1. Scope and roles

This Privacy Policy applies to CRE Brain, the service operated by Pacific Software Ventures (“PSV,” “we,” “us,” or “our”) that gives a firm a brain and AI agents, including its website, dashboard, remote connector, and related support.

CRE Brain is a business service provided to invited organizations. The organization that gives you access generally decides what business content belongs in its CRE Brain workspace and who receives a seat. For that workspace content, PSV acts on the organization’s instructions. If an order form, data-processing agreement, or other written agreement conflicts with this policy, that agreement controls for the affected organization.

2. Information we process

Account and membership information

Your name, verified work email address, organization membership, and invitation status. We use them to sign you in and place you in your organization’s workspace.

Documents in connected file sources

A firm can connect the place it keeps its files, such as Microsoft 365 or Dropbox (work or team accounts only). For Microsoft 365 we keep the list of files, where they are, and who can open them, along with the names and email addresses of the firm’s people and groups. For Dropbox we keep nothing from the files. A file is read from where your firm keeps it when someone who can open it asks about it, and each person sees only what they can already open there.

When someone in your firm reads a document through CRE Brain, we keep a redacted copy of its text so later reads are fast. It is deleted 30 days after it was last read, replaced when the file changes, and shown only to people your SharePoint or Google Drive still lets open the file. The one exception is PSV staff while your firm allows build access, described under Who can see what.

CRE Brain saves only new files. It never changes, replaces, moves, or deletes a file your firm already has, and it tells you what it saved. Our agents save their work into folders set up with your firm, such as an invoice or a register filed where your firm keeps them. A workbook CRE Brain updated for you is saved only after a person at your firm approves it, as a new file next to the one it came from. We keep our own copy of each file we save, and delete it 30 days after the file is saved.

A file attached to a chat is deleted after seven days.

Email

When a firm turns on Outlook, each person connects their own mailbox. We do not store your messages or attachments. We keep the connection you authorized, and a record of which mailbox was read, without its contents. CRE Brain never sends, moves, or deletes mail.

Financial books

A workspace administrator can connect the firm’s accounting system, currently QuickBooks Online. We keep a copy of what we read from it: the chart of accounts, vendor and customer lists, company details, and general ledger entries, and of the bills it proposes, with their invoices. CRE Brain enters a bill there only for a company your firm has switched on, and only after an owner at your firm approves it. It never pays, changes or deletes anything there.

Property management reports

A firm’s property management reports can reach CRE Brain by upload to a secure upload folder, or sent from the firm’s own system. A workspace administrator can give the firm’s property manager a one-time setup link for the upload folder. We keep the properties, units, and leases the reports contain, such as names, addresses, unit details, resident names, lease dates, and rent. We do not connect to the firm’s property management system.

Market data

A firm can connect a market-data subscription, such as NIC MAP or Trepp, with its own account. We send a person’s question to the provider and show the result in that person’s chat. We do not copy the provider’s data into the workspace.

Conversations and memory

We keep the questions people ask in chat, the answers, and the steps the assistant took. We also keep the rules people ask CRE Brain to remember about how the firm works, and the answers people save while completing a workflow, each with who gave it and when.

Usage and diagnostic information

We keep limited operational records needed to run and protect the service, such as which feature was used, whether it worked, how long it took, and feedback a person chooses to give. Our systems also receive technical request information such as IP address, browser or client type, timestamps, and security logs. We keep request logs and diagnostics for a limited period. To find and fix mistakes, we may keep a record of a request to an AI model and its response for a limited period.

Website inquiries and cookies

If you request access on our website, we keep the email address and firm name you give us so we can reply. We use only essential cookies and similar storage for sign-in and session continuity. CRE Brain does not use advertising cookies.

3. How we use information

We use information to:

sign in invited users and control who can see what;
answer questions and complete work for the people who ask;
return relevant private context when an authorized user invokes CRE Brain in an AI assistant;
keep the rules and saved answers a firm asks us to keep;
secure, troubleshoot, maintain, and improve the reliability of the service; and
comply with law and enforce our agreements.

No sale and no model training. We do not sell personal information or firm content, and we do not use a customer’s CRE Brain content to train AI models. Our AI model providers do not use it to train their models either.

5. Who can see what

CRE Brain is invitation-only. Signing in does not create a seat, and a workspace’s information is available only to the people in it.

Each person sees only what they could already open where the firm keeps it. Workspace administrators get no access to documents they could not already open. Email works the same way: a person sees only the mailboxes they can open themselves.

