AveryIQ Privacy Policy

1) Scope & Roles

• Controller vs. Processor. For data about our own relationships (e.g., our website visitors, prospects, and your account with us), Starlight acts as a business/controller. For data we handle inside Avery on behalf of property-management and CRM customers (e.g., tenant/owner/vendor data and client contact records), we typically act as a service provider/processor under applicable U.S. privacy laws and our customer agreements govern.
• U.S. focus. We operate and host the Services in the United States and do not target users outside the U.S.

2) Information We Collect

We collect information (a) directly from you, (b) automatically from your device/interactions, and (c) from third parties/integrations you or our customers enable.

A. Information you (or your organization) provide

• Identifiers & contact: name, email, phone number, postal address.
• Account & profile: role (property manager/owner/vendor/tenant), units, properties, apartment preferences.
• Payments: details needed to process rent/fees. Payments are processed by partners such as Stripe. We generally receive limited payment metadata (e.g., last-4 digits, card brand, expiration), and we do not store full primary account numbers.
• Communications & uploads: messages, photos, videos, and documents (e.g., work-order images, inspection files, invoices) submitted via app, email, phone/voice, and SMS/MMS.
• Government IDs or similar if you choose to provide them via our communication channels (e.g., for screening/verification handled by your property manager).

B. Information collected automatically

• Device/usage: IP address, device identifiers, browser/OS info, app version, referring/exit pages, pages viewed, links clicked, session timestamps, and general location inferred from IP.
• Cookies & similar: We use cookies/local storage for authentication and to operate/improve the Services (see §4).

C. Information from third parties/integrations you enable

• Integrations you connect or use: We receive/share data as needed to operate integrations such as QuickBooks, Zillow, Apartments.com, Telnyx, Google Maps, Stripe, Facebook, and others you or our customers enable.

D. Gmail and Google Workspace connections

If you choose to connect a Gmail or Google Workspace mailbox, Google asks you to authorize access to your email identity and permission to send email on your behalf. We request only these permissions. We do not receive your Google password.

• Connection information: We receive and store your verified email address, Google account identifier, granted permissions, connection status, and OAuth access and refresh tokens. Tokens are encrypted at rest and used by our servers to maintain the connection and send authorized messages.
• Sending and delivery records: We send Google the recipients, subject, message content, attachment links, and email headers needed to deliver messages you or an authorized Avery workflow send through the connection. We retain the message, sender and recipient addresses, reply address, delivery status, and identifiers returned by Google as part of the conversation record.
• Shared conversations and replies: Messages sent into an AveryIQ conversation are visible to organization members with access to that conversation. We use a conversation-specific reply address so recipient replies, including attachments, can arrive in the same shared inbox. Avery may process this conversation content for features such as summaries, suggested responses, and property-management workflows, subject to your organization's settings, permissions, and approvals.
• Mailbox access: This connection does not read or synchronize your Gmail inbox, import mail addressed directly to your Gmail address, access Google Drive, or change your Gmail settings. Drafts stay in AveryIQ. Replies delivered to AveryIQ are not automatically copied into your Gmail inbox.

Google Limited Use: AveryIQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace user data and developer policy. These limits also apply to data derived from Google user data and take precedence over the general data-use and disclosure provisions elsewhere in this policy.

We use Google user data only to provide or improve the features you authorize and that are visible in AveryIQ. We do not sell this data, use it for advertising or creditworthiness decisions, or use it to train machine learning or AI models. We require service providers handling this data on our behalf to follow these same limits. Transfers are limited to providing or improving those features with your consent, security purposes, legal requirements, or a business transfer with your explicit prior consent.

Our personnel may access Google user data only with your explicit agreement to access specific data, when necessary for security or legal compliance, or when the data is aggregated and anonymized for permitted internal operations. To disconnect or request deletion, see §9 below.

E. AveryIQ CRM and assistant plugins

AveryIQ stores the contacts, client notes and preferences, open houses and open-house visitor sign-ins that you and your team add, including through our ChatGPT and Claude plugins. The plugins send AveryIQ only what you ask the assistant to save or look up, and we don't read your ChatGPT or Claude conversation history. AveryIQ uses AI providers, including OpenAI, to read listings, messages and notes and to prepare suggestions; they process this data on our behalf.

3) How We Use Information

We use information to:

• Provide and operate the Services (accounts, authentication, role-based access, property/unit records, move-ins, work orders, maintenance workflows, payments, communications).
• Communicate with you, including transactional notices (login codes, work-order updates, rent reminders) and, where permitted, marketing emails/SMS.
• Support & safety (customer support, troubleshooting, reliability, fraud/abuse prevention, enforcing terms, and legal compliance).
• Improve and develop the Services (analytics, performance monitoring, product research).
• AI/automation features: We use data—including messages sent and received through Avery—to develop, train, and improve AI-powered and automated features (e.g., routing, summarization, categorization, suggested responses). We apply safeguards to reduce the risk of exposing sensitive content and restrict employee access to authorized personnel. Where required by law or contract, we honor limitations or opt-out choices provided to us. Google user data is subject to the Google Limited Use provisions in §2D, including the prohibition on using it for model training.

