Privacy Policy — OpusStack

OpusStack LLC

Effective Date: September 3, 2026
Last Updated: September 3, 2026

OpusStack LLC (“OpusStack,” “we,” “our,” or “us”) operates the OpusStack platform, an AI-powered real estate operating system built on persistent intelligence (OpusOS) (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service, including our website at www.opusstack.ai and any associated software, applications, or services.

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, do not use the Service.

This Policy is intended for users in the United States.

1. Information We Collect

1.1 Information you provide

We collect information you voluntarily provide when you:

Create or manage an account: name, email address, phone number, business name, business address, role or title, organization or workspace name, and authentication credentials.
Complete a purchase or reservation: billing name, payment-method tokens processed by our payment provider, plan selection, seat quantity, optional add-ons, and related transaction records. We do not store full payment-card numbers on OpusStack systems when a payment processor handles checkout.
Upload or create content: real estate transaction and business materials you choose to provide, which may include contracts, letters of intent, amendments, leases, listings, title materials, financial statements, reports, rent rolls, correspondence, notes, briefs, and other deal- or client-related files.
Provide operational information: property information, parties and contacts, deal terms, milestones, dates, tasks, and notes.
Communicate with us: support requests, sales or Charter inquiries, feedback, and other correspondence.
Connect third-party services: authorization tokens and metadata when you connect email, calendar, CRM, meeting tools, or other integrations you enable.

1.2 Information from connected systems

When you connect a third-party account, we may receive information that system makes available under your authorization. Depending on the connection and your settings, this may include emails and message metadata, calendar events, contacts, meeting information, files, and other records related to your real estate work.

We only request access consistent with providing the Service. The exact integrations available at any time are those presented in the product. This Policy does not promise any specific integration.

1.3 Information collected automatically

When you use the Service, we may automatically collect:

Usage data: pages and features used, actions taken, workspace context, session duration, and timestamps.
Device and technical data: IP address, browser type, operating system, device identifiers, and access times.
Log and diagnostic data: server logs, error reports, and performance information.

1.4 Information about other people

Real estate work often includes information about clients, prospects, counterparties, other brokers, lenders, attorneys, title companies, vendors, and other participants. If you upload, connect, or input that information, we process it as part of providing the Service to you and your organization. You are responsible for having the right to provide it.

2. How We Use Information

We use the information we collect to:

Provide, operate, maintain, and secure the Service.
Create and maintain an evolving operational understanding of your transactions and workspace, including documents, communications, people, dates, obligations, and risks, as functionality available to you permits.
Process documents and communications using artificial intelligence to extract and reconcile information, generate summaries and briefs, identify possible risks and next actions, prepare draft work, and respond to requests such as Ask Opus.
Operate workspaces, seats, permissions, and invited users.
Process subscriptions, Charter reservations, add-ons, invoices, and support.
Communicate about your account, transactions you follow in the Service, product updates, and (where permitted) service-related or marketing messages.
Send SMS only as described in Section 6.
Monitor usage, prevent fraud and abuse, debug, and improve the Service.
Comply with law and enforce our Terms of Service.

We do not sell your personal information.

3. AI Processing

OpusStack uses artificial intelligence, including large language models and related orchestration, to process information in your workspace.

Processing to provide the Service is not the same as training general AI models.

We process your documents, communications, and workspace data to deliver OpusStack functionality to you and users you authorize.
We do not use your User Content, uploaded documents, connected-mailbox content, or deal information to train OpusStack’s foundation models or third-party foundation models.
We may use third-party AI providers to process data on our behalf solely to provide the Service. Those providers are required by contract not to use that customer content to train their general models, except as their then-current customer terms for the specific processing arrangement require. If a provider’s terms change, we will review them and update this Policy if needed.
AI outputs (summaries, extractions, risk flags, drafts, suggested next steps, and similar) are informational. They can be incomplete or wrong. They are not legal, financial, tax, appraisal, or brokerage advice. You must verify material outputs before you rely on them.

4. How We Share Information

We share information only as described below.

4.1 Service providers

We share information with vendors who help us operate the Service, under contracts that require appropriate handling of the data. Our current key providers include:

Stripe: payment processing for checkout, Charter reservations, and recurring subscription charges. Card numbers are handled by Stripe, not stored in full on OpusStack systems.
Twilio: processing and delivery of SMS communications if you opt in. Twilio is not our payment processor.
Anthropic: AI processing on our behalf.
Supabase: database hosting, authentication, and file storage.
Vercel: application hosting.
Google: OAuth and Google services you choose to connect.

We may use additional processors as the Service evolves. We will not list a vendor here unless we actually use them.

