Privacy Policy

Last Updated: October 12, 2026

1. Introduction

This Privacy Policy describes how Tortus LLC ("Company," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Tortus platform (the "Platform").

The Platform provides real estate technology services to Consumers, Real Estate Professionals, and Brokerages, including property search (IDX/VOW), client collaboration, listing management (LMP), back-office analytics, website services, and third-party integrations (CRMs, email, calendars, phone dialers, and other business tools). This Privacy Policy applies to all users of the Platform.

By using the Platform, you consent to the practices described in this Privacy Policy.

Google User Data

This section explains how Tortus (the Tortus web and mobile applications, operated by Tortus LLC) accesses, uses, stores, shares, and deletes information it receives from Google APIs when you choose to connect a Google Account. It applies in addition to the rest of this Privacy Policy.

Google data we access

We request access only to the Google APIs below, only when you choose to connect them, and only to power the Tortus features described next to each:

Google Business Profile (business.manage) — reads your business profile and location information and lets you read and reply to your Google reviews from within Tortus.
Google Search Console (webmasters.readonly) — reads search-performance data for a website property you verify, to show that data in Tortus's website analytics.
Google Analytics 4 (analytics.readonly) — reads traffic and engagement data for an analytics property you authorize, to show that data in Tortus's website analytics.
Gmail (send, compose, read, modify, and settings, plus your Google Contacts) — sends, reads, and organizes email through your connected Gmail account from within Tortus, including creating a mail filter that routes parseable lead email to a label, and imports your Google contacts — including addresses Google has collected from mail you have sent, which is requested as a separate scope — so you can message them from Tortus. If you turn on email parsing for that mailbox, the content of inbound email is also used as described under "AI processing" below.
Google Drive (files Tortus creates, plus files or folders you explicitly choose through Google's file picker) — lets you save documents Tortus generates to your Drive and attach files you select from your Drive within Tortus.
Google Calendar (read and events) — shows your calendar inside Tortus and lets you create, update, and manage events, such as scheduled showings, from Tortus.
Google Sign-In (basic profile) — lets you sign in to Tortus with your Google Account; we receive your name, email address, and profile photo.

How we use Google data

We use information received from Google APIs only to provide the user-facing Tortus features described above, at your direction. We do not use it for advertising, we do not sell it, and we do not use it to build profiles for any purpose unrelated to those features.

AI processing. If you turn on email parsing for a connected Gmail mailbox, the text of an inbound email is sent to an AI model provider solely to classify and summarize it, detect requested follow-up actions, and extract lead information into your CRM. It is used only to provide these features to you. Information received from Google APIs is never used to develop, improve, or train generalized artificial intelligence or machine-learning models, by us or by that provider.

How we store and protect Google data

Google OAuth access and refresh tokens are stored encrypted. Data obtained through a Google connection is stored on access-controlled infrastructure and transmitted over encrypted (HTTPS) connections. Only personnel who need it to provide support, ensure security, or comply with law ever access it.

How we share Google data

We do not sell information obtained through Google APIs and we do not transfer it to third parties for advertising. We share it only as described in Section 5 of this Privacy Policy (for example, with the service providers who host the Platform, and with the AI model provider described above when you turn on email parsing), and only as needed to provide the features you use.

Retention and deletion of Google data

We retain a connection's tokens, and the data obtained through it, for as long as the connection stays active. Disconnecting an integration in Tortus revokes its access token; deleting your Tortus account deletes the stored access and refresh tokens. You can review and revoke Tortus's access to your Google Account at any time at https://myaccount.google.com/permissions, and you can ask us to delete information we obtained from Google APIs by emailing privacy@tortus.io.