Financial books, property management reports, and market data belong to the firm, so everyone in the workspace can read them. Connecting and disconnecting them stays with workspace administrators. The rules the firm asks CRE Brain to keep are visible to everyone in the workspace. Established company guidance can be reused in relevant work only by people with current access to the records behind it. Sharing guidance does not share its source documents or the chat it came from. Historical private records retain their existing access protections.

To provide support, PSV staff can help administer a workspace. While support access is on, they can see the firm’s financial books and property management reports. They cannot read its email or chats. Support access is on until the firm turns it off. A workspace owner can turn it off at any time and can see what support did.

PSV staff read a firm’s documents only with the same access a member would need, except under build access. While we set up your workspace, your firm’s owner can let PSV staff read your firm’s documents until a date the owner chooses, up to 90 days. Before your firm has an owner of its own, we can turn this on ourselves for up to 90 days. After that, only the owner can turn it on or extend it. Every document PSV staff open this way is recorded, and the owner can end it at any time. Build access does not reach email, other people’s chats, or files outside the sources your firm connected.

6. Retention and deletion

Unless an organization’s written agreement, a legal hold, or applicable law requires a different period, our standard retention schedule is:

Workspace content: Kept while the organization’s workspace is active. After a verified workspace deletion request, active records are deleted within 30 days. Residual encrypted backup copies age out on the infrastructure provider’s backup cycle and are not restored to active service except for disaster recovery.
Financial books and property management reports: Kept while the workspace is active and deleted with the rest of its data on the same 30-day schedule. Turning a connection off stops all further reading, and what was already read stays on file so the firm can reconnect without losing its history. Only the latest report for each property is kept.
Document text: The redacted text of a document someone read is deleted 30 days after it was last read, replaced when the file changes, and deleted with the file’s record when the source is removed.
Uploaded report files: Deleted once they have been read. A file we could not read because of a problem on our side may be kept for up to 14 days so it can be read again once we fix the problem. A short record of each report’s outcome, without the report, is kept for 90 days.
Email connections: A person’s Outlook connection is kept until they disconnect it, an administrator turns Outlook off, or Microsoft stops accepting it, and is then deleted. A record of which mailbox was read, without its contents, is kept no longer than the chat or work it belongs to.
Chats: Kept until the person who started the chat deletes it, which removes it at once. Otherwise they are deleted with the rest of the workspace’s data after a verified workspace deletion request. Files attached to a chat are deleted after seven days.
Activity records and usage totals: Records of who changed what in a workspace, and usage totals, are kept for up to 14 months.
Request logs and diagnostics: Kept for a limited period.
Account and membership data: A person’s membership ends when their access is removed. Their name may stay on work they did in the shared workspace, as its author, until the workspace is deleted. Invitations expire after 30 days.
Website inquiries: Kept until you ask us to delete them.

We may retain the minimum information required to establish, exercise, or defend legal claims, comply with law, investigate abuse, or enforce an agreement for the period that purpose requires. The organization’s written agreement may set shorter or longer periods.

Correct an answer: a person can tell the assistant an answer is wrong, and it records that verdict against the answer.
Change or remove a rule: anyone in the workspace can change or remove a rule the firm’s memory keeps, under Settings, then Firm memory. A removed rule stops shaping answers for the whole workspace.
End access: removing a seat ends that person’s access. Work they did for the shared organization remains part of its history unless the organization directs otherwise.

An organization administrator can contact us to request workspace-level access, correction, export, or deletion assistance.

7. Security

We use administrative, technical, and organizational safeguards designed for private business information. These include encryption of information in transit and at rest, invitation-only access, keeping each workspace’s information separate from every other workspace’s, access controls, and logging.

No service can guarantee absolute security. If you believe a credential or workspace may have been exposed, do not send the credential to us. Contact support promptly so it can be revoked and investigated.

8. Choices and rights

Depending on your location, you may have rights concerning personal information, such as rights to access, correct, delete, or receive a copy of it. Because CRE Brain is provided through your organization, your organization may need to handle or authorize requests about workspace content. We will assist it as required by applicable law and contract.

To make a privacy request, email paul@pacificsoftwareventures.com. We may need to verify your identity and relationship to the organization before acting. CRE Brain is a business service and is not directed to children.

9. Changes and contact

We may update this policy as CRE Brain or applicable requirements change. The effective date above identifies the current version. If a change materially affects how existing workspace information is handled, we will provide notice through the service or the organization’s designated contact when appropriate.

Questions about privacy or data handling can go directly to Pacific Software Ventures.

Email privacy support

What CRE Brain reads, what it keeps, and who can see it.