Privacy Policy

Effective date: October 12, 2026 · Last updated: October 12, 2026

This Privacy Policy explains how BLOK Group ("BLOK", "we", "us") collects, uses, discloses, and protects personal information in connection with the BLOK platform, including the Launchpad application, the Rex AI assistant, and related services (the "Service").

Our role. BLOK provides the Service to real estate organizations ("Organizations") and their users. For most data inside an Organization's workspace — such as client and contact information an agent uploads or synchronizes — the Organization is the data controller (or "business" under US state privacy laws) and BLOK processes that data on the Organization's behalf under our Data Processing Agreement. This Policy describes our practices both where we act on an Organization's instructions and where we act for our own purposes (such as account administration, billing, and security). If you are a client of a real estate professional who uses the Service, that professional or their Organization is responsible for their use of your information; contact them directly to exercise your rights, and we will support them in responding.

Account and profile information. Name, email address, phone number, role/title, real estate license number, profile picture, and authentication identifiers. If you sign in with Google, Microsoft, or Apple, we receive basic profile information from that provider with your consent.

Client and business content ("Customer Data"). Content you or your Organization submit or connect to the Service, including: contact and lead records synchronized from connected CRMs (such as Lofty); documents uploaded to the tenant knowledge base or document storage; chat messages exchanged with the Rex assistant (message content is treated as confidential personal information); property records you save; and names and email addresses of clients with whom you share properties or market reports.

Billing information. Subscriptions are processed by Stripe. We store your Stripe customer and subscription identifiers and subscription status; we do not store your full card number — card details are collected directly by Stripe. To enforce our one-trial-per-person policy, we store a one-way cryptographic hash (HMAC) of your email address and the card network fingerprint Stripe assigns to your payment card; neither is reversible to readable personal information.

Security and usage information. Sign-in events including IP address, browser/user agent, approximate location derived from IP address (using MaxMind GeoLite2 data), device identifiers, and risk signals used to detect account takeover and anomalous logins; audit logs recording actions taken in the Service (actor, action, affected record, before/after values, IP address, user agent); and signup funnel records (email, name, checkout status).

Communications data. If you use SMS-based multi-factor authentication, we process your phone number to deliver one-time codes (codes expire within 10 minutes and are not permanently stored). We send transactional and security emails via Amazon SES.

Provide, operate, and maintain the Service, including synchronizing data with integrations you connect;
Provide AI features: your chat messages, uploaded documents, and connected data are processed by AI models to generate responses, summaries, embeddings for search, CMAs, and reports (see Sections 3 and 3A);
Process payments, manage subscriptions and trials, and prevent trial and billing abuse;
Secure the Service: authentication, MFA, anomaly and fraud detection, audit logging, and abuse prevention;
Communicate with you about the Service, including security alerts, billing notices, and trial-expiry reminders;
Comply with legal obligations and enforce our agreements;
Improve the Service, using aggregated or de-identified information where practicable.

OpenAI generates Rex's responses for accounts in the United States.
OpenRouter routes Rex's requests for accounts in South Africa to independent model hosts. We instruct OpenRouter to use only hosts that do not retain or train on the data they receive. The current hosts are listed in Annex III of our Data Processing Agreement.
Amazon Web Services (Amazon Bedrock, in our AWS account) runs search embeddings, result ranking, and some supporting AI steps.

When you use AI features, your prompts, relevant documents, connected CRM data, connected Google data (see Section 3A), and MLS data (where entitled) are sent to these providers only to generate the response you asked for. We use these providers under terms that do not permit them to train their models on this data.

Documents ingested into the knowledge base pass through an automated redaction step that detects and masks sensitive identifiers (such as Social Security numbers, credit card and bank numbers, emails, phone numbers, names, and locations) before text is embedded for search.
Conversation history is retained to provide continuity across sessions (see Section 6).
To monitor and improve the quality of Rex's responses, we may send samples of Rex conversations to OpenAI for automated quality scoring. Conversations in which Rex accessed your Google data are never included.

If you connect your Google account, Rex can, at your request, read and search your Gmail messages, draft and send email on your behalf, read and manage files in Google Drive, and read and manage your Google Calendar events. We access this data only to perform the actions you ask Rex to take, and only while your Google account is connected.