Limited Use

Tortus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Information We Collect

2.1 Information You Provide

Account Information:

Name, email address, phone number
Password and account credentials
For Real Estate Professionals: license number, brokerage affiliation, MLS membership information
For Brokerages: company name, address, authorized contacts, domain information for website services

Profile Information:

Profile photo (optional)
Communication preferences
Search preferences and saved searches

Transaction-Related Information:

Property preferences (location, price range, property type)
Notes and comments on properties
Communications with your Real Estate Professional through the Platform

Listing Information (Real Estate Professionals using LMP):

Property details, descriptions, and specifications
Photographs, virtual tours, and media
Pricing and availability information
Where you use a listing-management or publishing feature we offer, this information is submitted directly to the applicable MLS

Payment Information (Real Estate Professionals and Brokerages):

Credit card or payment method details (processed by third-party payment processors)
Billing address
Transaction history

Business and CRM Information (Real Estate Professionals):

Contacts, leads, and client records you create, import, or sync (names, contact details, notes, tags, and activity history)
Communications you send or receive through the Platform — including email, SMS, calls, voicemails, and messages — and their content, transcripts, and metadata
Calendar events, tasks, deals, and transaction records
Documents and files you upload, including deal documents and electronic-signature records

Financial and Accounting Information (Real Estate Professionals):

Income, expense, commission, and transaction records you enter or import for back-office and accounting features
Receipts, invoices, and related financial documents
Connected financial-account information, where you enable such integrations (provided through third-party processors)

2.2 Information Collected Automatically

Usage Data:

Pages and listings viewed
Searches performed and search criteria used
Features used and actions taken
Time spent on the Platform
Click patterns and navigation paths
Links clicked and timestamps

Technical and Log Data:

IP address
Browser type, version, and settings
Device type, operating system, and unique device identifiers
Referring URLs and exit pages
Date and time of access
Error logs and performance data
Non-sensitive text entered in search fields

Device Information:

Hardware model and operating system version
Mobile network information (if applicable)
Screen resolution and display settings
Time zone and language preferences

Clickstream Data:

As you use the Platform, you leave a trail of electronic information. This "clickstream data" includes the type of device and browser you use, the address of the website from which you linked to the Platform, and your navigation path through the Platform. We use clickstream data to analyze how visitors use the Platform and to improve our services.

Location Information:

General location based on IP address
Precise location if you enable location services (with your consent)
We may derive your approximate location from other information, including your IP address, to provide location-relevant features and content

Cookies and Similar Technologies:

Session cookies for Platform functionality
Persistent cookies for preferences and authentication
Analytics cookies for usage analysis
See Section 3 below for detailed information on cookies and tracking technologies

2.3 Information from Third Parties

MLS Data:

Property listing information from REBNY RLS, OneKey MLS, and other participating MLSs
Broker and agent information from MLSs

Public Records:

NYC ACRIS documents (deeds, mortgages, UCC filings)
Property tax records
Department of Buildings permits and violations
Other government and public record sources

Your Real Estate Professional (for Consumers):

If you are a Consumer, your Real Estate Professional may provide information about you when inviting you to the Platform

Third-Party Integrations (for Real Estate Professionals):

If you connect third-party services (CRMs, email platforms, calendars, phone dialers), we may receive data from those services as necessary to provide the integration
This may include contact information, communication history, calendar events, and other data you choose to sync

3. Cookies and Tracking Technologies

3.1 What These Technologies Are

To operate the Platform and understand how it is used, we and selected partners use cookies and similar technologies. "Cookies" are small text files placed on your device; we also use browser "local storage" (similar to cookies, but not transmitted with every request) and, mainly in our emails, "pixel tags" / "web beacons" (small images used to measure opens and engagement). Some are strictly necessary for the Platform to function, while others are used for analytics or, where enabled, advertising measurement.

3.2 Cookies and Local Storage We Use

The table below describes the cookies and local-storage identifiers we set directly ("first-party"), and the third-party services that may set their own cookies when you use the related feature. Specific names and durations may change as we update the Platform.

