Privacy Policy

1. Introduction

Total Agent LLC ("Company," "we," "us," or "our") operates an AI-powered real estate operating platform ("Platform") accessible at app.bytotalagent.com and bytotalagent.com. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the Platform and all related services — including all current modules and any features added in the future.

By accessing or using the Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not access or use the Platform.

2. Information We Collect

2.1 Information Provided by Agents and Subscribers

When you create an account or subscribe, we collect:

• Full name, email address, phone number, and mailing address
• Real estate license number and licensing state
• Brokerage name and affiliation
• Brand assets including logos, headshots, color preferences, and taglines
• Payment and billing information (processed securely through Stripe; we do not store raw card data)
• Cell phone number for call forwarding and Calls module configuration
• MLS credentials and listing data you choose to import
• Financial goal data including income targets and commission structures
• AGENTA Brain questionnaire responses including brand positioning, communication style, target markets, and personal background information you choose to provide
• Voice DNA profile data used to personalize all AI-generated communications

2.2 Information Collected About Contacts and Leads

Agents using the Platform may input or import information about their clients, leads, and professional contacts, including:

• Names, email addresses, and phone numbers
• Property interests, showing history, and preferences
• Communication history (SMS messages, call logs, email correspondence)
• Showing feedback and property notes
• Transaction details and deal timeline milestones
• Lead source, referral data, and contact tags
• Relationship notes entered by the agent

Contacts of subscribing agents are not Platform users and do not have accounts. Agents are independently responsible for their lawful collection and use of contact data.

2.3 Information Collected Automatically

• Device type, intelligence platform, and browser information
• IP address and approximate geolocation
• Usage patterns, feature interactions, and session duration
• Log data including access times, pages viewed, and actions taken
• Cookies and similar tracking technologies (see Section 16 for details)
• Performance and error data used for Platform improvement

2.4 Information Collected Through Communications

• SMS: Content, timestamps, delivery status, and recipient data for all text messages sent or received through the Platform
• Phone Calls: Call logs including duration, timestamps, caller ID data, and call recordings (where consent has been obtained per applicable law)
• Email: Metadata and content of emails sent through the Platform's integrated email functionality, and emails accessed by AGENTA for event detection under your authorization
• Showing Feedback: Responses collected from buyers' agents following property showings, processed through FeedbackIQ

2.5 Information Collected Through Document Services

• Real estate contracts and addenda uploaded for AI document analysis
• E-signature data including signature events, timestamps, IP addresses, and email verifications
• Transaction documents stored within DealSync

2.6 Information Collected Through Social Media and Content Integrations

• Social media account identifiers and access tokens for connected accounts (Instagram, Facebook, LinkedIn, and any future platform integrations)
• Content performance data from connected social platforms where authorized
• Publishing history and scheduled content within ContentSync

2.7 Information Collected on Our Marketing Website

When you visit bytotalagent.com or submit our waitlist form, we collect:

• First name, last name, email address, and phone number (when you submit the waitlist form)
• Page view and browsing behavior data collected via Meta Pixel and Plausible Analytics (see Section 16 for full details)
• IP address, browser type, device information, and referring URL

2.8 Information Collected Through Future Features

As the Platform grows to include a mobile application, additional integrations, brokerage-level features, MLS data connections, and other capabilities, we may collect additional categories of information necessary to provide those features. Material expansions in data collection will be disclosed through updates to this Privacy Policy.

