Privacy policy

Acre (“Acre”, “we”, “us”) runs acre.so, a CRM for real estate investors. It finds listings that match your buy boxes, prices them against comps, and reminds you (or a workflow) to follow up with the listing agent.

This policy covers the website, the web app and the installed app. For the information you put in a workspace about other people (listing agents, sellers and so on), you decide what goes in and why; we hold it on your behalf and only use it to run Acre for you.

Your account. Your name, email address and password (stored only as a hash by our authentication provider), your time zone, the answers you give during setup (such as your team size), and which workspaces you belong to.

What you put in Acre. Leads and properties, addresses, prices, listing agents’ names, email addresses and phone numbers, notes, call and activity logs, follow-ups, custom fields, buy boxes, comp settings, workflows, files you upload, and CSV files you import.

People you invite. The email address of anyone you invite to Acre or to a workspace, so we can send them the invitation.

Gmail, if you connect it. See How we use Google user data.

The waitlist. If you join the waitlist, your email address and when you joined.

How you use Acre. Request logs (the page or API called, your IP address, browser, and approximate region), errors, and product analytics. On acre.so we record sessions (clicks, scrolls, page changes and what’s on screen) to find bugs and confusing screens, including what you type into form fields (passwords are always hidden).

Your device. If you turn on push notifications, the push subscription your browser gives us. Cookies and local storage are described under Cookies.

To fill your buy boxes and comps, Acre reads publicly available listing and sold-property data (for example from Redfin) and keeps a copy with the lead: price, price history, photos, beds, baths, square footage and the listing agent’s published contact details. Addresses you type are sent to our mapping provider to suggest and locate them. This data is about properties and the agents who publicly list them, not about you.

We use the information above only to:

• run Acre: show your leads, run buy boxes, comps and workflows, send the emails and notifications you or your workflows ask for;
• sign you in, keep your account secure and stop abuse;
• send service email: sign-in links, password resets, invitations and important changes to Acre or this policy;
• fix bugs, understand which features are used, and make Acre better;
• meet legal obligations.

We don’t sell your personal information, we don’t share it for cross-context behavioral advertising, and we don’t show ads in Acre.

Connecting Gmail is optional. Each member connects their own account from Manage › Integrations, and Acre asks Google for two permissions:

• Read your email (gmail.readonly): Acre searches your mailbox only for messages to or from the listing agents you added to a lead yourself or emailed from Acre (an address a teammate typed is never searched in your mailbox), plus replies in threads Acre sent from your account. It saves those messages (sender, recipients, subject, body, date and thread) on the matching lead. It looks back at most 90 days the first time it sees an agent’s address. Other messages are read only as far as needed to tell they don’t match, and are not stored.
• Send email as you (gmail.send): Acre sends the emails you write to an agent, and the emails your workflows send, from your address so replies come back to you.

We also receive your Google account’s email address, to show which account is connected. Google’s access tokens are stored encrypted (AES-256-GCM).

Emails saved on a lead are visible to the members of that lead’s workspace, like the rest of the lead. Workflows in the workspace can react to a new email from an agent (for example, by stopping follow-ups).

Acre’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Gmail data only to provide and improve the features described above, which you can see in Acre;
• we don’t sell it, use it for advertising, or use it to determine credit-worthiness or for lending;
• we don’t use it to train generalized AI or machine-learning models;
• no person at Acre reads it unless you ask us to (for example in a support request), it’s needed for security or to investigate abuse, or the law requires it;
• we share it only with the service providers that host Acre, as listed below, and only to run Acre.

You can disconnect Gmail at any time in Manage › Integrations. Acre then revokes its access with Google and deletes the stored tokens. You can also remove access from your Google account settings. Emails already saved on leads stay there until the lead or workspace is deleted, or you ask us to delete them.

Your workspace. Everything in a workspace is visible to its members. The workspace owner decides who’s in it.

Service providers that run parts of Acre for us, under contracts that limit them to doing so:

• Supabase: database, sign-in and file storage;
• Vercel: hosting;
• Google: Gmail, when you connect it;
• Mapbox: address suggestions and map locations;
• Brevo: sign-in and invitation emails;
• PostHog: product analytics and session recordings;
• Axiom: request and error logs.

When the law requires it, or to protect the rights, safety or property of our users, the public or Acre.

If Acre is sold or merged, your information may move to the new owner, who must keep honoring this policy or tell you first.

Acre uses a small number of cookies and browser storage:

• sign-in cookies, which keep you signed in;
• a preference cookie that remembers the last workspace you opened;
• analytics cookies and local storage from PostHog on acre.so, which tell visits apart and power session recordings.

We don’t use advertising cookies. Blocking cookies in your browser will sign you out.

We keep your account and workspace data for as long as your account is open. When you delete a lead, workspace or file, it is removed from Acre right away and from our backups as they roll over. When you ask us to close your account, we delete your personal information within 30 days, except what we must keep by law. Logs and analytics are kept for a limited time and then deleted. Waitlist entries are kept until you get access or ask to be removed.

Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Access to a workspace is enforced in the database itself, so one workspace can’t read another’s data. Google tokens are encrypted with a separate key. No system is perfectly secure; if we learn of a breach that affects your information, we’ll tell you without undue delay.

You can see and edit most of your information in Acre, disconnect Gmail, and turn off push notifications at any time. You can also ask us to:

• give you a copy of your personal information;
• correct it;
• delete it, or close your account;
• stop or limit a use of it, or object to it.

Email hello@acre.so from the address on your account. We answer within 30 days and won’t treat you differently for asking. Depending on where you live (for example the EU, UK or California), you may have further rights under local law, including the right to complain to your data protection authority.

If you’re a listing agent or anyone else whose details a customer saved in Acre, please contact that customer first; we’ll help where we can.

Acre is run from the United States and our providers may process data in the United States and other countries. When we transfer personal information out of the EU, UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

Acre is a tool for businesses and is not meant for anyone under 18. We don’t knowingly collect information from children.

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll also tell you by email or in Acre before it takes effect.

Questions or requests about privacy: hello@acre.so. See also our terms of service.