Name / Provider	Category	Purpose	Duration
Authentication & session cookies (Tortus)	Strictly necessary	Keep you signed in and maintain your session.	Session / login period
`csrf_token` (Tortus)	Strictly necessary	Security — prevents cross-site request forgery on account and form actions.	Session
Cookie-consent & display preferences (Tortus, local storage)	Strictly necessary	Remembers your cookie-banner choice and display settings (e.g., theme).	Until cleared
`tortus_vid` (Tortus)	Analytics (first-party)	Distinguishes unique viewers of shared content and Platform pages so engagement can be counted without double-counting. Stores no raw IP address.	~12 months
`tortus_embed_vid` (Tortus, local storage)	Analytics (first-party)	Distinguishes unique visitors within an embedded search widget hosted on a brokerage's own website.	Until cleared
`__stripe_mid`, `__stripe_sid` (Stripe, Inc.)	Functional / fraud-prevention	Payment fraud prevention; set only on pages where you make a payment.	Session – 12 months
Turnstile (Cloudflare, Inc.)	Functional / security	Bot and abuse protection on forms and sign-in.	Session
Google Maps (Google LLC)	Functional	Renders interactive maps where shown.	Per Google
Sign-in SDKs — Google, Apple, Microsoft, Meta	Functional	Authenticate you only if you choose that social sign-in option.	Per provider
Plaid (Plaid Inc.)	Functional	Identity and asset verification within rental applications, when that feature is used.	Per Plaid
Google Analytics 4 (Google LLC)	Analytics (third-party) — when enabled	Aggregate usage and traffic analytics. Off unless enabled for a given deployment.	Per Google
Google Ads (Google LLC)	Advertising (third-party) — when enabled	Ad-conversion measurement and remarketing. Off unless enabled.	Per Google
Meta Pixel (Meta Platforms, Inc.)	Advertising (third-party) — when enabled	Ad-conversion measurement and audience building. Off unless enabled.	Per Meta
Session recording (Tortus, self-hosted) and PostHog, Inc.	Analytics (first-party, with a processor)	Records a replay of your visit — pages viewed, clicks, scrolling, and the page content as displayed — so we can diagnose problems and improve the Platform. Text you type is masked; passwords and payment fields are never captured. See Section 3.8.	90 days

3.3 Tracking of Shared Content

Real estate professionals can share content with you through the Platform — for example, a market report, listing presentation, or property comparison sent by your agent through a link. When you open one of these shared links, we record that it was viewed so the professional who shared it can see aggregate engagement. For each view we store a one-way SHA-256 hash of your IP address (we never store the raw IP), your device type (desktop, mobile, or tablet), the referring domain, and a first-party visitor identifier (the tortus_vid cookie) used only to distinguish unique viewers. We do not use this information to build advertising profiles. See Sections 4.6 and 5.1 for how your real estate professional may access this activity.

3.4 Analytics and Advertising Partners

Depending on how a particular Tortus deployment is configured, we may enable third-party analytics and advertising tags — Google Analytics 4 and Google Ads (Google LLC) and the Meta Pixel (Meta Platforms, Inc.) — to measure traffic and the effectiveness of our marketing. These tags are off by default and are not enabled on all deployments. When enabled, these partners may receive information sent by your browser or device, including your IP address and the pages you visit, subject to their own privacy policies. You can opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout, manage Google ad personalization at https://adssettings.google.com, and manage Meta ad preferences in your Meta account settings.

3.5 Pixel Tags and Web Beacons

We may use "pixel tags," "web beacons," "clear GIFs," and similar technologies, primarily in our emails. These are small electronic images (often a single pixel) that are not visible to users and may be associated with cookies. We use these tools to:

Compile aggregate statistics about Platform usage
Measure the effectiveness of our communications
Determine whether and when emails have been opened

3.6 Your Cookie Choices

Most browsers let you refuse or delete cookies and clear local storage, and you can use private/incognito browsing. Strictly necessary cookies cannot be switched off without breaking core features such as staying signed in. For analytics and advertising choices, use the partner opt-outs listed above and see Section 9.3. If you disable cookies, some Platform features may not function properly.