3. Artificial Intelligence and Automated Processing

3.1 How AGENTA Uses Your Data

Our AI engine, AGENTA, uses large language models and your per-agent AGENTA Brain profile to power features across all modules. Current and planned AI-powered capabilities that process your data include:

• Email Monitoring and Drafting (InboxIQ): With your authorization, AGENTA accesses your connected email account to identify real estate events, draft responses, create CRM records, and trigger automation rules
• SMS Automation (ShowingSync, ClientSync, DealSync): AGENTA drafts, schedules, and sends SMS messages based on platform events and your configured rules
• Feedback Processing (FeedbackIQ): AI analyzes and classifies showing feedback from buyers' agents for structured delivery to sellers
• Content Generation (ContentSync): AI generates social media posts, blogs, listing descriptions, email campaigns, reel scripts, and other marketing materials
• Call Transcription and Summarization (Calls): Recorded calls are processed by AI to generate transcripts and summaries
• Document Analysis (Smart Contracts): Multiple AI models simultaneously extract and cross-verify data from real estate contracts
• Lead Scoring and Prioritization (ClientSync): AI analyzes contact behavior to suggest follow-up priorities
• Daily Action Briefing (DayBrief): AI synthesizes data from all modules to generate your daily prioritized briefing
• Deal Monitoring (DealSync): AGENTA monitors email and deal timelines to identify executed contracts, track deadlines, and draft deal communications
• Future AI Features: As AGENTA evolves, additional AI-powered capabilities may be introduced. All such capabilities will process your Platform data to deliver the relevant features.

3.2 AI Data Processing and Third-Party Providers

Data processed by AI systems may be transmitted to third-party AI service providers via API. We select providers that do not use API-submitted data to train their general models and that maintain enterprise-grade data security. We may use multiple AI models simultaneously (for example, in document analysis) and reserve the right to change AI providers without notice, provided replacement providers meet equivalent data protection standards.

3.3 No Use of Customer Data for AI Training

3.4 Automated Decision-Making

The Platform uses automated processing to assist with certain decisions, including:

• Lead Scoring: AI assigns priority scores to contacts based on engagement signals, communication recency, and behavioral patterns to help agents prioritize follow-ups
• AI Prioritization (DayBrief): AGENTA synthesizes data across modules to rank daily tasks and recommended actions
• Email Event Detection (InboxIQ): Automated classification of incoming emails to detect real estate events and trigger workflows
• Content Recommendations (ContentSync): AI suggests content topics and formats based on market data and engagement patterns

These automated processes are designed to assist and augment agent decision-making, not replace it. No fully automated decisions with legal or similarly significant effects are made without human review. You may request human review of any automated decision, obtain an explanation of the logic involved, or opt out of automated lead scoring and prioritization by contacting us at hello@bytotalagent.com. Opting out of automated features may limit certain Platform functionality.

3.5 AI Limitations

AI outputs may be inaccurate, incomplete, or contextually inappropriate. AI-generated content and recommendations do not constitute professional legal, financial, or real estate advice. Users are solely responsible for reviewing all AI-generated outputs before use.

4. How We Use Your Information

We use information we collect to:

• Provide, operate, maintain, and improve the Platform and all current and future features
• Process transactions and manage subscriptions
• Build and maintain your AGENTA Brain and Voice DNA profile for AI personalization
• Send SMS messages, emails, and other communications on behalf of subscribing agents
• Monitor email accounts (with authorization) to detect real estate events and trigger automated actions
• Forward and handle inbound and outbound phone calls and record calls with appropriate consent
• Process, classify, and deliver showing feedback through FeedbackIQ
• Analyze and cross-verify real estate contracts for deadline and data extraction
• Facilitate e-signature workflows and document management
• Generate, schedule, and publish content to connected social media platforms
• Track financial goal progress and commission data through RevenueSync
• Generate daily action briefings through DayBrief
• Provide analytics, dashboards, and performance insights
• Detect, prevent, and address technical issues, fraud, and security threats
• Communicate with you about your account, updates, and support
• Comply with legal obligations
• Provide features offered through future Platform modules and integrations
• Measure advertising effectiveness and website traffic through cookies and tracking technologies as described in Section 16

5. SMS and Telephone Communications

5.1 SMS Messaging

The Platform sends SMS text messages on behalf of subscribing real estate agents. By receiving SMS messages from a Total Agent subscriber, you acknowledge:

• Messages are sent from dedicated local phone numbers assigned to individual agents
• Message frequency varies based on showing activity and agent communication preferences
• Message and data rates may apply depending on your mobile carrier and plan
• You may opt out of SMS communications at any time by replying STOP to any message
• You may request help by replying HELP to any message
• Opt-out requests are processed immediately and automatically

5.2 Phone Calls and Call Recording

Inbound and outbound calls through the Platform's Calls module are handled via dedicated business phone numbers. These calls may be recorded for quality assurance, training, and record-keeping.

