Privacy Policy

GeoGenius (“GeoGenius,” “we,” “our”) helps real estate agents become discoverable to AI search engines. This Privacy Policy explains what we collect, why we collect it, who we share it with, and the choices you have. We try to keep it plain-English. Email legal@geogenius.ai with any questions.

1. What we collect

We collect the information you give us and a limited amount we generate or observe while you use the platform:

• Account information: name and email address when you sign in with Google or Apple. We store the OAuth identifier so we can recognize you on future visits.
• Agent profile data: full name, brokerage, real estate license number and state, areas served, specialties, years of experience, total transaction volume, transaction count, photograph, and biography. This is entered by you during intake, extracted from your website when you run an audit, or — during our beta — assembled by our staff on your behalf from a website URL you or your brokerage provides. Profiles built before you sign in stay unclaimed until you verify and claim them, and staff-created or staff-edited records are attributed and logged internally.
• Knowledge pins: short text notes you contribute about specific locations, including the location coordinates and any tags you provide.
• Voice notes: if you use voice capture to create a pin, we record your audio in the browser, send it to xAI’s speech-to-text service for transcription, and keep the raw transcript alongside the cleaned-up pin text so you can always see what you actually said. Record voice notes in a setting where you won’t capture other people’s conversations.
• Transaction history: when you upload a CSV of closed transactions we store the addresses, prices, dates, and any role/category fields you provide. This data is used to power your verified track record on your public profile.
• Testimonials: client testimonials submitted via the review link we generate for you, including the client’s name and (optionally) a star rating.
• Third-party integrations: when you connect Google Business Profile or Foursquare, we receive OAuth tokens scoped to managing those listings on your behalf. We store them encrypted and use them only to read and update the listings you authorize. We do not access your personal email or calendar.
• SMS phone numbers: when you use our review-request feature, the recipient phone number is passed to Twilio to deliver the SMS. We retain the number for tracking the request status.
• AI engine probe results: we record the responses ChatGPT, Grok, Claude, and Google AI return when asked about you. These are stored on your agent record so the dashboard can display trends.
• Usage analytics: page views, clicks, performance metrics, and feature use via Google Analytics 4 (GA4) and PostHog. See “Cookies and analytics” below.
• Technical data: IP address, browser type, device type, and approximate location (city/country) inferred from IP. We use this for security, abuse prevention, and aggregate analytics.

2. How we use your data

• To build, host, and update your public agent profile (which is — by design — publicly accessible at geogenius.ai/agents/<your-slug>).
• To generate JSON-LD structured data that AI engines crawl from your profile.
• To ask ChatGPT, Grok, Claude, and Google AI about you and surface the responses in your dashboard.
• To sync information you authorize to Google Business Profile and Foursquare listings.
• To send SMS testimonial requests via Twilio when you initiate them.
• To generate pages from your contributions — for example, neighborhood guide pages written from your knowledge pins and sold-market pages built from your transaction history.
• To build aggregated insights across agents, such as market cohort score distributions. These combine data across accounts; individual comparisons are never published.
• To operate, secure, debug, and improve the platform.
• To email you. Three kinds: operational messages (welcome, your visibility report, account, security, billing) which every account gets; a weekly digest of your profile’s activity, sent only on paid or comped plans; and product and blog updates, which your account is enrolled in when it’s created and which you can leave any time with one click — every such email carries an unsubscribe link, and there’s a preference toggle in your account settings.

3. What is public vs. private

Your agent profile is public on purpose. The entire product is built around making you discoverable to humans and AI engines. Knowledge pins, transaction summaries (address, price, date), and testimonials you publish to your profile are public.

Your account email, OAuth tokens, raw uploaded CSVs, draft testimonials, and dashboard analytics are private to you. We don’t expose them to other users or list them in the agent directory.

Profiles built from public information. Part of what GeoGenius does is measure who AI engines already recommend — which means we maintain records about real estate professionals who haven’t signed up, assembled from public sources: AI engine answers, public business listings (Google, Foursquare), and the professional websites those listings point to. Some of these appear as unclaimed profiles or in our recruiting-research views, and may include name, brokerage, publicly listed contact details, photo, and bio. Two commitments: we do not submit unclaimed profiles to search-engine sitemaps (we don’t invite indexing of a page about someone who hasn’t opted in), and anyone — account or not — can email legal@geogenius.ai to correct or remove a record about themselves. We honor those requests.

Testimonials. If an agent sends you a review link and you submit a testimonial, your first name (as you enter it) and your words will be published on that agent’s public profile. Email us at legal@geogenius.ai if you’d like a testimonial you submitted corrected or removed.