3.7 Do Not Track Disclosure

Some web browsers have a "Do Not Track" (DNT) feature that signals you do not wish to be tracked. At this time, the Platform does not respond to DNT signals. You can manage your choices as described above and, if you are a California resident, exercise the rights described in Section 9.5.

3.8 Session Recording

To diagnose problems, respond to support requests, and improve the Platform, we record and replay browsing sessions. A recording reconstructs the page as it appeared and what you did on it — the pages you viewed, clicks, scrolling, mouse movement, and the content displayed. Recording uses a recorder we host ourselves and, as an independent second copy, PostHog, Inc. acting as our processor (configured for session recording only). We do not record your screen, your camera, or any activity outside the Platform.

What is masked. Text you type into form fields is masked by default and is not captured. Passwords are never captured. Payment card fields are rendered by Stripe and are excluded from recording, as are other third-party frames such as sign-in windows. We do not intend to capture sensitive personal information; if you believe a recording captured something it should not have, contact us using Section 14 and we will delete it.

Where recording applies.

Signed-in Tortus applications. Recording is part of the Service for authenticated users and is disclosed here and in our Terms of Service.
Our marketing website (tortus.io). Recording runs only if you accept analytics cookies in our banner, and not if you decline. See Section 3.6.
Real Estate Professional websites we host. Recording runs only where that Real Estate Professional has enabled it for their site and the visitor has accepted analytics cookies on that site. The recording is available to that Real Estate Professional, who determines how their own visitors’ information is used.

Retention. Recordings are deleted automatically after 90 days. A recording flagged for a specific open investigation (for example, an active support ticket) is kept only for as long as that purpose requires.

4. How We Use Your Information

4.1 Provide and Operate the Platform

Create and maintain your account
Provide property search and listing services (IDX/VOW)
Enable Real Estate Professionals to invite and collaborate with clients
Process listing submissions directly to MLSs (LMP)
Generate analytics, market reports, CMAs, and performance metrics (Back-Office)
Provide website domain connection services (IDX)

4.2 Artificial Intelligence and Machine Learning

We use artificial intelligence and machine learning ("AI/ML") technologies to power and improve Platform features. Depending on the feature, these may include property recommendations, automated valuations, market and comparative analysis, listing content generation, image and document understanding, summarization of communications, and similar enhancements.

To provide these features, we process information you provide and information generated through your use of the Platform. Depending on the feature, this may include your searches, saved properties, and preferences; listing information and associated media; and the content of communications and documents you submit. We process only the information needed for the specific feature, and we apply internal controls that limit how sensitive and regulated information is used.

Some AI/ML processing is performed with the assistance of established third-party AI service providers. Where we use such providers, we do so under contractual data-protection agreements, and we configure our accounts so that these providers do not use your information to train or improve their own models. We route sensitive or regulated information only to providers covered by these agreements.

We may use information processed through the Platform to develop, train, and improve our own models and features (for example, valuation and analytics models). Our own models and the data used to build them are maintained within our own systems.

For information about how long AI-related information is retained, see Section 7 (Data Retention).

4.3 Improve the Platform

Analyze usage patterns and trends
Develop new features and services
Troubleshoot technical issues
Conduct research and analysis

4.4 Communications

Send transactional emails (account confirmations, password resets, client invitations)
Provide customer support
Send Platform updates and announcements
Send marketing communications (with your consent, where required)

4.5 Compliance and Protection

Comply with MLS rules and audit requirements
Enforce our Terms of Service
Protect against fraud, abuse, and security threats
Comply with legal obligations

4.6 Agent Access to Consumer Activity

If you are a Consumer using VOW features, your Real Estate Professional will have access to information about your Platform activity, including:

Properties you have viewed and saved
Searches you have performed
Notes and comments you have made
Login history and usage patterns

This access enables your Real Estate Professional to provide you with better service. By using the Platform, you consent to this access.

5. How We Share Your Information

5.1 With Your Real Estate Professional (Consumers)

If you are a Consumer invited by a Real Estate Professional, we share your information with that Real Estate Professional, including your contact information and Platform activity as described in Section 3.6.