• All parties are notified of call recording via an automated disclosure at the beginning of the call, in compliance with applicable state and federal laws including all-party consent requirements
• Call recordings are stored securely and accessible to the subscribing agent through the Platform
• Recordings may be processed by AI for transcription and summarization
• Agents are responsible for ensuring use of call recordings complies with all applicable laws in their jurisdiction

5.3 Email Communications

The Platform integrates with agents' Gmail and Outlook accounts via OAuth. We do not store email account passwords. Emails sent through the Platform originate from the agent's actual email address. With agent authorization, AGENTA may also monitor the agent's inbox to detect real estate events and trigger automated actions.

5.4 Google API Services User Data Policy

Total Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We only request the minimum Gmail API scopes necessary for Platform features
• We do not use Gmail data for advertising, market research, or any purpose unrelated to Platform services you have authorized
• We do not transfer Gmail data to third parties except as necessary to provide authorized services, comply with applicable law, or as part of a business transfer with prior notice
• We do not use Gmail data to train machine learning or AI models
• Humans may only access your Gmail data with your affirmative consent for support, as required for security, to comply with law, or when data is aggregated and anonymized for internal operations

6. Data Sharing and Disclosure

We do not sell your personal information. We do not share mobile opt-in data or SMS consent with third parties for marketing or promotional purposes. We may share information in the following circumstances:

• Service Providers: We share data with third-party providers who perform services on our behalf — including payment processing, SMS and voice communications, AI processing, application hosting, database infrastructure, email connectivity, and social media publishing. These providers are contractually obligated to protect your data and use it only for services they provide to us.
• Advertising and Analytics Partners: We share data with Meta (Facebook) through the Meta Pixel and with Plausible Analytics for website analytics purposes. Data shared with Meta includes page view events and lead submission events, which may include IP address, browser information, and action timestamps. Under the CCPA, this sharing of data with Meta through the Pixel constitutes "sharing" of personal information for cross-context behavioral advertising purposes. See Section 16 for full details on tracking technologies. You may opt out of this sharing as described in Section 11.
• Subscribing Agents: Contact and communication data entered by or generated on behalf of a subscribing agent is accessible to that agent through the Platform. Agents are independent data controllers for their client data and are responsible for their own privacy law compliance.
• Social Media Platforms: Content you authorize for publication is transmitted to connected platforms. Each platform maintains its own data practices.
• MLS and Data Providers: If and when MLS data integrations are executed under formal vendor agreements, data sharing with those providers will be governed by those agreements and disclosed in an update to this policy.
• Legal Requirements: We may disclose your information if required by law or in response to valid requests by public authorities.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership or control.
• Protection of Rights: We may disclose information to protect and defend our rights, property, or safety, or that of our users or others.

7. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row-level security at the database level ensuring complete data isolation between agent accounts
• OAuth-based authentication for third-party integrations (no password storage)
• Regular security assessments and monitoring
• Access controls limiting data access to authorized personnel only
• Secure handling of API keys and credentials through environment-based configuration

No method of internet transmission or electronic storage is 100% secure. We maintain security incident response procedures as described in Section 7.1 below.

