PRIVACY POLICY

Effective Date: _________________________

This Privacy Policy describes how Production Labs, LLC, a North Carolina limited liability company doing business as "Production OS" and "Agent Growth OS" ("Production Labs," "we," "us," or "our"), collects, uses, and discloses information when you use our website at agentgrowthos.com, the application at dashboard.agentgrowthos.com, our mobile applications, and related services (collectively, the "Service").

If you are a customer using the Service to manage your real estate practice's data about your contacts and prospects, you are the data controller of that data, and Production Labs acts as the data processor on your behalf. The Data Processing Addendum at /dpa governs that relationship.

1. SCOPE AND DEFINITIONS

This Privacy Policy applies to:

• Visitors to our public websites.
• Customers who have signed up for a paid Subscription or trial.
• Authorized Users of our customers (e.g., agents within a brokerage that purchased Production OS).
• Prospects who provide information through forms on our public websites (e.g., the PI Self-Scan, contact forms).

This Privacy Policy does NOT govern data you, as a customer, enter into the Service about your own contacts and prospects — that is governed by your own privacy policy and our Data Processing Addendum.

2. INFORMATION WE COLLECT

2.1 Information You Provide

• Account information: name, email address, password (hashed), business name, phone number, brokerage affiliation, billing address, and payment method (processed by Stripe; we do not store full card numbers).
• Subscription preferences: archetype, production strategy, KPI targets, habit configurations, and similar settings.
• Customer Data: content you upload, type, dictate, or otherwise submit to the Service in the course of using it (contacts, calendar events, notes, documents, communications, etc.). For Customer Data, you are the data controller; see the Data Processing Addendum.
• Communications: support requests, feedback, survey responses, and other communications you send us.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, time-stamped events, click paths, session duration, referring URL.
• Device and connection data: IP address, browser type and version, operating system, mobile device identifiers, language preferences.
• Cookies and similar technologies: see Section 7.

2.3 Information From Third Parties

• Integration data: when you connect a third-party service (Calendly, Google Calendar, FollowUpBoss, etc.), we receive data from that service to the extent you authorize.
• Payment processor: Stripe shares transaction status, fraud signals, and partial payment-method information with us.
• Authentication providers: if you sign in via a third-party identity provider, we receive your verified email and basic profile information.

2.4 Information We Do Not Knowingly Collect

We do not knowingly collect personal information from anyone under the age of 18. If you become aware that a child has provided personal information to us, please contact us at admin@agentgrowthos.com and we will take prompt steps to delete it.

3. HOW WE USE INFORMATION

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Process payments and manage subscriptions;
• Authenticate users and prevent unauthorized access;
• Send transactional communications (welcome emails, receipts, password resets, security alerts);
• Send service announcements, product updates, and (where you have opted in) marketing communications;
• Provide customer support and respond to your requests;
• Monitor and analyze usage for product improvement, capacity planning, and security;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our Terms of Service;
• Personalize content, recommendations, and the AI Assistant's behavior; and
• Generate aggregated, de-identified statistics and benchmarks.

3.1 Legal Bases (for users in jurisdictions requiring this disclosure)

Where applicable law (such as GDPR) requires a legal basis for processing, we rely on: (a) performance of a contract (to provide the Service); (b) legitimate interests (to improve, secure, and develop the Service); (c) consent (for optional marketing or where required); and (d) legal obligation.

4. HOW WE SHARE INFORMATION

We do not sell personal information.

We share information only as follows:

4.1 Service Providers (Subprocessors)

We share information with carefully selected vendors that help us operate the Service. Current subprocessors include:

• Stripe, Inc. — payment processing
• Anthropic PBC — the AI assistant (Claude), processes your chat messages and workspace context to generate responses
• OpenAI, LLC — voice transcription (Whisper) and spoken replies (TTS), only when you use the mic button or enable voice replies
• GoHighLevel — backend CRM infrastructure for some customer workspaces
• Neon — cloud database hosting
• Railway — application hosting and deployment infrastructure
• Twilio — SMS and voice communications, where enabled
• Postmark / Resend — transactional email delivery
• Tavily — AI web research, where enabled
• Rewardful — affiliate tracking, where you enroll in the affiliate program
• Calendly, Google, FollowUpBoss, Mailchimp, ActiveCampaign, Constant Contact, DocuSign, Dotloop — integrations you have authorized

We will publish an updated subprocessor list on the Service from time to time. Material changes will be communicated with reasonable advance notice.

4.1a Third-Party AI Processing

Some features of Production OS — the assistant, voice input and replies, and the assistant's web-research tool — rely on third-party AI services. We ask for your explicit in-app permission before any of these features send data to those services. You can review this consent moment at any time by signing out and back in, or by contacting us to reset it.

What we send, to whom:

• Anthropic PBC (San Francisco, CA, USA) — powers the assistant. When you use the assistant, we send your chat message, attached files or images, and the workspace context the assistant needs to answer (relevant contacts, deals, tasks). We never send authentication passwords or payment card details.
• OpenAI, LLC (San Francisco, CA, USA) — powers voice transcription (Whisper) and spoken replies. When you press the mic button, we send the audio recording. When you have voice replies enabled, we send the text of the assistant's reply. We do not send anything to OpenAI unless you actively invoke a voice feature.
• Tavily Research, Inc. (USA) — powers the assistant's web-research tool, only when the assistant needs to look something up online during a conversation. In that case, the specific search query is sent to Tavily.

