Privacy Policy

The data controller / business responsible for your information is:

Redo AI, Inc. c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA Privacy inquiries and data-rights requests: privacy@hobb.ai Legal notices: legal@hobb.ai

For most purposes under this Policy, Redo AI is the "business" (CCPA/CPRA) or "controller" of your account, billing, and usage data. For the third-party personal information you load into or route through Hobb (for example, information about your contacts, leads, and clients), Redo AI generally acts as a "service provider" / "processor" that processes that information on your behalf and under your instructions (see Section 9).

• We collect the information you give us (account, billing), information from the accounts you connect (email, calendar, phone/messaging), and information generated as you use Hobb (calls, messages, transcripts, tasks, contacts, logs).
• We use it to run the Service: sync and read your email, capture and organize your communications, extract tasks and contacts, place and receive calls and messages, transcribe recorded calls, bill you, and keep the Service secure.
• We do not sell your personal information, and we do not use your data for advertising.
• Google user data obtained through Gmail is handled under Google's Limited Use requirements, and is never used to train generalized/non-personalized AI models (see Section 6).
• We use a small set of trusted sub-processors (Section 8) and require them to protect your data.
• You have rights over your data, including access, deletion, and correction, described in Section 12.

a. Information you provide directly.

• Account data: name, email address, business/brokerage name, and authentication identifiers when you sign up or sign in.
• Billing data: subscription tier, credit-ledger balance, and payment records. Card details are collected and processed directly by our payment processor, Stripe. Redo AI does not store full card numbers.
• Support and communications: messages you send us, and the contents of support requests.
• Provisioning/KYC data: for phone-number features, the legal/business name and business address required to provision a number and (where applicable) register an emergency-calling address.

b. Information from accounts and channels you connect. When you connect a mailbox or channel, we access data through that provider's API, subject to the permissions (scopes) you grant:

• Email (Gmail / Google Workspace): message metadata and content, drafts, and labels, via Google APIs. See Section 6 for the specific Google scopes, uses, and Limited Use commitments.
• Email (Microsoft Outlook / Microsoft 365): message metadata and content via the Microsoft Graph API, subject to the permissions you grant.
• Calendar (optional): calendar event data, if you enable calendar features.
• Voice, SMS, and WhatsApp: call and message metadata and content sent or received through a Hobb-provisioned phone number, processed through our telephony provider (Telnyx). This includes phone numbers, timestamps, call duration and status, message bodies, and, where you enable it and consent is captured, call audio recordings and their transcripts.

c. Information generated by your use of the Service.

• Derived records: contacts, "person" records, importance/behavioral scores, extracted to-dos and follow-up tasks, each linked to its source communication.
• Usage and device data: log data, IP address, browser/extension version, feature usage, and diagnostic events.
• Cookies and similar technologies: see our Cookie Policy and Section 11.

d. Information about third parties (your contacts). To provide the Service, Hobb necessarily processes personal information about the people you communicate with (your leads, clients, and other contacts), including their names, email addresses, phone numbers, the content of your communications with them, and inferences (such as behavioral importance scores) derived from those communications. You are responsible for having a lawful basis and any required notice or consent to load this information into Hobb and to record/transcribe communications with these individuals (see Sections 7 and 9, the Terms of Service, and the Acceptable Use Policy).

We do not knowingly collect information from anyone under 18. The Service is for business use by adults (see Section 14).

We use the information above to:

• Provide the core Service. Sync and read your connected mailbox; capture calls, SMS, and WhatsApp messages; build unified contact records; extract and surface to-dos and follow-ups; place and receive calls and messages; draft replies (Hobb writes drafts to your mailbox; you send them, Hobb never sends email as you).
• Record and transcribe calls where you enable recording, and generate AI transcripts and summaries.
• Operate AI features. A privacy-preserving pipeline scrubs personal identifiers from message text before it is sent to our AI sub-processors for extraction and classification (see Section 6).
• Bill and administer your account. Manage subscriptions, the credit ledger, receipts, and dunning.
• Secure and maintain the Service. Authenticate users, prevent fraud and abuse, debug, and enforce our terms.
• Communicate with you. Send transactional messages (sign-in links, receipts, service notices) and respond to support.
• Comply with law and enforce our agreements.

We do not use your data, or your Google user data, for advertising or to build advertising profiles. We do not sell your personal information.

Legal bases (for users protected by GDPR/UK-GDPR, e.g., future UK/NL markets)

Where applicable, we rely on: performance of a contract (to provide the Service you request), legitimate interests (to secure, improve, and operate the Service, balanced against your rights), consent (for example, for recording and certain optional features), and legal obligation.

For the preceding 12 months, we have collected the following statutory categories of personal information. We collect these from you, from the accounts/channels you connect, from your use of the Service, and from our sub-processors. We disclose categories to sub-processors for the business purposes described in Section 4; we do not sell or "share" (for cross-context behavioral advertising) any category.

Sensitive personal information note. Under the CPRA, "sensitive personal information" includes the contents of a consumer's mail, email, and text messages unless the business is the intended recipient. Because Hobb reads your mailbox to provide the Service, we process such content. We use and disclose sensitive personal information only as necessary to provide the Service you have requested and for the permitted purposes recognized under the CPRA (such as performing services, ensuring security, and detecting malicious activity). We do not use it to infer characteristics about you. Because our use is limited to these purposes, the "Limit the Use of My Sensitive Personal Information" right has limited application; even so, you may contact us at privacy@hobb.ai with any request and we will honor applicable rights.

Where a specific period is not stated, we retain personal information for as long as your account is active and as needed to provide the Service, then delete or de-identify it within a reasonable period, unless a longer period is required by law. You can delete individual items, and set a deletion schedule for call recordings and transcripts, in your account Settings.

Hobb's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request (least-privilege). Hobb requests the narrowest Gmail scopes required for the features you enable:

Hobb never requests gmail.send and cannot send email as you. Hobb drafts; you send.

How we access, use, store, and share Google user data.

• Access: with your explicit OAuth authorization, Hobb connects to your Gmail through Google's APIs using the scopes above. Your Google refresh token is stored encrypted and is used only to maintain your connection.
• Use: we use Google user data solely to provide and improve the user-facing features prominent in Hobb: syncing and reading your mail to surface to-dos and follow-ups, building contact records, and (if enabled) drafting replies. Message text is passed through a personal-data scrubbing step before AI processing.
• Storage: we store the minimum message data needed to provide these features (including a restricted, access-controlled store of message content and derived, PII-scrubbed records), encrypted in transit and at rest, on our hosting sub-processor's infrastructure.
• Sharing/transfer: we do not transfer Google user data to others except as permitted by the Limited Use requirements, namely: (i) as necessary to provide or improve user-facing features and only with your consent; (ii) for security purposes (e.g., investigating abuse); (iii) to comply with applicable law; or (iv) as part of a merger, acquisition, or asset sale with your explicit prior consent.
• Human access: we do not allow humans to read your Google user data except (i) with your affirmative agreement to view specific messages, (ii) where necessary for security, (iii) to comply with law, or (iv) where the data is aggregated and de-identified for internal operations.

Limited Use: the four prohibitions. Consistent with Google's policy, Hobb does not:

1. Transfer or sell your Google user data to third parties like advertising platforms, data brokers, or information resellers;
2. Transfer, sell, or use your Google user data for serving ads, including retargeting, personalized, or interest-based advertising;
3. Transfer, sell, or use your Google user data to determine credit-worthiness or for lending purposes; or
4. Transfer, sell, or use your Google user data to create, train, or improve (directly or indirectly) any machine-learning or artificial-intelligence model, other than a model personalized to you for the specific user-facing feature that is the reason you connected Gmail.