7.1 Data Breach Notification

In the event of a security breach involving your personal information, we will:

• Timeline: Notify affected individuals no later than 30 calendar days after determination that a breach has occurred, consistent with Florida Statutes Section 501.171 and other applicable state breach notification laws
• Method of Notice: Provide notification via email to the address associated with your account and, if the breach affects more than 500 individuals, post a prominent notice on our website at bytotalagent.com
• Content of Notice: Include a description of the breach, the types of personal information involved, the date or estimated date of the breach, steps we are taking in response, steps you can take to protect yourself, and contact information for further inquiries
• Definition of Breach: A data breach occurs when there is unauthorized access to, or acquisition of, unencrypted personal information (including names combined with Social Security numbers, financial account numbers, driver's license numbers, email credentials, or medical information) that materially compromises the security, confidentiality, or integrity of that information
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that notice would impede a criminal investigation, in which case notice will be provided promptly after the law enforcement agency determines it will no longer compromise the investigation

For subscribing agents who act as data controllers, we will notify you of any breach affecting data you have entrusted to the Platform within 72 hours of our becoming aware of the breach, enabling you to fulfill your own notification obligations to your clients and contacts.

8. Data Retention

Upon account termination, you may request deletion of your data by contacting us at hello@bytotalagent.com. We will process deletion requests within 30 days, except where retention is required by law (for example, e-signature audit trails must be retained for the full 7-year period regardless of account status).

9. Agent Obligations Regarding Contact Data

Subscribing agents act as independent data controllers for personal data they input about their clients, leads, and contacts. By inputting contact data, you represent and warrant that:

• You have all necessary rights and permissions to collect and process the contact's personal data
• You have provided any required privacy notices to your contacts
• Your use of contact data complies with all applicable privacy laws including the TCPA, CAN-SPAM, CCPA, and any applicable state laws
• You have obtained proper written consent for SMS communications where required
• You will honor all opt-out and deletion requests from your contacts promptly

The Company processes contact data on behalf of subscribing agents solely for the purpose of providing Platform services. Each subscribing agent is responsible for their own compliance with applicable privacy laws in connection with their use of the Platform.

10. Privacy Notice for Contacts and Leads (Non-Users)

If you are a client, lead, or contact of a real estate agent who uses the Total Agent Platform, this section describes your rights and how your data is handled, even though you do not have a Platform account.

10.1 What Data Is Collected About You

Your agent may input or import the following information about you into the Platform:

• Your name, email address, and phone number
• Property interests, showing history, and preferences
• Communication history including SMS messages, call logs, and emails exchanged with your agent
• Transaction details and deal milestones
• Showing feedback you provide
• Notes and tags your agent assigns to your contact record
• Lead source and referral information

10.2 How Your Data Is Used

Your data is used by the Platform solely to help your agent provide real estate services to you, including: scheduling and coordinating property showings, sending communications on behalf of your agent, processing showing feedback, managing transaction timelines, and generating AI-assisted communications and recommendations for your agent's review.

10.3 Your Rights as a Contact

Regardless of whether you are a Platform user, you have the right to:

• Access: Request a copy of personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Opt-Out of SMS: Reply STOP to any SMS message at any time to immediately stop receiving text messages
• Object to Processing: Object to certain uses of your data

To exercise these rights, you may contact your agent directly or contact us at hello@bytotalagent.com. We will coordinate with the subscribing agent as needed to fulfill your request. We will respond to verified requests within 30 days.

11. California Privacy Rights — CCPA/CPRA Notice at Collection

11.1 Categories of Personal Information Collected and Purposes

11.2 Your CCPA/CPRA Rights

If you are a California resident, you have the following rights:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting, and the categories of third parties with whom we share your information
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain legal exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: While we do not sell personal information for monetary consideration, our use of the Meta Pixel constitutes "sharing" of personal information for cross-context behavioral advertising under the CCPA. You may opt out of this sharing by contacting us or using browser-based opt-out mechanisms (see Section 16)
• Right to Limit Use of Sensitive PI: You may request that we limit our use of sensitive personal information to only what is necessary to provide the Platform services (see Section 11.4)
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights

To submit a California privacy request, contact us at hello@bytotalagent.com with the subject line "California Privacy Request." We will verify your identity and respond within 45 days. You may also designate an authorized agent to make a request on your behalf.

