Privacy Policy

1. Who this policy is for

Homebound has two groups of people whose information it handles, and they have different relationships to it:

• Agents — the people who sign in and use Homebound. Access is restricted to an administrator-approved allowlist; there is no public sign-up.
• Leads and contacts — the prospective buyers and sellers whose information an agent brings into Homebound from their own CRM. Leads are not users of Homebound and do not sign in. Their information is handled on behalf of the agent and the brokerage that has the underlying relationship with them.

If you are a lead and want to know what is held about you, or want it corrected or deleted, contact the agent or brokerage you have been working with. They control that data and can action the request. See §8.

2. Information collected

From an agent's Google account, at sign-in: name, email address, and Google account identifier. Used to authenticate the agent and check them against the access allowlist.

From Follow Up Boss, the CRM Homebound syncs from, using credentials the agent supplies: lead names, email addresses, phone numbers, postal addresses, lead source and stage, tags, assigned agent, CRM notes, message history, and property-viewing activity. Homebound's access to Follow Up Boss is read-only; it does not write back.

Entered by the agent: notes about a lead, buyer criteria (budget, bedrooms, location, must-haves), listings, and any MLS listing sheets uploaded as PDFs.

Generated by Homebound: lead priority scores and the reasoning behind them, summaries of what a lead appears to be looking for, draft outreach messages, and lead-to-listing match results.

From a connected Gmail account, only if an agent chooses to connect one: see §4, which covers Google user data specifically.

3. How information is used

• Authenticating agents and enforcing the access allowlist.
• Ranking and summarizing leads so an agent can see who to contact next, and explaining why a lead was ranked where it was.
• Matching leads to listings based on stated and observed preferences.
• Drafting outreach messages for an agent to review, edit, and send.
• Sending those messages, and reading replies to them, when Gmail is connected.

Homebound does not sell personal information, does not share it for cross-context behavioral advertising, and does not use lead data to build profiles for anyone other than the agent who brought that lead in.

4. Google user data

Connecting Gmail is optional. An agent who connects one grants Homebound two Google OAuth scopes:

• gmail.send — to send outreach messages the agent has reviewed, from the agent's own address. This scope cannot read the mailbox.
• gmail.readonly — to detect replies to those messages, so a lead who responds can be surfaced to the agent and the reply recorded against that lead.

Limited Use.Homebound's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, data obtained through these scopes is used only to provide the features described above; it is not transferred to others except as necessary to provide those features, for security purposes, or to comply with applicable law; it is not used for advertising; and it is not used to train generalized artificial intelligence or machine learning models.

What is read and retained. Reply detection looks only at messages that are replies to outreach Homebound sent. The sender, timestamp, subject, and body of such a reply are stored against the corresponding lead so the agent has the conversation in one place. Homebound does not index, scan, or retain the rest of the mailbox.

Google data and AI features. Where an agent asks Homebound to draft a reply, the relevant message text is sent to OpenAI to produce that draft (see §5). OpenAI is contractually prohibited from training on data submitted through its API. No Google user data is used to train any model, by Homebound or by any provider it uses.

Revoking access.An agent can disconnect Gmail from Homebound's Settings page, or revoke it directly at Google Account permissions. Revoking stops all further access immediately and deletes the stored OAuth tokens.

5. Service providers

Homebound relies on the following third parties. Each receives only what its function requires.

• Follow Up Boss — the CRM lead data is read from.
• OpenAI — lead scoring and summaries, lead-to-listing matching, drafting outreach, and extracting fields from uploaded MLS PDFs. Receives lead details and notes relevant to the task. Used via the OpenAI API, which does not train on submitted data.
• Clay— optional enrichment of a lead's professional background. Receives a lead's email address or name.
• Google — sign-in, and Gmail send/read when connected (§4).
• Mapbox — converts a listing address into coordinates and renders listing maps. Receives listing addresses, not lead information.
• ShadeMap — renders sun and shade simulation on a listing map, in the browser. Receives listing coordinates, not lead information.
• Property data providers — used to look up comparable properties. Receive search criteria such as city, price range, and bedroom count, not lead identities.
• Prospecting providers — used only when an agent explicitly runs a prospect search. Receive the search criteria for that request.
• Render (application and database hosting) and Netlify (web hosting) — host the service and store its data.

6. Storage, security, and retention

Data is stored in a managed PostgreSQL database hosted by Render in the United States, and transmitted over TLS. Gmail OAuth tokens are encrypted at rest with a key held separately from the database. Access requires an allowlisted Google account, and administrative functions are restricted further by role.

Lead records are retained while the agent using Homebound continues to work that lead, and are deleted on request (§8). Gmail OAuth tokens are deleted as soon as Gmail is disconnected or access is revoked. No security measure is perfect, and Homebound cannot guarantee absolute security.

7. Automated decision-making

Homebound scores and ranks leads automatically and drafts messages automatically. These outputs are advisory: they order a work list and pre-fill text for an agent, who decides what to act on and reviews every message before it is sent. Nothing in Homebound determines whether anyone can buy, sell, rent, or finance a property, and scores are never disclosed to leads.

Scoring uses stated buyer criteria, engagement history, and CRM activity. It does not use race, color, religion, sex, familial status, national origin, disability, or any other protected characteristic, and must not be configured to.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of the personal information held about you, to opt out of its sale or sharing (Homebound does neither), and not to be discriminated against for exercising these rights. California residents have these rights under the CCPA as amended by the CPRA.

For a lead, the fastest route is the agent or brokerage you have been dealing with, who can action the request directly. Requests can also be sent to the contact address in §10 and will be passed to the responsible agent. Because Homebound reads from Follow Up Boss, a record deleted only in Homebound may return on the next sync — a deletion request should be actioned in the source CRM as well, and we will say so rather than let you believe otherwise.

9. Children

Homebound is a professional tool and is not directed at children. It does not knowingly collect information from anyone under 16.

10. Contact and changes

Questions about this policy, or a request concerning your information, can be sent to privacy@homebound.net.

If this policy changes materially, the effective date above will be updated and the change noted on this page. Continued use after a change indicates acceptance of it.