BLOK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically:

We use Google user data only to provide and improve the user-facing features that use it.
We do not use Google user data for advertising, and we do not sell it.
We do not use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized artificial intelligence or machine-learning models.
We transfer Google user data to third parties only as necessary to provide those features (for example, to the AI providers in Section 3 to generate the response you asked for), to comply with applicable law, or as part of a merger, acquisition, or sale of assets with equivalent protections for the data.
BLOK personnel do not read Google user data, except with your explicit consent, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.

When you connect Google, we store the authorization token Google issues to BLOK, encrypted with AWS Key Management Service; we never receive your Google password. When you disconnect Google, or your account is archived or deleted, we revoke BLOK's access with Google and delete the token.

Google data that Rex uses to answer you becomes part of that conversation's history and is kept as described in Section 6. You can disconnect Google at any time in Launchpad under Integrations; Rex then stops accessing your Google data. You can also remove BLOK's access from your Google Account at https://myaccount.google.com/permissions.

Service providers (subprocessors). Vendors that process data on our behalf under contract, including the AI providers described in Section 3. For a list of our current subprocessors, please refer to Annex III of our Data Processing Agreement.

Integrations you connect. When you connect Google, Lofty, Dotloop, or another integration, we exchange data with that provider at your direction. Their privacy policies govern their use of your data; our use of Google user data is described in Section 3A.

Legal and safety. We may disclose information to comply with law, enforce our agreements, or protect the rights, safety, and property of BLOK, our users, or others; and in connection with a merger, acquisition, or sale of assets, subject to this Policy.

lp_session (Launchpad) and cc_session (Control Center): httpOnly, secure, signed session cookies that keep you logged in. Launchpad sessions last up to 8 hours (or 30 days with "remember me"); Control Center admin sessions are shorter.
A device-recognition cookie (cognito_device_key) supporting MFA device trust.

We do not currently use third-party analytics, advertising cookies, or cross-site tracking on the Service. Because we use no non-essential cookies, no cookie consent banner is currently required in most jurisdictions; if analytics are added later, this Policy and the consent flow must be updated first.

Customer Data: retained while your Organization's account is active. Records deleted in-app are archived (soft-deleted) rather than immediately destroyed, then deleted or de-identified in accordance with this Policy and our agreements. Rex conversations are the exception described below.
Rex conversations: kept so you can return to them, and permanently deleted 12 months after their last activity, together with their messages, attachments, and feedback. Conversations you delete are permanently removed within 30 days.
Audit logs and security events: retained for up to 7 years to meet security-compliance commitments.
Database backups: encrypted backups are retained for 30 days.
Trial-abuse ledger: hashed email and card fingerprint records are retained indefinitely to enforce the one-trial policy; they contain no readable personal information.
Compliance exports: archived to long-term encrypted cold storage on a lifecycle schedule.

We maintain a security program that includes: tenant isolation enforced at the database layer via row-level security on every tenant-scoped table; encryption in transit (TLS 1.2+; TLS 1.3 supported) and at rest (AWS KMS-managed keys across databases, file storage, caches, and logs, with key rotation enabled); application-layer AES-256-GCM encryption for high-sensitivity records such as MLS credentials; multi-factor authentication (TOTP, email, or SMS); a 12-character minimum password policy; web application firewall and rate limiting; threat detection (Amazon GuardDuty, including malware scanning of uploaded files); anomalous-login detection with risk scoring; comprehensive audit logging; and multi-availability-zone database deployment with 30-day encrypted backups. No system is perfectly secure; report suspected vulnerabilities to support@blok.co.

Depending on your location, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Under US state privacy laws (such as the CCPA/CPRA), you may also have the right to know what personal information we collect and to non-discrimination for exercising your rights. We do not sell personal information or share it for cross-context behavioral advertising.

To exercise rights over data we control (your BLOK account data), contact support@blok.co. To exercise rights over data in an Organization's workspace (for example, your data as a client of a real estate agent), contact that Organization; we will assist them as processor. We will verify your identity before acting on a request and respond within the time required by applicable law. You may also lodge a complaint with your local supervisory authority.