11.3 Sharing for Advertising Purposes

We "share" (as defined under CCPA) the following categories of personal information with Meta Platforms, Inc. for cross-context behavioral advertising through the Meta Pixel: identifiers (IP address, browser/device data) and internet/electronic activity (page views, lead form submissions). We do not sell personal information for monetary consideration. We do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.

11.4 Sensitive Personal Information (SPI)

Under the CPRA, certain categories of personal information are classified as "sensitive personal information." The Platform may collect the following categories of SPI:

• Account Credentials: Username and password combinations used for Platform authentication
• Financial Information: Payment card details (processed by Stripe; we do not store raw card data), commission structures, and income target data processed through RevenueSync
• Precise Geolocation: If and when the mobile application is released, precise geolocation data may be collected with your permission

We use sensitive personal information only as necessary to provide the Platform services you have requested and for security purposes. You have the right to limit our use of sensitive personal information to these purposes. To exercise this right, contact us at hello@bytotalagent.com with the subject line "Limit Use of Sensitive PI."

12. State-Specific Privacy Considerations

12.1 Florida

Total Agent operates primarily in Florida. Florida requires all-party consent for call recording (Section 934.03, Florida Statutes). Our Platform provides automated recording disclosures to comply with this requirement. Florida Statutes Section 501.171 requires notification of data breaches involving personal information within 30 days; our breach notification procedures (Section 7.1) are designed to meet this requirement.

12.2 Other States

As the Platform expands nationally, additional state-specific privacy and call recording laws apply. Agents operating outside Florida are responsible for understanding and complying with applicable laws in their jurisdiction. Call recording consent requirements vary significantly by state. The Company will update this policy as national expansion introduces additional jurisdiction-specific considerations.

13. GDPR — European Economic Area and United Kingdom

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, this section outlines how we process your personal data in compliance with the General Data Protection Regulation (GDPR) and the UK GDPR.

13.1 Data Controller

Total Agent LLC is the data controller for personal data collected directly from you (such as account registration, website visits, and waitlist submissions). For personal data entered by subscribing agents about their clients and contacts, the subscribing agent is the data controller and Total Agent LLC acts as the data processor.

13.2 Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Platform services you have subscribed to, including AI-powered features, communications, and document management
• Legitimate Interests (Article 6(1)(f)): Processing for Platform improvement, analytics, security, fraud prevention, and marketing our services, where our interests are not overridden by your rights
• Consent (Article 6(1)(a)): Processing based on your explicit consent, such as email monitoring by AGENTA, call recording, Meta Pixel tracking, and optional data sharing. You may withdraw consent at any time
• Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including tax, financial reporting, and breach notification requirements

13.3 Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights:

• Right of Access (Article 15): Obtain confirmation of whether we process your personal data and request a copy
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations
• Right to Restriction (Article 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Article 20): Receive your personal data in a structured, commonly used, machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests, including profiling and automated lead scoring
• Right Not to be Subject to Automated Decision-Making (Article 22): Not be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you
• Right to Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing
• Right to Lodge a Complaint: Lodge a complaint with your local supervisory authority (data protection authority) if you believe our processing violates the GDPR

To exercise any of these rights, contact us at hello@bytotalagent.com. We will respond within 30 days.

