Privacy Policy

SourceDeck ("SourceDeck," "we," "us") operates the sourcedeck.ai website and the SourceDeck software platform for real estate brokers. The corporate entity behind SourceDeck is in formation; until it is announced, the responsible contact for all privacy matters is the founder, reachable at the email address at the end of this policy.

This policy covers two contexts: visitors to the sourcedeck.ai marketing site, and customers using the SourceDeck platform. Where the two differ, the policy says so.

Forms. When you submit a request for access, a demo request, or a newsletter signup, we collect what you enter: name, email address, and optionally phone, brokerage, market, business line, and any note you include. Newsletter signups collect email only.

Attribution. On your first page view in a session we capture standard campaign parameters from the URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referring page, and the path you landed on, stored in your browser session storage and attached to a form submission if you make one. We use this to understand which channels bring visitors.

Technical logs. Like nearly every website, our servers record request metadata such as IP address, user agent, and requested URL for security and operations.

When enabled, this site loads the following third-party measurement tools, each of which may set cookies or use similar technologies in your browser:

• /Google Analytics 4 (Google LLC), for aggregate site usage measurement.
• /Google Ads conversion tracking (Google LLC), to measure whether advertising clicks lead to form submissions.
• /Meta Pixel (Meta Platforms, Inc.), to measure advertising performance and form submissions from Meta placements.

These tools are loaded only when configured; if a tool is not configured, no script for it loads at all. You can limit tracking through your browser settings, browser extensions that block trackers, Google Ads Settings, and Meta ad preferences. The site remains fully usable with these tools blocked.

We do not use cross-site tracking beyond the tools listed above and we do not sell personal information.

We use the information above to respond to your request (access, demo, or newsletter), evaluate founding membership applications, operate and secure the website, understand which marketing channels work, and send the communications you asked for. Form submissions generate a notification email to the founder, delivered through Resend, our transactional email processor.

We do not sell your personal information, and we do not share it with third parties except the service providers listed in this policy acting on our instructions.

If you tick the text-message box on sourcedeck.ai/sms, you give SourceDeck permission to send text messages from (561) 933-4902 about your SourceDeck request, scheduling a demo or onboarding call, and account and support questions. We do not send promotional or bulk marketing texts, and submitting any other form on this site does not enroll you in text messages.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop receiving texts, and HELP for help. Consent to receive texts is not a condition of any purchase.

Mobile information or text messaging opt-in data and consent will not be sold or shared with third parties or affiliates for their marketing or promotional purposes.

You can also withdraw consent at any time by emailing [email protected]. We keep the date and time of your consent and the exact wording you agreed to, and an opt-out on one channel does not affect the other contact you have separately agreed to.

Customers of the SourceDeck platform store business data in it: contacts, properties, pipeline, documents, and outreach history. That data belongs to the customer. Each brokerage operates in its own tenant, isolated at the database layer with row-level security, and one customer’s data is never shared with, or visible to, another customer.

AI features process customer data to perform the tasks the customer directs (sourcing, drafting, scoring, document generation) and for no other purpose. To do that, the text of the task is sent to Anthropic’s Claude models through SourceDeck’s business API account; a few optional features use OpenAI (voice note transcription and image generation) and ElevenLabs (the spoken voice of CASH). SourceDeck does not train or fine-tune any model on customer data.

Files a customer uploads or generates are kept in two ways. Marketing material (listing photos, site imagery, a published offering memorandum or flyer) is served by long, unguessable public links so it can be shared. Since October 1, 2026, everything else (rent rolls, financials, surveys, deal room documents, executed confidentiality agreements, client portal files, CMAs and presentations, reports, imports and exports) is stored without a public link and is served only after an access check: the customer’s signed-in session, a signed confidentiality agreement in a deal room, a client portal link, or a share link the customer sent, which expires. Each of those serves the file through a link that lives ten minutes, or streams it through the platform. Files uploaded before that date are being moved the same way; an old public link keeps working until the old copy is deleted.

Platform customers are responsible for their own compliance obligations toward their contacts, including obtaining any consents required for their outreach. SourceDeck provides compliance tooling (verification gates, suppression lists, unsubscribe handling, throttles) but does not provide legal advice.

Platform customers may connect their own Google account so that SourceDeck can work their email and calendar on their behalf. This connection uses Google OAuth and, with the customer’s explicit consent in one Google consent screen, exactly these four scopes:

Gmail read-only (https://www.googleapis.com/auth/gmail.readonly), to read the customer’s messages so they can be triaged and summarized and so replies can be drafted in context. Gmail compose (https://www.googleapis.com/auth/gmail.compose), to create drafts in the customer’s Drafts folder and to send a draft only when the customer has approved it or has turned on sending for that feature (drafts are the default). Calendar events (https://www.googleapis.com/auth/calendar.events), to put a meeting or tour booked through SourceDeck on the customer’s calendar. Calendar free/busy (https://www.googleapis.com/auth/calendar.freebusy), to see when the customer is busy so only open times are offered. SourceDeck does not request the Gmail modify scope and does not change, label, archive or delete the customer’s messages. Signing in to SourceDeck with Google uses only the customer’s basic profile and email address.

The customer grants these in Google’s own consent screen and can revoke them at any time from their Google Account settings or by disconnecting the integration inside SourceDeck.

SourceDeck’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide and improve the features the customer explicitly connected it for; we do not sell it; we do not use it for advertising; we do not let humans read it except with the customer’s permission, for security purposes (such as investigating abuse), to comply with applicable law, or when the data has been aggregated and anonymized; and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.

