Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Sophia CRE, Inc., a Delaware corporation ("Sophia CRE," "Sophia," "we," "us," or "our") collects, uses, shares, and protects personal information.

It covers:

• Our website at sophiacre.ai and related marketing pages, forms, and emails
• The Sophia platform, including Mission Control, our AI workflows, and the integrations that surface them in Microsoft Teams and Slack
• AI Workflow Customization, the custom workflows we design and build for member organizations
• AI Workforce Training, our live virtual training program, including sessions, homework, and skills documentation

We call the organizations that subscribe to our services "members," and the people they authorize to use our services "authorized users." Sophia CRE serves commercial real estate firms; our services are not intended for consumers.

Our services are also governed by our Terms of Service and, for members, by a written agreement and, on request, a Data Processing Addendum. If those documents conflict with this policy regarding member data, the member agreement controls.

2. Information we collect

We do not knowingly collect sensitive personal information, such as government ID numbers or health data, except where a member chooses to process it through the platform as member data.

3. How we use information

We use personal information to:

• Provide, operate, and support the Sophia platform, custom workflows, and training program
• Run AI workflows a member has configured, and route results to authorized users for approval, rejection, or modification
• Measure results for members, such as Mission Control dashboards and monthly scorecards
• Maintain audit trails, secure our services, and detect, prevent, and investigate fraud, abuse, or security incidents
• Respond to inquiries, schedule demos, and provide member support by email and chat
• Send service notices and, where permitted, marketing communications you can opt out of at any time
• Improve our services and train AI models using de-identified information that does not identify any member or individual, as described in Section 4
• Comply with law, enforce our agreements, and protect our rights and those of others

We use member data to provide services to that member, as described in Section 5, and to create de-identified data, as described in Section 4.

4. How we handle data in our AI services

Sophia's AI services run on large language models provided by third-party AI providers. Our proprietary AI Synchronization Model™ may send a task to more than one model so their results can be cross-checked. Here is how we protect member data in that process:

5. Our role with member data

When we process member data, we act as a service provider (or "processor") on behalf of the member, which is the business (or "controller") responsible for that data. That means:

• We process member data only according to the member's agreement and instructions
• We do not sell member data or share it for cross-context behavioral advertising
• Members decide what systems to connect, what data flows through Sophia, and who has access

If you are a tenant, resident, vendor, employee, or other individual whose information a member processes through Sophia, please direct privacy requests to that member. We will assist the member in responding as required by law and our agreement.

6. How we share information

We do not sell personal information. We share it only as follows:

• Subprocessors and vendors that help us operate, such as cloud hosting, AI model providers, communication tools, analytics, payment processing, and member support. They are bound by contracts requiring confidentiality, security, and use only for our services. A current list of subprocessors is available to members on request.
• Integrations you enable, such as Microsoft Teams, Slack, or a member's property management system or CRM. Those services handle data under their own terms and privacy policies.
• Within a member organization, with administrators and authorized users according to the permissions the member sets, and AI Workforce Training session recordings with the member's management
• Legal and safety reasons, when required by law, subpoena, or court order, or to protect the rights, property, or safety of Sophia, our members, or others
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections
• With your consent or at your direction

7. Cookies and similar technologies

Our website uses cookies, pixels, and similar technologies to keep the site working, remember your preferences, understand how visitors use the site, and measure our marketing. We use Google Analytics. See our Cookie Policy for details.

You can control cookies through your browser settings and our cookie banner. We honor Global Privacy Control (GPC) signals as an opt-out of targeted advertising where required by law. Blocking some cookies may affect how the site works.

The Sophia platform uses only the cookies needed to log you in, keep your session secure, and remember your settings.

8. Retention, security, and data location

Retention. We keep personal information only as long as needed for the purposes in this policy. Member data is kept for the term of the member's agreement and is available for the member to export for 30 days after it ends. After that, we may delete it in line with our data retention policies. Audit logs, billing records, and contract records are kept as needed for legal, tax, and security purposes. Marketing contact data is kept until you opt out or it is no longer useful.

Security. We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, role-based access controls, logging and audit trails, and vendor security reviews. No system is perfectly secure; if a breach affects your information, we will notify affected members and individuals as required by law and our agreements.

Data location. Sophia CRE is based in the United States, and we store and process data in the United States. If you access our website from outside the U.S., your information will be transferred to and processed in the U.S.

9. Your choices and rights

• Marketing emails. Click "unsubscribe" in any marketing email or contact us. We will still send service and account notices.
• Account information. Authorized users can update profile details in the platform or through their member administrator.
• State privacy rights. Depending on where you live, such as California, Colorado, Virginia, and other states with consumer privacy laws, you may have the right to know what personal information we hold about you, access it, correct it, delete it, receive a portable copy, and opt out of targeted advertising, sale, or profiling. California residents may also limit the use of sensitive personal information.
• How to make a request. Email support@sophiacre.com with the subject line "Privacy Request." We will verify your identity before responding, and you may use an authorized agent. If we deny your request, you may appeal by replying to our decision.
• No discrimination. We will not treat you differently for exercising your privacy rights.

Requests about member data (Section 5) should go to the member organization that controls it.