13.4 International Data Transfers

The Platform is hosted in the United States. Personal data transferred from the EEA, UK, or Switzerland to the United States is protected through the following mechanisms:

• Standard Contractual Clauses (SCCs): We rely on the European Commission's Standard Contractual Clauses (adopted June 2021) as the primary transfer mechanism for personal data transferred to the United States
• Supplementary Measures: We implement appropriate technical and organizational safeguards — including encryption in transit and at rest, access controls, and data minimization — to ensure an adequate level of protection for transferred data
• Subprocessor Transfers: Our subprocessors (listed in Section 15) who receive personal data from the EEA/UK are also bound by Standard Contractual Clauses or equivalent transfer mechanisms

13.5 Data Protection Officer Contact

For GDPR-related inquiries, you may contact our designated data protection point of contact at hello@bytotalagent.com with the subject line "GDPR Inquiry." We will respond within 30 days.

14. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Opt-Out of SMS: Reply STOP to any SMS message at any time
• Disconnect Email Integration: Disconnect your email account at any time from account settings, which immediately stops AGENTA email monitoring
• Disconnect Social Media: Disconnect connected social accounts at any time from account settings
• Opt-Out of Call Recording: Request calls not be recorded; this may limit certain Platform features
• Data Portability: Request a machine-readable copy of your data
• Withdraw Consent: Where processing is based on consent, withdraw at any time
• Opt-Out of Automated Lead Scoring: Request that automated lead scoring and AI prioritization features be disabled for your account or contact record
• Opt-Out of Tracking: Disable Meta Pixel tracking through browser settings, ad blockers, or by opting out through Meta's ad preferences at facebook.com/adpreferences

To exercise any of these rights, contact us at hello@bytotalagent.com.

15. Third-Party Services

The Platform integrates with third-party services. We are not responsible for the privacy practices of these providers. Current integrations include:

As the Platform adds new integrations — including MLS data providers, additional AI model providers, additional social platforms, and others — this table will be updated accordingly.

16. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect usage data, measure advertising effectiveness, and improve the Platform and our marketing website. This section provides detailed information about the specific technologies we use.

16.1 Essential Cookies

16.2 Analytics Technologies

16.3 Advertising and Tracking Technologies

The Meta Pixel transmits the following data to Meta Platforms, Inc.: your IP address, browser type and version, intelligence platform, referring URL, pages visited, actions taken (page views and lead form submissions), and a unique browser identifier. Meta may use this data for its own purposes as described in Meta's Privacy Policy. Under the CCPA, the operation of the Meta Pixel constitutes "sharing" of personal information for cross-context behavioral advertising.

16.4 How to Manage Cookies and Tracking

You can control cookies and tracking technologies through the following methods:

• Browser Settings: Configure your browser to refuse all or certain cookies. Note that disabling essential cookies may prevent Platform functionality
• Meta Ad Preferences: Opt out of Meta's interest-based advertising at facebook.com/adpreferences
• Ad Blocker Extensions: Use browser extensions that block tracking pixels and third-party cookies
• Digital Advertising Alliance: Opt out of interest-based advertising from participating companies at optout.aboutads.info
• Global Privacy Control (GPC): We honor GPC signals sent by your browser as a valid opt-out of sharing for CCPA purposes

Plausible Analytics does not use cookies and cannot be opted out of at the individual level, as it does not track or identify individual users.

17. Data Processing Agreement Framework

This section describes the framework under which Total Agent processes data on behalf of subscribing agents and business customers.

17.1 Role of Total Agent

Under the CCPA/CPRA, Total Agent acts as a "service provider" when processing personal information on behalf of subscribing agents. Under the GDPR, Total Agent acts as a "data processor" for contact and client data entered by subscribing agents (who act as "data controllers"). Total Agent processes this data solely to provide the Platform services as instructed by the subscribing agent.

17.2 Processing Instructions

Total Agent processes personal data only in accordance with the subscribing agent's instructions as embodied in: (a) the terms of service and subscription agreement, (b) this Privacy Policy, (c) the agent's configuration of Platform features and automation rules, and (d) any written instructions provided by the agent. Total Agent will not process personal data for any purpose other than providing the Platform services.

