Privacy Policy

1. Introduction

B & E Rental Equipment LLC, operating as OrbiLattice ("OrbiLattice," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our real estate CRM platform and services (collectively, the "Services").

2. Information We Collect

Personal Information

We collect personal information that you provide directly to us, including:

• Account information (name, email address, phone number, password)
• Profile information (company name, role, profile picture)
• Contact information for your clients and leads
• Property information and transaction data
• Payment and billing information
• Communications and support requests
• Calling and messaging information when you or your organization use those features, including phone numbers, call or message date and time, direction, duration, delivery or call status, campaign or routing context, and applicable consent, opt-out, suppression, and compliance records

Automatically Collected Information

When you use our Services, we automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Location information (if enabled)
• Cookies and similar tracking technologies

Third-Party Data Sources

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process transactions and send notifications
• Provide AI-powered features, including lead scoring, property enrichment, and document intelligence
• Respond to your requests and provide support
• Send administrative information, updates, and security alerts
• Analyze usage patterns to improve user experience
• Comply with legal obligations and enforce our terms
• Send marketing communications (with your consent)
• Place or route calls and messages you or your organization initiate; deliver requested communications; maintain call and delivery records; provide support; prevent fraud and abuse; and meet applicable compliance obligations

4. AI and Machine Learning

Our platform uses artificial intelligence and machine learning to provide intelligent features such as lead scoring, property valuations, and document extraction. We process your data using:

• Proprietary AI models trained on anonymized, aggregated data
• Third-party AI services (OpenAI, Anthropic) with strict data processing agreements
• Confidence-weighted transparency to show reasoning behind AI recommendations

4B. Calling, Text Messaging, Recordings, and AI Voice Features

When a customer enables and uses calling, messaging, or AI voice features, we process the contact and activity information needed to provide that feature. This can include telephone numbers, call and message dates and times, duration, direction, delivery or technical status, campaign or routing context, configured purpose, and records of consent, opt-out, suppression, and other compliance checks.

Some configured voice workflows may also create or store call recordings, voicemail content, transcripts, and AI-generated summaries or insights. Where these artifacts are used, they may contain information discussed during a call. Our bounded test-call workflow does not record, transcribe, transfer, or coach calls.

Communications Providers and Access

We may disclose the minimum information necessary to telecommunications carriers, messaging providers, transcription providers, AI providers, and integrations that you enable in order to provide the requested feature. This can include Twilio for telephony services, Google Cloud Speech-to-Text for configured transcription, and OpenAI-compatible services for configured transcript analysis. Authorized users in the same customer workspace may be able to access call records and any associated recordings, transcripts, or summaries according to the permissions available in the Services.

Marketing Communications and Opt-Outs

Marketing calls and messages are subject to the communication preferences and compliance controls configured for the customer workspace. For SMS delivery, our guarded delivery paths require an active consent record for the applicable number and check applicable do-not-contact or suppression records before sending. A person may opt out through the methods stated in a message, including replying STOP where that option is provided, or by contacting the organization that sent the message. We preserve necessary consent, revocation, opt-out, suppression, and related compliance records so that those preferences can be honored and verified.

Customer and OrbiLattice Roles

4A. AI Email Processing (GDPR & CCPA Privacy Controls)

When you enable AI-powered email features, we process email content to provide intelligent assistance. This section provides detailed information about how your email data is handled with GDPR/CCPA privacy rights and consent workflows in mind.

Legal Basis for Processing

We process email content under the following legal bases:

• Explicit Consent (GDPR Article 6(1)(a)): AI email processing requires your explicit opt-in consent, which can be withdrawn at any time.
• Contract Performance (GDPR Article 6(1)(b)): When AI features are necessary to provide the services you requested.

What Email Data is Processed

• Email body text and subject lines
• Sender and recipient information
• Email thread context (for contextual responses)
• Attachment metadata (not full attachments unless explicitly enabled)

How Email Data is Processed

• Draft Assistance: AI analyzes email content to suggest responses and identify action items.
• Summarization: Email threads are summarized for quick context review.
• Lead Intelligence: Email interactions inform lead scoring and follow-up recommendations.

Third-Party AI Processors

Email content may be sent to the following third-party AI providers for processing:

• OpenAI: GPT-4 and GPT-4o-mini models for text analysis and generation. OpenAI retains API data for 30 days only for abuse monitoring, does NOT train models on your data, and permanently deletes data after 30 days.

Data Minimization

We apply data minimization principles to AI email processing:

• Only the minimum necessary email content is sent for AI analysis
• Payment information, passwords, and highly sensitive data are automatically filtered before AI processing
• Email content is not stored after AI processing is complete

Your Rights Regarding AI Email Processing

• Consent Withdrawal: You may withdraw consent for AI email processing at any time via Settings → AI Privacy & Data. This will immediately disable AI email features.
• Access: Request a copy of any email data processed by AI.
• Deletion: Request deletion of AI interaction history related to emails.
• Object: Object to specific AI processing activities (e.g., lead scoring based on email content).

Audit & Transparency

• All AI interactions are logged with correlation IDs for audit purposes
• You can view your AI interaction history in the Mission Control dashboard
• AI decisions (like lead scores) include explainability information showing reasoning

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who perform services on our behalf (hosting, analytics, payment processing, customer support)
• Integrated Services: Third-party applications you connect to our platform (with your explicit consent)
• Communications Providers: Telecommunications carriers, messaging providers, transcription and AI providers, and integrations needed to provide enabled calling, messaging, recording, transcription, or analysis features
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Compliance: When required by law or to protect rights and safety
• With Your Consent: For any other purpose disclosed to you with your consent

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• SOC 2-aligned security controls
• Regular security audits and penetration testing
• Role-based access controls and audit logging
• Multi-factor authentication (MFA)
• Employee security training and background checks

7. Data Retention

We retain your information for as long as necessary to provide our Services and comply with legal obligations. Specifically:

• Account information: Duration of your subscription plus 30 days
• Transaction records: 7 years (legal requirement)
• Usage data and logs: 90 days (except where longer retention is required)
• Backup data: 30 days after primary deletion
• Call recordings, transcripts, and AI-derived call artifacts: the period configured by the customer workspace for recordings (365 days by default), after which an authorized retention process removes the provider recording and locally stored call artifacts; a setting of 0 retains them indefinitely, and a legal hold may require longer retention
• Consent, revocation, opt-out, suppression, and related communications-compliance records: at least 4 years after the relevant communication activity, or longer where required by law or an applicable legal hold. Active suppression records remain in place until they expire or are validly removed.

8. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information
• Portability: Request transfer of your data in a structured format
• Opt-Out: Opt out of marketing communications or data sales
• Restriction: Request restriction of processing

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)
• Privacy workflows for GDPR, CCPA, and other applicable regulations

10. Children's Privacy

11. Changes to This Privacy Policy

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us: