Privacy Policy

This Policy applies to the Rook web application, our website and product pages, and related services (together, the "Service"), operated by Aximon ("we", "us", "Rook"). It applies to the people who sign up for and use the Service on behalf of a real estate firm or team ("you").

Rook is a business-to-business product intended for use by professionals. It is not directed to consumers or to children, and we do not knowingly collect information from anyone under 18.

We collect only what we need to run the Service. Specifically:

• Account information you provide when you sign up or are invited, such as your name, work email address, and the organization you belong to. Authentication is handled through Supabase Auth.
• Documents and files you upload or import, such as offering memorandums, rent rolls, T-12 operating statements, Excel underwriting models, and related deal materials brought in from systems you use (for example, CoStar, Yardi, or Excel), so the Service can read, extract, and underwrite them.
• Content connected through an email inbox you choose to link (via Google or Microsoft/Outlook authorization), including message metadata, message bodies, and attachments, used to detect and ingest deals sent to you. You control which inbox is connected and can disconnect it at any time.
• If a workspace owner enables initial data-room NDA signing, the signer details they provide, the scope and record of authorization, and captured agreement and action records.
• Voice notes or audio you submit to the assistant, which are transcribed to text so we can act on them.
• Property and deal data you enter or generate in the product, including addresses, financial assumptions, and the analyses, comps, and memos the Service produces.
• Usage and device data, such as which features you use and basic technical logs, used to operate, secure, and improve the Service.

We use the information above to:

• Provide the Service: parse your documents, extract facts, generate underwrites, comps, pro formas, and investment memos, and return them to you.
• Enrich analyses with public and licensed market data (for example, comparable sales, rents, demographics, and market signals) so your underwrites are grounded in real numbers.
• Authenticate you, operate and secure the platform, prevent abuse, and provide support.
• Improve the Service, including debugging and measuring which features are useful. We do not use your private deal documents to train shared or public models, and we do not share your pipeline with other customers.

We use OpenAI to process relevant document, email, and audio content for deal detection, analysis, and transcription. For connected inboxes, this can include sender information, subjects, message snippets and body text, attachment metadata, and extracted attachment text. Our infrastructure providers are listed under "Service providers" below.

We do not use your content, including Google user data and information derived from it, to develop, improve, or train shared, public, or general-purpose AI models. Our large-language-model provider processes API inputs and outputs to deliver the service and does not use them to train its models.

When you connect a property portal, Rook handles the sign-in fields you submit and stores an encrypted session scoped to your workspace, your member account and that portal. Login secrets, verification codes and saved credentials are not sent to AI. Portal pages, screenshots, agreement text and downloaded deal documents may be processed by OpenAI to navigate a data room, assess an agreement against your signing permission and analyze the opportunity. Required signer and contact details are submitted to the relevant portal or broker to obtain the authorized access.

Portal connection is optional. For supported sign-in flows, the Connect notice discloses that Rook will save your portal-native username and password for automatic sign-in; choosing Connect authorizes that use. If saving a login is unavailable, the notice states that only your session will be saved. Saved credentials are encrypted separately from session data and used only to sign into that portal; verification codes and MFA approvals are not saved as reusable credentials. We do not obtain your Google or Microsoft account password through connecting an inbox.

With your explicit portal reuse permission, encrypted access is retained for up to 30 days after verified authorized use; the portal may invalidate it sooner. Older sessions without this permission keep their fixed expiry and are not enrolled in saved-password access. Disconnecting removes the stored session and any saved login for that connection. Imported deal documents and agreement records are retained under the retention rules below.

We retain permission records including the member or owner who accepted, the workspace, time, disclosure version and exact accepted text. An owner's signing permission is separate from a member's portal access permission. Turning signing off prevents future agreement acceptance; it does not undo accepted agreements. Historical permissions may lack an exact text snapshot and are identified accordingly, rather than being presented as acceptance of a later notice.

If you connect a Google (Gmail) or Microsoft (Outlook) inbox, we request permission to read messages and attachments to identify and import deal opportunities, and to send emails you explicitly submit through the Service. Relevant message and attachment contents are processed using OpenAI as described under "How your documents are processed" and "Service providers". We do not use connected email data for advertising or transfer it except as needed to provide the Service to you.

Rook temporarily processes mail content to identify deal activity. It retains deal and outreach evidence, ambiguous or potential opportunities, and unfinished classification or recovery work, including messages awaiting a matching deal. For newly received inbound messages determined unrelated, Rook removes content from the intake record and keeps minimal message identifiers, date and processing outcome to prevent duplicate work. Previously retained source records remain subject to the retention and deletion policy below.

Imported deal information can be shared with authorized workspace members. A personal mailbox remains controlled by the member who connected it: only that member can manage its settings or submit sends. A workspace owner can also disconnect it in Settings.

Rook's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. Our use of information received from Microsoft APIs is likewise limited to providing the Service.

For Google user data, these limits take precedence over broader provisions in this Policy: personnel may read specific content only with your documented, explicit permission, when necessary for security purposes or to comply with applicable law, or when the data is aggregated and anonymized for internal operations. We obtain your explicit prior consent before transferring Google user data as part of a merger, acquisition, or sale of assets, and your consent before using it for a newly disclosed purpose.