4.2 SMS

We do not share, sell, rent, or transfer your phone number or SMS opt-in data to any third party or affiliate for their marketing. Numbers collected for SMS are used to deliver messages you requested and are processed through Twilio only for that purpose.

4.3 Organization / workspace sharing

If you join or create a workspace, authorized members of that workspace may see information you add or that is connected into that workspace, subject to permissions.

4.4 Legal

We may disclose information if required by law, legal process, or government request, or if we believe in good faith it is necessary to protect rights, safety, or the security of the Service.

4.5 Business transfers

If OpusStack is involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. We will notify you before information becomes subject to a different privacy policy where required.

4.6 With your consent

We may share information for other purposes with your explicit consent.

5. Security

We use administrative, technical, and organizational measures designed to protect information, including:

encryption in transit (TLS/SSL);
encryption at rest on supporting infrastructure;
authentication and access controls;
workspace-level permissions where enabled;
OAuth-based connections you authorize;
vendor agreements requiring appropriate protections.

Infrastructure providers (including Supabase) may maintain their own security programs and certifications. OpusStack itself does not claim SOC 2 or similar certification in this Policy unless and until OpusStack has obtained it.

No method of transmission or storage is completely secure. You are responsible for protecting your credentials and for configuring workspace access thoughtfully.

6. SMS and Other Communications

6.1 SMS (optional)

The Service includes optional SMS alerts. If this feature is enabled for your account and you opt in, you consent to transactional SMS from OpusStack, delivered by Twilio, such as deal or milestone alerts, analysis or report notices, and account activity related to your use of the Service.

Opt-in occurs when you check an unchecked box at signup or enable SMS in Settings, including language substantially as follows: you consent to SMS related to your transactions, deal updates, and account activity; message and data rates may apply; reply STOP to unsubscribe.

Opt-out: reply STOP to any message, or disable SMS in Settings. We will stop promotional or alert SMS to that number as required. Reply HELP for support information.

OpusStack does not charge for SMS. Carrier rates may apply. Frequency depends on your activity and settings.

SMS opt-in is optional. You may use the Service without it.

We do not treat SMS opt-in as consent for unrelated third-party marketing.

6.2 Email and in-product messages

We send transactional email (receipts, security, product notices). If we send marketing email, we will provide an unsubscribe method and honor it. Separate consent will be used where law requires it.

7. Retention

We retain information as follows, subject to legal holds:

Active accounts and workspaces: for as long as the account or workspace remains active and as needed to provide the Service.
After you delete an account or request deletion: we will delete or de-identify personal information and User Content from production systems within a commercially reasonable period, except data we must keep for legal, tax, accounting, dispute, or security purposes.
Backups: residual copies may remain in encrypted backups for a limited backup cycle before they rotate out.
Billing and transaction records: retained as reasonably required for tax, accounting, fraud prevention, and legal compliance.
Aggregated or de-identified data: may be retained for analytics and Service improvement if it cannot reasonably be linked back to you.

8. Your Rights and Choices

Depending on your location, you may have rights to:

access a copy of personal information we hold about you;
correct inaccurate information;
request deletion, subject to legal exceptions;
request a portable copy where applicable;
withdraw consent where we rely on consent;
opt out of marketing;
appeal a denial of a request where state law provides that right.

To exercise rights, email privacy@opusstack.ai. We will verify the request and respond within the time required by applicable law.

California and other U.S. state privacy laws. If you are a resident of California or another state with a consumer privacy statute, you may have additional rights to know, delete, correct, and opt out of “sale” or “sharing” of personal information as those terms are defined by statute. OpusStack does not sell personal information and does not share it for cross-context behavioral advertising as those terms are commonly defined. Authorized agents may submit requests as permitted by law. We will not discriminate against you for exercising privacy rights.

These rights apply to *your* personal information. They do not automatically let one workspace member export or delete another member’s account or an organization’s entire deal file without proper authority.

9. Cookies

We use cookies and similar technologies to operate the Service, keep you signed in, and understand usage. You can control cookies in your browser. Disabling some cookies may break login or core features.

10. Children

The Service is not for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it. Contact privacy@opusstack.ai if you believe this has occurred.

11. International users

OpusStack operates in the United States and stores data in the United States. The Service is intended for U.S. users. If you access it from elsewhere, you understand information is processed in the United States.

12. Third-party services

The Service may link to or connect with third-party sites and tools. Their privacy practices govern data they hold. Review their policies before connecting an account.

13. Changes

We may update this Policy. The “Last Updated” date will change, and we will provide additional notice for material changes where appropriate (email or in-product). Continued use after an update means you accept the revised Policy.

14. Contact

OpusStack LLC
3575 Katherine Way
Frederick, MD 21704
United States

Privacy: privacy@opusstack.ai
Website: www.opusstack.ai