4. Who we share data with

We do not sell your personal information. We share data only with the service providers needed to run the platform:

• Google Cloud / Firebase — hosting, database (Firestore), serverless functions, file storage, authentication. US-based.
• Google Analytics 4 — web analytics, governed by Google’s Consent Mode v2.
• PostHog — product analytics and session telemetry.
• OpenAI, Anthropic, xAI, Google AI — we send agent profile context to these AI engines when probing for visibility scores. xAI additionally transcribes voice notes you record.
• Firecrawl — the crawling service we use to read websites during audits (the URL you submit, plus the public sites of professionals we profile from public sources).
• SendGrid — delivers our email (welcome, reports, digests, blog updates, billing notices).
• Google Maps review display — we save the listing identifier you confirm. When you or a visitor asks to see reviews, we request current excerpts from Google Places. We do not save those excerpts in your profile. Google content and linked pages are covered by the Google Privacy Policy.
• Google Business Profile, Google Places, and Foursquare — public business-listing lookups, plus — for listings you connect — only data you authorize us to write.
• Twilio — SMS delivery for testimonial requests you initiate.
• Stripe — payment processing for paid plans; card details go directly to Stripe and we never see or store full card numbers.

We may disclose information when required by law, to respond to valid legal process, or to protect our users, our service, or the public from fraud, abuse, or imminent harm.

5. Cookies and analytics

We use a small number of first- and third-party cookies for authentication, security, and analytics. On your first visit you’ll see a banner letting you accept or decline analytics cookies (we use Google’s Consent Mode v2 to honor your choice across GA4 and our other analytics). Essential cookies needed for sign-in and session continuity are always set.

You can clear cookies from your browser at any time and re-set your consent from the banner’s controls.

6. Data retention

We retain profile and account data for as long as your account is active. When your account ends — you close it, or we terminate it — two different things happen, and we want to be straightforward about the difference:

• Removed: your public profile and every generated page go offline within 7 days, and your sign-in credentials, billing records, and mailing-list enrollment are deleted.
• Retained by default: the content contributed to the account — profile facts, knowledge pins, transaction history, generated guides, and audit reports — is kept internally. It is no longer publicly visible anywhere, but it continues to inform the platform (for example, aggregated market insights).

You can override the default. If you ask us to delete your personal data — when closing your account or any time after — we delete it from primary systems within 30 days of verifying the request, not just hide it. Backups and incident logs may retain data for up to 90 days before they roll off. Aggregated, anonymized analytics that no longer identify you may be retained indefinitely. Our internal audit log of staff actions is append-only and retained for accountability.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information; to object to processing; or to withdraw consent. You can:

• Edit most profile information directly from your dashboard.
• Email legal@geogenius.ai to request export or deletion.
• Revoke Google Business or Foursquare access at any time from those providers’ security settings.
• Adjust analytics consent from the in-app banner.

We respond to verifiable requests within 30 days. To verify a request we match it to the email on the account, or — for people without an account (for example, the subject of an unclaimed profile or a submitted testimonial) — to reasonable evidence that you are the person the record describes. An authorized agent may submit a request on your behalf with proof of authorization. We will never treat you differently for exercising these rights.

California residents: the rights above are the rights the CCPA/CPRA gives you — to know what we collect (this policy is that notice; the categories and purposes are in Sections 1–4, and retention in Section 6), to access it, to correct it, and to delete it. We do not sell your personal information, and we do not share it for cross-context behavioral advertising; our analytics run only with your consent from the cookie banner. These rights apply whether or not you have an account — including to profiles we’ve built from public information.

8. Security

We use industry-standard security: TLS in transit, encryption at rest for sensitive fields, scoped OAuth tokens, principle-of-least-privilege access controls, and regular review of our Firestore security rules. No system is perfectly secure; we’ll notify affected users without undue delay if we ever experience a breach involving personal data.

Staff access. A small number of staff operators can access account data to onboard users and provide support, including a time-limited “view as user” mode for troubleshooting. Every staff action — edits, entitlement changes, report views, impersonation sessions — is recorded in an append-only internal audit log that staff cannot alter or delete.

9. International users

GeoGenius is operated in the United States. If you access it from outside the US, your data will be transferred to and processed in the US, where data-protection laws may differ from those in your jurisdiction.

10. Children

GeoGenius is intended for licensed real estate professionals, who are adults. We do not knowingly collect personal information from anyone under 18.

11. Changes to this policy

We’ll update the “Last updated” date at the top of this page if we make material changes. If the change affects how we use your existing data, we’ll notify active account holders by email or in-app banner before the change takes effect.

12. Contact

Questions, complaints, or data requests: legal@geogenius.ai.