17.3 Subprocessor Management

Total Agent engages the subprocessors listed in Section 15 (Third-Party Services) to assist in providing Platform services. We will notify subscribing agents of any material changes to our subprocessor list by updating this Privacy Policy and, for material additions, providing at least 30 days' notice via email or in-Platform notification. Subscribing agents may object to a new subprocessor by contacting us within 15 days of notification; if we cannot reasonably accommodate the objection, the agent may terminate their subscription.

17.4 Audit Rights

Subscribing agents acting as data controllers may request, no more than once per 12-month period, reasonable information about Total Agent's data processing practices and security measures to verify compliance with this Privacy Policy and applicable data protection laws. Such requests should be submitted in writing to hello@bytotalagent.com. We will respond within 30 days and may satisfy audit requests through written responses, documentation, third-party audit reports, or certifications.

17.5 Breach Notification to Controllers

In the event of a personal data breach affecting data for which a subscribing agent is the data controller, Total Agent will notify the affected agent within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, the categories and approximate number of records affected, likely consequences, and measures taken or proposed to address the breach. This notification enables the subscribing agent to fulfill their own breach notification obligations to affected individuals and supervisory authorities.

17.6 Data Return and Deletion

Upon termination of a subscribing agent's account, Total Agent will, at the agent's election: (a) return all personal data to the agent in a structured, commonly used format, or (b) delete all personal data within 90 days of termination, except where retention is required by law (such as e-signature audit trails). Agents may make this election by contacting us at hello@bytotalagent.com.

18. Mobile Application

The Company intends to release a native mobile application (iOS and Android) as a future Platform feature. When available, the mobile application will collect additional data categories typical of mobile apps, including device identifiers, push notification tokens, and location data (if you grant permission). The mobile application's data practices will be governed by this Privacy Policy and any supplemental disclosures presented at the time of installation. Use of the mobile application may also be subject to the privacy policies of the applicable app marketplace.

19. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will take steps to delete such information promptly.

20. International Data Transfers

The Platform is hosted in the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Platform, you consent to the transfer of your information to the United States. For individuals located in the EEA, UK, or Switzerland, please see Section 13.4 for information about the specific transfer mechanisms we use to protect your data.

21. Data Localization

The following disclosures specify where key service providers process and store data:

• Supabase (Database): Primary data storage is in AWS us-east-1 region (Northern Virginia, United States). All Platform database records, including contact data, communication logs, and account information, are stored in this region.
• Twilio (Communications): SMS and voice data is processed primarily in the United States. Twilio may process communications data in additional regions based on the location of message recipients.
• Anthropic (AI Processing): AI model inference occurs in the United States. Data sent to Anthropic for AI processing is transmitted via encrypted API calls and is not retained by Anthropic beyond the processing session.
• Vercel (Application Hosting): The Platform application is hosted primarily in the United States, with edge network distribution globally for performance.
• Meta Platforms (Pixel): Data collected by the Meta Pixel is transferred to Meta's servers in the United States and other locations where Meta operates.
• Plausible Analytics: Analytics data is processed and stored in the European Union.

22. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. We do not currently respond to DNT signals as there is no standardized industry approach to DNT compliance. However, we do honor Global Privacy Control (GPC) signals as a valid opt-out of the "sharing" of personal information under the CCPA.

23. Changes to This Privacy Policy

We may update this Privacy Policy to reflect new Platform features, regulatory changes, or operational updates. We will notify you of material changes by posting the updated policy and updating the "Last Updated" date. For material changes, we will provide notice through the Platform or via email at least 30 days before the changes take effect. Continued use of the Platform after any modification constitutes acceptance of the updated policy.

24. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us:

• Email: hello@bytotalagent.com
• Company: Total Agent LLC
• Address: Palm Beach County, Florida

For GDPR-specific inquiries, use the subject line "GDPR Inquiry." For California privacy requests, use the subject line "California Privacy Request." For requests to limit use of sensitive personal information, use the subject line "Limit Use of Sensitive PI."

25. Document Version History