To help our customers evaluate and pursue real estate, the Service collects and compiles business-context information about properties and the people connected to them, such as property owners, brokers, and their firms. This can include names, business contact details, firm affiliation, and property ownership records, drawn from documents our customers provide and from publicly available or licensed sources.

This information is used only to support legitimate commercial real estate activity for the customer whose account it appears in, not for advertising and not for sale. If you are an owner or broker and want to know what information we hold about you, or to have it corrected or removed, contact us at support@aximon.ai.

If you use the Service to email contacts from an email account you connect, those messages are sent from your own mailbox and your own address. You are the sender and, for the personal data of the people you contact, you are the controller. We process that data on your behalf to carry out the send you asked for.

You select the recipients and submit the message before sending starts. Submitted messages are queued and sent separately to each recipient in the background, so sending can continue after you close the page.

We store what is needed to run and account for the send: the recipient's name, firm and address as they exist in your list, the message you wrote, and a per-recipient record of what happened to it — queued, sent, failed, or skipped, and why. That record is what stops the same person being emailed twice and is retained with your workspace data.

Deciding who may lawfully be contacted, having a lawful basis for contacting them, and honoring their opt-outs and data-subject requests are your responsibilities as the sender. See the Email outreach section of our Terms of Use.

If you received an email sent through Rook from one of our customers and want it to stop, reply to that message directly — it goes to the sender's own inbox, because they sent it from their own account. You can also contact us at support@aximon.ai and we will record the address so it is not contacted again from that workspace.

We share information with a limited set of vendors who process it on our behalf to deliver the Service, under agreements that require appropriate confidentiality and security. We do not sell your information, and we do not share it for advertising. Our current categories of providers are:

• Cloud database, storage, and authentication: Supabase, which hosts your account, documents, and generated artifacts.
• AI processing: OpenAI, for document understanding, generation, and voice transcription via API.
• Market and property data enrichment: RentCast, plus public or government data sources such as the U.S. Census Bureau, Bureau of Labor Statistics, Bureau of Economic Analysis, the Federal Reserve (FRED), and SEC EDGAR.
• Email connectivity: Google (Gmail) and Microsoft (Outlook) authorization, for inboxes you choose to connect, used to read messages and attachments for deal intake and send messages explicitly submitted by workspace members.

We will keep this list current as our providers change. If you need a formal, up-to-date subprocessor list for a security or vendor review, email support@aximon.ai.

We share your information only in these situations:

• With the service providers described above, to operate the Service.
• With the relevant broker or portal when performing owner-authorized initial data-room access: the required signer identity and contact details and the acceptance action. Those recipients may keep their own access and signature records.
• Within your organization, with other authorized users on your team's account, according to your team's roles and permissions.
• For legal reasons, if required by law or valid legal process, or to protect the rights, safety, and security of our users, the public, or Rook.
• In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this Policy.

We never sell your personal information or your deal documents.

Your data is encrypted in transit (TLS) and at rest, and is stored in a secured database. When you connect an inbox, the Service processes your messages and attachments automatically to detect and pull in deals; this is done by software, and we do not human-read your inbox for any other purpose. We do not monetize your documents or use them to train shared or public models.

In normal operation, our personnel do not access the content of your documents or deals. Limited access may occur when reasonably necessary to provide support you request, investigate a security or service issue, comply with applicable law, or protect the Service, and is restricted to authorized personnel with a legitimate need.

Authorization tokens for connected inboxes are encrypted at rest; Rook does not receive or store your Google or Microsoft account password. Your documents and data are logically isolated per organization, so one customer cannot see another customer's pipeline. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

We plan to undergo a SOC 2 Type II examination. No report is available yet.

Rook is built for real estate firms in the United States, and your data is stored on cloud infrastructure located in the United States.

For the documents and deal data you put into the Service, we act on your behalf and process that content to provide the Service to you. A data processing agreement is available on request for customers who need one for a security or vendor review; email support@aximon.ai.

We retain your documents and the artifacts we generate for as long as your account is active or as needed to provide the Service. You can delete individual deals, files, chats, and connected inboxes from within the product at any time; deleting a deal removes its files and derived data from active production systems, subject to limited processing time and residual encrypted backup copies.

Disconnecting an inbox does not delete previously imported deals or documents; use the deletion options described here.

Signing authorizations and agreement receipts are retained with the relevant workspace and deal under this policy. Turning signing off or disconnecting an inbox does not undo accepted agreements or erase historical receipts.

You can also request deletion of all of your data at any time by emailing support@aximon.ai. We will remove it within 30 days, except where we must retain limited information to comply with legal obligations or resolve disputes. Residual copies may persist in routine backups for a limited period before being overwritten.

You can access, correct, export, or delete your information, and you can disconnect a linked inbox, at any time from within the product or by contacting us. Depending on where you live, you may have additional rights over your personal information under applicable law, including the right to request access or deletion; we honor these requests.

To make a request, email support@aximon.ai. We may need to verify your identity before acting on a request.

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after an update takes effect means you accept the revised Policy.

Questions, requests, or a security review? Email us at support@aximon.ai.