AI model-training commitment. We do not retain or use Google Workspace/Gmail user data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. Our AI sub-processors are contractually bound not to train their models on your content.

Revoking access. You can disconnect Hobb at any time in-app or via your Google Account → Security → Third-party access, which revokes Hobb's access. On disconnection we stop syncing and delete or de-identify stored Google user data in line with Section 12.

When you connect Outlook/Microsoft 365, Hobb accesses your mail through the Microsoft Graph API under the permissions you grant, and uses that data on the same least-privilege, no-advertising, no-generalized-AI-training basis described above for Google data. Your Microsoft refresh token is stored encrypted and used only to maintain your connection. You can revoke access in your Microsoft account settings or in-app.

• Provisioned numbers. When you activate a phone number, calls, SMS, and WhatsApp messages route through that Hobb-provisioned number via our telephony sub-processor (Telnyx). Native-dialer calls on your personal SIM are never recorded by Hobb.
• Recording, and who tells the other party. Where you enable recording, Hobb plays a recording/transcription announcement at the start of calls it routes for you. Calls you dial from the Hobb mobile app or the in-app web dialer are recorded without any announcement being played to the other party, because that connection gives us no way to speak to them before the call is answered; on those calls you must state that the call is recorded yourself. You are responsible for complying with call-recording laws, which in some U.S. states require the consent of all parties. Our Acceptable Use Policy sets out your obligations, and Hobb provides controls to disable recording. We treat transcripts with the same protection as the underlying audio.
• Transcription and AI analysis. Recorded audio may be transcribed and summarized by automated systems. We do not build voiceprints or perform biometric speaker-identification.
• Messaging. For SMS and WhatsApp you send through Hobb, you are the message sender and are responsible for obtaining recipient consent and honoring opt-outs (STOP/HELP), consistent with the TCPA, CTIA/10DLC rules, WhatsApp's Business Messaging Policy, and the Acceptable Use Policy.

This section describes the SMS program operated through Hobb (Redo AI, Inc.) and is provided for U.S. A2P 10DLC registration and carrier review.

• Program and message types. Hobb provisions phone numbers to its users (real-estate professionals) who use them to send and receive text messages with their own clients and leads. Messages are conversational and one to one: replies to inbound texts, appointment scheduling, and follow-ups relating to an existing or requested real-estate relationship. Hobb does not send marketing or promotional text blasts.
• Consent and opt-in. Recipients receive texts because they gave their phone number to a Hobb user (by phone, in person, or through a property or listing inquiry) or because they first contacted that user's number. Hobb users are contractually required to obtain the recipient's consent before texting and to honor opt-out requests, consistent with the TCPA and CTIA guidelines (see the Acceptable Use Policy). Consent to receive texts is never a condition of any purchase.
• Message frequency. Message frequency varies with the conversation; there is no fixed recurring schedule.
• Cost. Message and data rates may apply, depending on the recipient's mobile carrier and plan.
• Opt-out and help. A recipient can reply STOP at any time to stop receiving messages from a Hobb number, and HELP for assistance. For support, contact privacy@hobb.ai.
• We do not share mobile opt-in data. Mobile phone numbers, text-messaging opt-in information, and consent are not shared or sold to third parties or affiliates for marketing or promotional purposes. Phone numbers and message content are shared only with the sub-processors that deliver the Service (for example, our telephony provider Telnyx), as described in Section 8, and never for third-party marketing.

See also the Terms of Service and Acceptable Use Policy.

We share personal information only with service providers that process it on our behalf under contract, and as required by law. We do not sell personal information. Our current sub-processors include:

A current, maintained sub-processor list is available at hobb.ai/legal/subprocessors. We require each sub-processor to protect personal information and to process it only per our instructions, under a data-processing agreement or equivalent service-provider terms.

