Platform Privacy Policy

1. Who we are and what this policy covers

Brelos, Inc. ("Brelos," "we," "us") is a Delaware corporation. This policy covers the Brelos platform: the application at app.brelos.ai, the emails it sends, and the support we give to customers who use it (together, the "Platform"). Our public website at brelos.ai has its own Privacy Policy.

A customer is the building owner or firm that signs up for the Platform. Each customer has an agreement with us: our Platform Customer Terms, a signed order form, or both. If that agreement says something different from this policy, the agreement controls.

Account information. For information about who signs in and how they use the Platform, Brelos decides how the information is used and is responsible for it under this policy.

Customer content. For the leases, bank files, tenant information and other documents a customer uploads, and everything the Platform builds from them, we act on the customer's behalf and follow the customer's instructions. The customer decides what to upload and who can see it. If you are a tenant or another person named in a customer's documents, please contact that building owner first. We will help them answer you.

2. What we process

Account information. Your name and email address, your password (held by our sign-in provider, never stored by us in readable form), your two-step sign-in setting, the buildings you can access and your role, and sign-in records such as session times.

Customer content. What a customer uploads or creates in the Platform, for example:

• leases, amendments and rent rolls, including tenant names, unit numbers, rent amounts, lease dates and any contact details the documents contain;
• bank and cash files, including deposits, payments, payee names and descriptions. The Platform shows only the last four digits of a bank account number;
• building settings, notes, and the owner's corrections to records;
• Chat conversations, and things you ask the Platform to remember;
• drafts the Platform prepares, and your decisions on them.

Information the Platform creates. Records built from your documents, such as a lease's dates and rent schedule, checks and findings, the morning email and monthly report, and a history of changes.

Technical information. Request and error records needed to run and secure the Platform.

What we ask you not to upload. Health information, government ID numbers such as Social Security numbers, full payment card numbers, and passwords for other services. The Platform is not built to protect these.

3. Why we use it

• To provide the Platform: read your documents, keep your building records, answer your questions in Chat, prepare drafts for your review, and send you the emails you have switched on.
• To keep it secure, prevent misuse, and investigate problems.
• To support you, and to check and improve the quality of the Platform's work for you. Brelos staff may review the Platform's answers and the records behind them for this purpose.
• To meet legal obligations and enforce our agreements.

We do not sell personal information, we do not share it for advertising, and we do not use customer content to train AI models, ours or anyone else's.

4. How the AI works with your information

The Platform uses AI models from outside providers to read documents, answer questions and prepare drafts. Today these are Anthropic (Claude) and OpenAI. Each request sends the information needed for that task, such as the lease being read or the records that answer your question. Under their business terms:

• Anthropic may not train its models on our customers' content. It deletes our requests and answers within 30 days, except content flagged for a policy violation, which it may keep for up to 2 years.
• OpenAI does not train on data sent through its business API unless the customer opts in, and we have not opted in. It keeps requests in abuse-monitoring logs for up to 30 days. We also tell OpenAI not to store our requests.

AI output is a draft and can be wrong. The Platform's code, not the AI, does the rent, money and date calculations. Our AI and Data Use page explains more.

Before we add another AI or document-reading provider, we will add it to our subprocessor list.

5. Who we share it with

• Service providers who run parts of the Platform for us, listed on our subprocessor list. They may use it only to provide their service to us.
• People in your organization whom the account owner gives access. Today the Platform emails only people in your account.
• Legal and safety. When the law requires it, to protect rights and safety, or with advisers such as lawyers and accountants under confidentiality.
• Business transfers. In a merger, financing or sale of assets, under confidentiality and with this policy continuing to apply.

6. How long we keep it

When a customer leaves, we will export the customer's building data on request and then delete it. Deleted data stays in encrypted backups until those backups age out and is not restored into service.

7. How we protect it

• Encryption. Connections to the Platform and between our systems are encrypted in transit, and the database's certificate is checked. Our hosting providers encrypt stored data. We encrypt backups with AES-256 before they leave our systems, with a key only Brelos holds.
• Separation between buildings. Every request is checked against the signed-in person's access to that building. The database also blocks all access except through the Platform's own server.
• Two-step sign-in. You can turn on two-step sign-in with an authenticator app in Controls.
• Limited staff access. Brelos staff access customer content only to support you, fix a problem, check the quality of the Platform's work for you, or as the law requires.

No system is perfectly secure. If a security incident affects your information, we will tell you without undue delay, as the law and your agreement require.

8. Your choices and rights

If you use the Platform, you can see and correct your records, delete files and conversations, and ask the Platform to forget what it remembered. You can also ask us to access, correct, export or delete your account information.

If you are named in a customer's documents, for example as a tenant, the building owner controls that information. Please ask them first. If you contact us, we will pass your request to the owner and help them answer.

Depending on where you live, you may have more rights under privacy law, including the right to appeal our decision. We will not treat you differently for using them. To make a request, email privacy@brelos.ai. We may need to confirm who you are first.

9. Where it is processed

Brelos and our main providers process information in the United States. Our subprocessor list shows each provider's location.

10. Children

The Platform is for businesses and is not for anyone under 18.

11. Changes

We will update this policy as the Platform changes and update the Last updated date above. For a material change, we will tell account owners by email or in the Platform before it takes effect.

12. Contact

To report a security issue, email security@brelos.ai.