven days even when provider or processing failures continue.
• Mileage retention-gap markers: Encrypted coordinate-free markers for locally expired samples are retained on the device until the server acknowledges the corresponding incomplete-day records. They are fenced to the same account across sign-out and are deleted during account deletion.
• Processed mileage history: Simplified geometry, stop snapshots, distances, classifications, purposes, review state, and export metadata are retained while your account is active or until you delete the applicable records. Later Listing or saved-place edits do not rewrite historical snapshots.
• Subscription and AI-allowance records: Phantom's owner-scoped entitlement, period, command, and Contract Intel usage records are retained while your account is active and removed through the account-deletion workflow. Stripe may retain payment, invoice, dispute, tax, and compliance records under its own legal obligations and retention policy.
• Pending responses and drafts: Generated drafts, source-message routing metadata, classifications, send records, and bounded source previews are retained for no more than 90 days from creation. Complete source-email bodies are not copied into pending-response records, and account deletion removes these records as part of the deletion process.

8. Your Rights and Choices

You have the following rights regarding your data:

• Disconnect Gmail: You can disconnect your Gmail account at any time from your account settings. This revokes our access and deletes stored tokens.
• Revoke Google access: You can revoke Phantom's access to your Google account at any time via your Google Account permissions.
• Delete your account: You may start account deletion from Settings. If the automated workflow requires support, you may also contact us.
• Access and portability: You may request a copy of your personal data by contacting us.
• Correction: You can update your profile information at any time through your account settings.
• Location controls: You may decline the initial request, pause or stop tracking in Phantom, or revoke precise/background permission in device settings. Manual mileage entry remains available without location permission.

If you are located in the European Economic Area (EEA), you may also have the right to lodge a complaint with your local data protection authority.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Effective Date" at the top of this page. If we make material changes, we will notify you by email or through the Service. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Phantom
Email: privacy@sharetech.dev