5.2 With Brokerages (Real Estate Professionals)

If you are a Real Estate Professional, we share your information with your affiliated Brokerage as needed for Platform administration, compliance, and analytics.

5.3 With MLSs

In most cases we receive listing and related data from participating MLSs to display on the Platform; we do not publish or push listing data back to an MLS except where we expressly offer listing-management or listing-publishing features. Where we do offer such features, the listings you create or modify are submitted directly to the applicable MLS. We also share information with participating MLSs as required by their rules and policies, including:

Listing information you submit through any listing-management or publishing feature we offer (submitted directly to the applicable MLS)
Audit trail data (user logins, searches, listing views) as required for compliance
User verification information

5.4 With Service Providers

We share information with third-party service providers who perform services on our behalf, including:

Cloud hosting and data storage
Payment processing
Email delivery
Analytics
Customer support
Domain and SSL services (for website services)
Artificial intelligence and machine learning processing

Service providers are contractually obligated to protect your information and to use it only to provide services to us. Where service providers process information using artificial intelligence, they are contractually prohibited from using your information to train or improve their own models.

5.5 White-Label Partners

When the Platform is provided on a white-label basis to a Brokerage, team, or individual real estate professional, consumer data is shared with that white-label partner as the primary service provider. The Platform displays "Powered by Tortus" attribution.

5.6 Third-Party Integrations

If you enable third-party integrations (CRMs, email platforms, calendars, phone dialers, etc.), we share data with those connected services as necessary to provide the integration functionality. This may include:

Contact and client information
Property and listing data (subject to MLS restrictions)
Communication history and notes
Calendar events and appointments
Activity and transaction data

You control which integrations are enabled and can disconnect them at any time. Once data is shared with a third-party service, it is governed by that service's privacy policy. We recommend reviewing the privacy policies of any third-party services you connect.

Google API Services. How we access, use, store, share, and delete information received from Google APIs is described in Google User Data above.

5.7 For Legal Reasons

We may disclose information:

To comply with laws, regulations, or legal process
To respond to lawful requests from government authorities
To protect our rights, privacy, safety, or property
To enforce our Terms of Service
In connection with MLS audits and compliance investigations

5.8 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5.9 User-Generated Content and User-Controlled Sharing

You may elect to share certain information with other users or with the public through your use of the Platform. For example:

Notes, comments, or tags you add to properties may be visible to your Real Estate Professional or team members
If you use communication features, recipients will see your message content and contact information
If you share market reports or other content externally, recipients will have access to that content

You control such sharing via settings that we provide. Always use caution when sharing information through the Platform. We are not responsible for the actions of other users or third parties with whom you share information.

5.10 With Your Consent

We may share your information for other purposes with your consent.

6. MLS Audit Trail Requirements

Participating MLSs require us to maintain audit trails of user activity. We collect and retain the following information for MLS compliance purposes:

For VOW Users (Consumers):

Registration date and time
Invitation source (inviting Real Estate Professional)
Email verification status
Login and logout timestamps
IP addresses
Searches performed
Listings viewed
Terms acceptance records (including the version accepted)
Any other information required by participating MLSs for compliance and auditing

For Real Estate Professionals:

Account activity logs
Listing submission and modification history (LMP)
Client invitation records
Data access logs

This information may be accessed by participating MLSs and their authorized representatives during compliance audits. By using the Platform, you authorize such access.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We also retain information as necessary to:

Comply with legal obligations
Resolve disputes
Enforce our agreements
Meet MLS audit requirements

After account termination, we retain certain information for the periods required by applicable MLS rules and regulations, applicable law, and legitimate business purposes.

8. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption of data in transit and at rest
Access controls and authentication
Regular security assessments
Employee training

However, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

9. Your Rights and Choices

9.1 Account Information

You may access, update, or correct your account information at any time through the Platform settings.

9.2 Communication Preferences

You may opt out of marketing communications by following the unsubscribe instructions in our emails or updating your preferences in the Platform.

