Privacy Policy

We collect the information you give us when you create an account and use the Service, including:

• Account and profile details — your name, email address, phone number, brokerage, license number, headshot, and password credentials.
• Content you upload — listings, photos, videos and other media in your library, and the videos, captions, websites and blog posts you create.
• Contacts and leads — the people you import or who reach you through your forms, including their names, email addresses, phone numbers, messages and the notes you keep on them.
• Communications you configure — the email templates, auto-replies, welcomes and drip sequences you set up to send to your contacts.
• Billing information — processed by our payment processor. We receive limited details such as the last four digits and card brand; we do not store full card numbers.
• Support requests and correspondence you send us.

The Service works by connecting to platforms you authorize. When you connect an account, we collect and store what is needed to act on your behalf:

• MLS / IDX — listing data (photos, price, beds, baths and related fields) synced over the RESO Web API, and the credentials or tokens you provide to access it.
• Social platforms (Meta / Instagram / Facebook, Google / YouTube, TikTok) — access tokens, basic account identifiers, and the posts and performance metrics associated with content you publish.
• Advertising — your connected Meta ad account identifier and the reach, spend and cost metrics of boosts you launch. Boosts run on your own ad account; the platform bills you directly.
• Property-link lookups — when you paste a listing link, we query a third-party data provider to retrieve public listing details.

As you use the Service, we automatically collect usage and log data — pages viewed, features used, actions taken, approximate location derived from IP address, and device and browser information. We use strictly necessary cookies to keep you signed in and to secure the Service.

We use information to operate, secure and improve the Service, specifically to:

• Provide the studio — render videos, generate scripts, captions and blog drafts, build your website, sync your listings, organize your leads and report on performance.
• Publish and boost content to the platforms you connect, at your direction.
• Send the emails you configure to the contacts you designate, and send you service and account notifications.
• Process payments, manage subscriptions and prevent fraud.
• Provide support, understand how the Service is used, and develop new features.
• Comply with law and enforce our Terms of Service.

To generate videos, scripts, captions, blog drafts and assistant replies, we send the relevant content you provide to third-party AI providers (currently Anthropic and Google). These providers process your content to return a result under business terms that restrict use of your content to providing the service. We do not sell your content, and AI output is generated for you to review before you publish it.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising. We share information only as follows:

• Service providers (subprocessors) who host and power the Service. These currently include Supabase (database, authentication and file storage), Vercel (application hosting, United States), Stripe (payments), Resend (email delivery), Anthropic and Google (AI), and a RapidAPI data provider (property lookups). This list may change as our vendors evolve.
• Connected platforms — Meta, Google/YouTube and TikTok — when you direct us to publish, boost or sync content.
• Legal and safety — when required by law, subpoena or to protect the rights, safety and property of Themis, our users or others.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy.
• With your consent, or at your direction.

We use only strictly necessary cookies — primarily to maintain your authenticated session and to protect against security threats. We do not use third-party advertising or cross-site tracking cookies. Because these cookies are essential to signing in, disabling them may prevent the Service from working.

We keep personal information for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward to comply with legal obligations, resolve disputes and enforce our agreements. You can delete content and contacts at any time, and you can delete your account from Settings; deletion requests are honored as described below, subject to backups that expire on a rolling basis.

We use administrative, technical and organizational safeguards designed to protect your information, including encryption in transit, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password confidential and notify us of any suspected unauthorized access.

Colorado residents have rights under the Colorado Privacy Act, and residents of other U.S. states may have similar rights under their own laws. Subject to those laws, you may:

• Access and confirm whether we process your personal data, and obtain a portable copy.
• Correct inaccuracies in your personal data.
• Delete your personal data.
• Opt out of the sale of personal data, targeted advertising, and certain profiling — note that we do not engage in these activities.

To exercise these rights, email us at contact@themisre.com. We will verify your request and respond within the time required by law. You may use an authorized agent. If we decline your request, you may appeal by replying to our decision; if you have concerns about our appeal response, you may contact the Colorado Attorney General.

If you submitted an inquiry to a real estate professional who uses Themis, that professional is the controller of your information. We process it on their behalf — please direct access and deletion requests to them, and we will assist them in responding.

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

The Service is operated in the United States and our infrastructure is hosted in the United States. If you access the Service from outside the United States, you understand that your information will be processed here, where data protection laws may differ from those in your location.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the Service or by email. Your continued use of the Service after an update means you accept the revised Policy.