We may also disclose information: (i) to comply with law, legal process, or lawful government requests; (ii) to protect the rights, safety, and security of Hobb, our users, and the public; (iii) to enforce our terms; and (iv) in connection with a merger, acquisition, financing, or sale of assets, subject to the commitments in this Policy (and, for Google user data, with your explicit prior consent).

For the personal information you and your organization load into or generate through Hobb about your contacts and clients, Redo AI acts as your service provider / processor: we process that information to provide the Service, under your instructions, and we do not use it for our own purposes, retain, use, or disclose it outside the direct business relationship, or combine it with data from other sources except as permitted by law. You are the business / controller for that information and are responsible for providing any notices and obtaining any consents required to collect it, record communications, and use Hobb to contact those individuals. Our Data Processing Addendum governs this processing for business customers.

If you are an end-recipient (a contact of a Hobb user) and want to exercise privacy rights, please contact the Hobb user (the agent/brokerage) who holds your information; we will assist them as their service provider. You may also contact us at privacy@hobb.ai and we will route your request appropriately.

We use technical and organizational safeguards including encryption in transit and at rest, encryption of stored third-party credentials, strict secret management, per-organization data isolation enforced in every data query, least-privilege access scopes, fail-closed production configuration, and monitoring. Connected-account credentials (such as your Gmail/Outlook refresh tokens) are encrypted with a key that is itself tightly controlled. No method of transmission or storage is perfectly secure, but we work to protect your information and to respond promptly to incidents. To report a security concern, contact security@hobb.ai.

hobb.ai and the Hobb app use cookies and similar technologies for essential functionality (sign-in, security), preferences, and product analytics. We use third-party analytics providers (Google Analytics, PostHog, and Hotjar) that may set cookies and record usage and interaction data (including session activity) to help us understand and improve the Service. We do not use cookies for cross-context behavioral advertising, and we do not sell your personal information. You can opt out through your browser controls, our cookie banner where shown, and recognized opt-out preference signals, including the Global Privacy Control (GPC). For full details and choices, see our Cookie Policy.

Depending on where you live, you may have some or all of the following rights:

• Access / know the personal information we hold about you, its sources, purposes, and the categories of third parties we disclose it to.
• Delete your personal information.
• Correct inaccurate personal information.
• Portability. Receive a copy of certain data in a portable format.
• Opt out of "sale" or "sharing" of personal information (note: we do not sell or share personal information).
• Limit the use of sensitive personal information (see the note in Section 5).
• Non-discrimination. We will not discriminate against you for exercising your rights.
• Appeal. If we deny a request, you may appeal by replying to our decision or writing to privacy@hobb.ai; you may also contact your state attorney general.

How to exercise your rights. Email privacy@hobb.ai, or use the in-app account/privacy controls (including self-service disconnect and deletion). We will verify your request (typically by confirming control of the account email) and respond within the time required by applicable law (generally 45 days under U.S. state laws, extendable once). An authorized agent may submit a request on your behalf with proof of authorization.

California "Your Privacy Choices." California residents may exercise the rights above, including opting out of sale/sharing (again, we do not sell or share) and limiting sensitive-PI use, via privacy@hobb.ai or the in-app "Your Privacy Choices" control, and through the GPC signal.

Other U.S. states. Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and others) have equivalent rights to access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale, and certain profiling. Exercise them the same way.

Hobb currently serves the United States, and personal information is processed in the United States and other locations where our sub-processors operate. If we expand to the United Kingdom, the European Union/Netherlands, or elsewhere, we will update this Policy and implement appropriate transfer safeguards (such as Standard Contractual Clauses / UK IDTA and the EU-U.S. Data Privacy Framework where relevant).

The Service is intended for business use by adults and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact privacy@hobb.ai and we will delete it.

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice (such as in-app or by email). Your continued use of the Service after an update means you accept the revised Policy. Where required, we will obtain your consent.

Redo AI, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA Privacy: privacy@hobb.ai · Legal: legal@hobb.ai