9.3 Cookies

You may control cookies through your browser settings. Note that disabling cookies may affect Platform functionality.

9.4 Account Deletion

You may request deletion of your account by contacting us at privacy@tortus.io. Note that:

Some information may be retained for legal or compliance purposes
Information shared with MLSs or your Real Estate Professional may be retained by them
Audit trail data may be retained as required by MLS rules
Listing information submitted to MLSs is governed by MLS policies

9.5 California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Your Rights:

Right to Know: You may request information about the categories of personal information we collect, the purposes for collection, and the categories of third parties with whom we share your information
Right to Access: You may request a copy of the specific personal information we have collected about you in the prior 12 months
Right to Delete: You may request deletion of your personal information, subject to certain exceptions
Right to Correct: You may request that we correct inaccurate personal information we maintain about you
Right to Opt Out of Sale/Sharing: You may opt out of the sale or sharing of your personal information. We do not sell personal information for monetary consideration. If we share personal information for targeted advertising purposes, you may opt out
Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to purposes necessary to provide the services
Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

How to Exercise Your Rights:

To exercise your rights, contact us at privacy@tortus.io or submit a request through the Platform. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

California "Shine the Light" Law:

California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. If you have questions, contact us at privacy@tortus.io.

Categories of Personal Information Collected:

In the preceding 12 months, we may have collected the following categories of personal information: identifiers (name, email, IP address), commercial information (transaction history), internet activity (browsing history, search history), geolocation data, professional information (real estate license), and inferences drawn from the above.

9.6 International Users

If you are accessing the Platform from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where our servers are located. The data protection laws of the United States may differ from those of your country of residence.

By using the Platform, you consent to the transfer of your information to the United States and the use and disclosure of your information in accordance with this Privacy Policy. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we will comply with applicable legal requirements for transferring personal information to countries outside of those regions.

9.7 Other Jurisdictions

Depending on your location, you may have additional rights under applicable privacy laws, including the EU General Data Protection Regulation (GDPR). These may include the right to access, rectify, erase, restrict processing, data portability, and to lodge a complaint with a supervisory authority. Contact us at privacy@tortus.io to learn more or exercise your rights.

10. Third-Party Services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access.

The Platform uses third-party service providers for various functions. Categories include cloud infrastructure, analytics, payment processing, email services, domain/SSL services, and artificial intelligence model providers. These providers act on our behalf under contractual data-protection agreements. A current list of key sub-processors is available on our security page and on request.

11. Fair Housing

We conduct our business in accordance with all federal, state, and local fair housing laws. It is our policy to provide housing opportunities to all persons regardless of race, color, religion, sex, familial status, handicap, national origin, sexual orientation, or gender identity. We do not knowingly allow our Platform to be used in any manner that would violate fair housing laws.

12. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected such information, we will make efforts to delete it in accordance with applicable law, including the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided personal information to us, please contact us at privacy@tortus.io.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last Updated" date. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

14. Contact Information

For questions about this Privacy Policy or our privacy practices, please contact us at:

Email: privacy@tortus.io

Address:

Tortus LLC

800 Third Ave Frnt A #1006, New York, NY 10022

15. Data Sources Attribution

Data displayed on the Platform is sourced from:

REBNY Residential Listing Service (RLS): This information is not verified for authenticity or accuracy and is not guaranteed and may not reflect all real estate activity in the market. © 2026 The Real Estate Board of New York, Inc., All rights reserved.

OneKey MLS: Listing data is the property of OneKey MLS, LLC and/or its participants.

Other Multiple Listing Services: Listing data may also be sourced from other participating MLSs, subject to their respective rules, terms, and required attributions.

Public Records: Publicly available government and property records, including deeds, mortgages and other recorded instruments, assessment and tax records, building permits, and violations, sourced from county and municipal recording offices and other government sources across the jurisdictions we serve. Public records may contain errors, omissions, or outdated information as originally filed.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.