4) Cookies, Analytics, and Similar Technologies

• Cookies/local storage help with login/authentication and remembering settings. You can disable cookies in your browser, but some features may not work.
• Analytics/monitoring: We use PostHog, Sentry, Google Analytics, and Google Ads (via Google Tag Manager) to understand usage, measure advertising effectiveness, diagnose issues, and improve performance. These tools may set their own cookies or collect device/usage data as described in §2B.
• Advertising pixels & conversion APIs: On certain marketing pages and post-purchase pages we use the Meta Pixel and the Meta Conversions API (CAPI) to measure ad performance, attribute conversions, and build audiences for Facebook and Instagram ads. The Meta Pixel may set first- and third-party cookies (e.g., _fbp, _fbc) and report page views, lead-form submissions, and purchases to Meta. The Conversions API additionally sends hashed contact information (e.g., SHA-256 of email, name, and phone) and technical signals (IP address, user-agent) from our servers to Meta to improve attribution. You can control or opt out of these activities via your browser settings, your Facebook/Instagram ad preferences, or by emailing [email protected].

5) When We Disclose Information

We disclose information as follows:

• At your (or your organization's) direction: e.g., sharing owner/tenant/vendor info within workflows; publishing listings; using enabled integrations.
• Service providers/contractors: e.g., Telnyx (telephony/SMS), AWS SES (email), hosting on Google Cloud Platform and Amazon Web Services, analytics/monitoring (PostHog, Sentry, Google Analytics), advertising measurement and audience-building (Google Ads, Meta/Facebook via the Meta Pixel and Conversions API), payments (Stripe). These parties may access personal information only to perform services for us and are bound by confidentiality/contractual obligations.
• Integration partners you choose: e.g., QuickBooks, Zillow, Apartments.com, Google Maps, Facebook, and similar.
• Legal, safety, and compliance: to comply with law, enforce terms, and protect rights, safety, or property of Starlight, users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of all/part of our business.

We do not sell personal data. Some U.S. laws define "share" for cross-context behavioral advertising differently from "sell." If activity qualifies as "sharing," we provide required opt-outs and honor applicable signals.

6) SMS, Voice, and Call Features

You may interact with Avery by calling or texting our phone line without creating an account.

• We may log message/call metadata (time/date, phone numbers, duration) and store message content to deliver Services.
• If calls are ever recorded, we provide legally required notice.
• Message frequency varies. Message and data rates may apply.
• To stop marketing texts, reply STOP; for help, reply HELP. Transactional texts (e.g., login codes, urgent maintenance) may continue where permitted.

7) Data Retention

We retain personal information as long as our customers need it for operational purposes and as permitted by law (e.g., to comply with legal obligations, resolve disputes, enforce agreements). Retention varies by customer and record type. When information is no longer needed, we may delete or de-identify it consistent with our policies and applicable law.

Export/Deletion: Some data can be exported or deleted on request (see §9). Certain records (e.g., legal, billing, security logs, backups) may be retained where required or permitted.

Disconnecting Gmail deletes the saved OAuth credentials and disables the connection for future sends. It does not erase existing shared conversations, delivery records, or the mailbox identity associated with those records. Messages already sent or being transmitted cannot be recalled by disconnecting. Retained Google user data remains subject to §2D, and you may request its deletion as described in §9.

8) Security

We use administrative, technical, and physical safeguards designed to protect personal information, including least-privilege access for authorized employees, account-level controls, logging/monitoring, and encryption in transit. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9) Your Privacy Rights & Choices

Your rights and choices depend on your relationship with us and where you live.

A. Account & notification settings

• Manage notifications: You can opt out of marketing emails/SMS (unsubscribe links or reply STOP). Transactional/service-related messages may still be sent.
• Cookies/analytics: Control cookies via browser settings.
• Gmail access: In the AveryIQ web app, open Settings → Integrations → Gmail → Disconnect to remove the saved credentials. You can also remove AveryIQ's access through your Google Account's third-party connections. To request deletion of retained connection information or conversation data, contact [email protected] as described below. Disconnecting does not delete copies already delivered to recipients or stored in your Google account.

B. Requests regarding your data

Subject to verification, applicable law, and our role when acting as a service provider for our customers, you may request:

• Access/Know categories and specific pieces of personal information we have collected about you.
• Correction of inaccurate personal information.
• Deletion of personal information.
• Portability of certain information.
• Opt-out of (i) sale of personal information (we do not sell personal information) and (ii) sharing for cross-context behavioral advertising, if applicable.
• Limit use of sensitive personal information, where required.

How to submit: email [email protected].

If we processed your information on behalf of a property-management customer, we may forward your request to that customer or ask you to contact them directly. Where required, we honor Global Privacy Control (GPC) or similar signals for opt-outs.

Residents of certain U.S. states (e.g., CA, CO, CT, VA, UT) may have additional rights. You may also have the right to appeal a decision we make regarding your request; appeal instructions will be provided if we deny a request.

10) Children

The Services are intended for adults and are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child provided information to us, contact [email protected].

11) International Users

We do not target users outside the United States. If you use the Services from outside the U.S., you understand your information will be processed in the U.S., where laws may differ from those in your jurisdiction.

12) Third-Party Links & Services

The Services may link to or integrate with third-party websites, apps, and services. We are not responsible for their privacy practices. Review their privacy policies before providing personal information.

13) Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy with a new "Last updated" date and, for material changes, provide additional notice (e.g., email, in-app message, or prominent notice).

14) How to Contact Us

Starlight Energy, Inc.

1606 Headway Cir STE 9312

Austin, TX 78754, United States

Email: [email protected]