Privacy Policy

We collect the following categories of information:

• Account information — your name, email address, business name, phone number, and authentication identifiers when you sign up or sign in (including via Google, Microsoft, or Apple sign-in).
• Business, valuation, prompts & configuration data — information you enter or select, including typed prompts, your business profile, AI persona settings, scripts, working hours, coaching scenarios, scheduling rules, property and valuation inputs, completed valuation details, report settings and recipients, the business-profile image you choose to upload, and any exact-property report image you deliberately submit through a legacy report integration.
• Contacts — the names, phone numbers, email addresses, and notes for the people you choose to call or text through Harvesty, whether entered by you, imported, or captured on a call. If you start a device-contact import, nothing is selected by default; only contacts you individually check are uploaded for preview and saved after you confirm. Harvesty does not automatically upload your whole address book.
• Audio, call & message content — microphone audio you provide when you start an AI voice or coaching feature, call audio recordings (when enabled), conversation and call transcripts, AI-generated summaries and outcomes, and the content of SMS messages sent and received through the service.
• Connected-account data — when you connect a Google or Microsoft account, the data made available by the specific permissions you grant (see Section 4).
• Billing data — plan, usage, billing contact, payment status, transaction status, and subscription status. Payment-card details are handled by Stripe and are not stored by Harvesty.
• Usage & device data — log data, IP address, browser type, and product analytics used to operate, secure, and improve the service.

• To provide, operate, and maintain the service, including creating, storing, previewing, downloading, and sharing the valuation reports you request.
• To place and receive AI-assisted calls and texts on your behalf, and to check availability and book appointments when you enable those features.
• To generate transcripts, summaries, and outcomes from your calls.
• To process billing and prevent fraud and abuse.
• To support you, communicate service notices, and improve product quality and reliability.
• To comply with legal obligations.

We do not sell your personal information, and we do not use the content of your calls, messages, or connected-account data to build advertising profiles.

Connecting a Google or Microsoft account is optional and is used only to power the features you turn on. You grant permissions through the provider’s own consent screen, and you can revoke them at any time from your provider account settings or by disconnecting the integration inside Harvesty.

• Calendar — for connected calendars you choose to sync, we retrieve the calendar and event metadata needed to display your schedule and compute availability. This can include calendar names and, when supplied by your provider, event titles, start and end dates or times, all-day, time-zone and status details, locations, organizers, and meeting links. We also create, update, or cancel events for appointments you book through Harvesty. You control which connected calendars are displayed, used to block availability, and selected as the booking calendar.
• Send email — if you enable it, we send booking confirmations and follow-ups from your connected address. We do not read your inbox.

Scope of Google user data. Google user data (your Google Calendar events, calendar availability, and the ability to send email from your Gmail address) is used ONLY to provide the user-facing features you explicitly enable: showing your availability, booking and syncing appointments, and sending emails that you or your AI assistant compose. We never use Google user data for billing, fraud prevention, customer support, marketing, advertising, analytics, improving other products, or developing or training generalized AI/ML models. We do not sell Google user data and do not transfer it to third parties except as necessary to provide these features, for security, or to comply with applicable law.

Google API Services — Limited Use. Harvesty’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google APIs (such as Google Calendar and Gmail send) is used only to provide and improve the user-facing features described above, is not transferred or sold for advertising or other unrelated purposes, is not used to train generalized AI/ML models, and is only accessed by humans where you have given consent, for security, to comply with law.

Microsoft Graph data (Outlook Calendar and mail-send) is handled on the same basis: used only to deliver the features you enable, never sold, and never used for unrelated profiling.

AI features are optional. Before any mobile AI feature sends personal information to an AI provider, Harvesty presents a dedicated in-app disclosure that names Google LLC (Gemini) and OpenAI, L.L.C., lists the data that may be sent, and asks for your permission. No mobile data is sent to either AI provider unless you explicitly tap “Agree & Continue.”

• Google LLC (Gemini) — powers assistant voice and chat, AI calls, coaching, campaign drafting, persona accents, and voice previews. Depending on the feature you request, Google may receive microphone or call audio, typed prompts, conversation or call transcripts, business and persona settings, coaching scenarios, and the contact or customer details selected for that request.
• OpenAI, L.L.C. — may power a real-time AI call when that provider is selected. It may receive live call audio, prompts, transcripts, business or persona settings, and the contact or customer details selected for the call.
• How the data is collected — directly from what you type, say, upload, configure, or select; from the microphone only after you start a voice feature and grant operating-system microphone access; from relevant account and contact records you choose to use with AI; and from transcripts or outputs generated while providing the requested feature.
• How the data is used — only to perform the AI feature you request, return the response, audio, draft, call result, or coaching score, maintain safety and security, and troubleshoot service reliability. Harvesty does not sell this information or use it for advertising profiles.

You may choose “Not now”; non-AI app features remain available. The mobile app records your explicit choice before it enables an AI feature or transmits the listed data. You can review the full disclosure and grant or withdraw permission at any time in Settings > Privacy > AI data sharing. Withdrawing permission immediately stops in-app AI voice features and blocks new AI actions and new AI data sharing from the mobile app. Information already processed, including work already requested before withdrawal, remains subject to the retention and deletion obligations in our provider agreements and applicable law.

Google and OpenAI act as Harvesty service providers under data-processing terms requiring privacy and security protection that is the same as or equivalent to the protection Harvesty provides. We use encryption in transit, access and purpose restrictions, and data minimization, and we do not authorize these providers to use the data for advertising or unrelated generalized model training.

We share information only with service providers who help us run the service. We require every provider that receives personal information to use it only to provide services to us and to provide the same or equal protection described in this Policy and required by applicable guidelines and law. These providers include:

• Telnyx (telephony and SMS) and LiveKit (real-time media transport), to place calls, carry audio, and send texts;
• Google LLC (Gemini) and OpenAI, L.L.C. for the optional AI features described in Section 5;
• Vercel (application hosting) and Supabase (authentication, database, and storage);
• Stripe (payment processing and billing);
• Google, Microsoft, and other CRM or calendar/email providers you choose to connect.

Valuation reports, report links, recipient details, and any legacy report image included in a report are shared only with the recipients and delivery providers you select. We may also disclose information to comply with the law, enforce our agreements, or protect the rights, safety, and security of our users and the public. If Harvesty is involved in a merger or acquisition, information may be transferred as part of that transaction subject to this Policy.

Depending on where you live, you have rights over your personal information. For users in Canada and Quebec, these include the right to access the personal information we hold about you, to request correction, to withdraw consent, and to request deletion, subject to legal limits. To exercise these rights, contact us at privacy@harvesty.ca. We will respond within the timeframes required by applicable law.

You are responsible for having a lawful basis to contact the people whose information you load into Harvesty, and for honoring opt-out and do-not-call requests; the service provides tools (such as STOP handling) to help you do so.