Connected-account credentials (OAuth refresh tokens) are stored encrypted at rest and isolated to the customer’s own tenant, never shared with another customer. Message content that SourceDeck processes to perform a task is used only to perform that task and to keep the customer’s own records within their tenant; it is not retained for any other purpose. Revoking access in Google, or disconnecting in SourceDeck, stops all further access, and the connected-account credentials are deleted when the customer disconnects or leaves.

Platform customers with a Microsoft work or school account may connect their own Microsoft 365 mailbox so that SourceDeck can work their email on their behalf. This connection uses Microsoft sign-in (the Microsoft identity platform) and, with the customer’s consent in Microsoft’s own consent screen, exactly these delegated Microsoft Graph permissions: User.Read, to identify the mailbox and its address; Mail.ReadWrite, to read the customer’s messages so they can be triaged and summarized and so replies can be drafted in context, and to place drafts in a folder named SourceDeck in the customer’s mailbox; Mail.Send, to send a draft only when the customer has approved it or has turned on sending for that feature (drafts are the default); and offline_access, so the connection keeps working without asking the customer to sign in again. SourceDeck does not request calendar, contacts or file permissions through this connection.

The customer can revoke access at any time from their Microsoft account (myapps.microsoft.com) or by disconnecting the integration inside SourceDeck. Where a customer’s organization requires it, a Microsoft 365 administrator may need to approve the connection first.

SourceDeck treats Microsoft user data under the same commitments as Google user data in section 5a: we use it only to provide the features the customer explicitly connected it for; we do not sell it; we do not use it for advertising; we do not let humans read it except with the customer’s permission, for security purposes (such as investigating abuse), to comply with applicable law, or when the data has been aggregated and anonymized; and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.

Connected-account credentials (OAuth refresh tokens) are stored encrypted at rest and isolated to the customer’s own tenant, never shared with another customer. Message content that SourceDeck processes to perform a task is used only to perform that task and to keep the customer’s own records within their tenant. Disconnecting in SourceDeck or revoking in Microsoft stops all further access, and the connected-account credentials are deleted when the customer disconnects or leaves.

We use the processors below to run the website and platform. The list is generated from the same register as our trust center (sourcedeck.ai/trust), which is checked against the code that runs the platform. Google and Meta also provide the analytics and advertising measurement described in section 3, when enabled. Public data sources the platform reads (US Census, the Federal Reserve, SEC filings, county records, the Florida corporate registry, MLS feeds) are not processors: they send data to us, not the other way round.

• /Fly.io: Runs the SourceDeck app, the background jobs and this website (Ashburn, Virginia region).
• /Crunchy Data (Crunchy Bridge): Managed Postgres database, on AWS us-east-1.
• /Cloudflare: DNS and TLS in front of the sites, R2 file storage, and nightly database backups.
• /Anthropic: The Claude models behind CASH, drafting, classification and document writing.
• /Resend: Sends email: alerts to you, and the outbound email you approve.
• /Google: Sign-in, and Gmail, Analytics and Search Console when you connect them.
• /Better Stack: Uptime monitoring heartbeat.
• /Stripe: Billing, once paid plans are switched on. Used only when the customer uses that feature or connects that account.
• /OpenAI: Transcribes voice notes and generates marketing images. Used only when the customer uses that feature or connects that account.
• /ElevenLabs: The spoken voice of CASH. Used only when the customer uses that feature or connects that account.
• /MillionVerifier and Bouncer: Checks that an email address can receive mail before anything is sent to it. Used only when the customer uses that feature or connects that account.
• /Endato (EnformionGO): Owner contact lookup (skip trace), only when paid lookups are switched on for your workspace. Used only when the customer uses that feature or connects that account.
• /Apify: Public people and company lookups during contact enrichment. Used only when the customer uses that feature or connects that account.
• /SearchBug: Do Not Call list checks. Used only when the customer uses that feature or connects that account.
• /Twilio: Phone number lookups. Used only when the customer uses that feature or connects that account.
• /Quo (OpenPhone): Business calling and call logging when connected. Used only when the customer uses that feature or connects that account.
• /Vapi: Voice calls to warm, consenting leads, when turned on. Used only when the customer uses that feature or connects that account.
• /Lob: Printed direct mail you approve. Used only when the customer uses that feature or connects that account.
• /Dropbox Sign: Electronic signatures on documents you send for signing. Used only when the customer uses that feature or connects that account.
• /Cal.com: Booking links and scheduled calls. Used only when the customer uses that feature or connects that account.
• /Meta, LinkedIn and TikTok: Posts social content you approve to the accounts you connect. Used only when the customer uses that feature or connects that account.
• /Runway: Generates short property videos when you ask for one. Used only when the customer uses that feature or connects that account.
• /Crexi: Listing integration when you connect a Crexi account. Used only when the customer uses that feature or connects that account.

Lead form submissions are retained while we evaluate and follow up on them and for our business records afterward. Newsletter signups are retained until you unsubscribe. Platform customer data is retained for the life of the customer relationship; when a customer leaves, their data is exported to them on request and then deleted from production systems within a commercially reasonable period, except where law requires longer retention.

You can request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, subject to legal retention obligations. You can unsubscribe from the newsletter at any time using the link in any issue, and from sales follow-up by replying and saying so. To exercise any of these rights, email us; we respond to verified requests within the timeframes required by applicable law, including the rights afforded to residents of states with comprehensive privacy statutes.

Traffic to the site and platform is encrypted in transit. Platform data is isolated per tenant with database-level row security. Credentials are stored outside the codebase, and connected-account credentials are encrypted in the application before they are stored. Private files are handled as described in section 5. No system is perfectly secure, and we will notify affected users of any breach as required by law.

SourceDeck is a business tool for licensed real estate professionals. It is not directed to children, and we do not knowingly collect information from anyone under 16.

We will post any changes to this policy on this page with an updated effective date. Material changes affecting platform customers will also be communicated directly.