Data protection commitments. Anthropic, OpenAI, and Tavily each contractually commit that customer inputs are not used to train their models, and that inputs are retained only for the operational window needed to generate the response and support abuse-monitoring. Their published data-handling terms are here:

• Anthropic — https://www.anthropic.com/legal/commercial-terms
• OpenAI — https://openai.com/enterprise-privacy
• Tavily — https://tavily.com/privacy

Withdrawing consent. You may withdraw your AI-processing consent at any time by contacting admin@getproductionos.com. When you withdraw consent, the assistant, voice features, and web research tool become unavailable until you re-enable them. Other features of Production OS remain fully functional.

4.2 Within Your Brokerage

If you are using the Brokerage tier, certain information may be visible to your broker-in-charge or team leader as part of compliance and supervision features. This visibility is set when your brokerage account is provisioned.

4.3 Legal Compliance

We may disclose information to comply with legal process (e.g., subpoenas, court orders), respond to lawful government requests, enforce our Terms, or protect the rights, property, or safety of Production Labs, our customers, or others.

4.4 Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred to the successor entity, subject to commitments at least as protective as this Privacy Policy.

4.5 With Your Consent

We will share information with other parties only when you have consented to that sharing.

5. INTEGRATIONS WITH THIRD-PARTY SERVICES

When you connect a Third-Party Service (e.g., authorize Calendly or Google Calendar via OAuth), data flows between us and that service at your direction. Each Third-Party Service has its own privacy policy that governs its handling of your data. You should review those policies. Disconnecting a Third-Party Service stops the future flow of data but does not retroactively delete previously received data.

6. INTERNATIONAL DATA TRANSFERS

Production Labs is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or in other countries where we or our subprocessors operate. By using the Service, you consent to this transfer. Where required (e.g., for EU residents), we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

7. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for:

• Authentication (essential — keeps you signed in).
• Security (essential — detects fraudulent or anomalous behavior).
• Preferences (e.g., remembered settings).
• Analytics (to understand usage and improve the Service).
• Affiliate tracking (Rewardful cookie set on landing pages where applicable).

You can control cookies through your browser settings. Disabling essential cookies will prevent the Service from functioning.

8. DATA RETENTION

We retain personal information only as long as necessary to provide the Service and fulfill the purposes described in this Policy, except where a longer retention period is required by law (e.g., tax records).

• Account data: retained while your account is active, and for a reasonable period after termination for billing reconciliation, security, dispute resolution, and legal compliance.
• Customer Data: retained per the Terms of Service. After termination, you may export Customer Data within thirty (30) days; we then delete from active systems, with deletion from backups occurring in the ordinary backup rotation (typically within ninety (90) days).
• Logs and usage data: retained for up to twelve (12) months for security and operational monitoring, then deleted or anonymized.
• Marketing data: retained until you unsubscribe.

9. SECURITY

We implement administrative, technical, and physical safeguards including:

• Encryption in transit (TLS) and encryption at rest for sensitive data.
• Role-based access control with least-privilege defaults.
• Logging and alerting for unusual access patterns.
• Hashed credentials (never storing plaintext passwords).
• Regular security review of subprocessors and internal practices.
• Sandboxed processing of AI Assistant requests with rate limits.

No system is perfectly secure. You are responsible for protecting your own account credentials. If you suspect unauthorized access, contact us immediately at admin@agentgrowthos.com.

10. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the following rights with respect to personal information about you that we hold:

• Access: request a copy of the information we have about you.
• Correction: request correction of inaccurate information.
• Deletion: request deletion of your personal information, subject to lawful retention exceptions.
• Portability: receive a copy of certain information in a structured, machine-readable format.
• Objection / Restriction: object to or restrict certain processing.
• Withdraw Consent: where processing is based on consent, withdraw that consent at any time.
• Marketing Opt-Out: unsubscribe from marketing emails using the link in the message, or by contacting us.

To exercise these rights, email admin@agentgrowthos.com. We will respond within the time period required by applicable law. We may need to verify your identity before responding.

10.1 California Residents

California residents have specific rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including:

• The right to know what categories of personal information we collect, the sources, purposes, and categories of third parties with whom it is shared (covered in Sections 2-4 above).
• The right to delete personal information.
• The right to correct inaccurate information.
• The right to opt out of "sale" or "sharing" of personal information. Production Labs does not sell or share personal information for cross-context behavioral advertising.
• The right to limit use of sensitive personal information.
• The right to non-discrimination for exercising privacy rights.

To exercise these rights, email admin@agentgrowthos.com. You may also designate an authorized agent to act on your behalf (we may require verification of authority).

10.2 European Residents

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under GDPR similar to those described above. Our legal bases are described in Section 3.1. You also have the right to lodge a complaint with a supervisory authority.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. The "Effective Date" at the top will reflect the most recent update. Material changes will be communicated by email or in-app notice at least thirty (30) days before they take effect.

12. CONTACT

For questions or to exercise your rights, contact us at:

Production Labs, LLC

_[Mailing Address]_

admin@agentgrowthos.com

_End of Privacy Policy_