Privacy Policy

Last Updated: April 6, 2026

Sifta ("we," "us," or "our") operates the website at joinsifta.com and provides an AI operating system for real estate agents that connects to email, calendars and messaging to do work on the agent's behalf (collectively, the "Service"). This Privacy Policy describes how we collect, use, store, share, and protect information when you visit our website, join our waitlist, or use the Service as an active subscriber. By using the Service in any capacity, you agree to the practices described in this policy.

1. Information We Collect

We collect information in the following categories depending on how you interact with the Service:

Account and Registration Information

• Full name: to identify and address you in communications.
• Email address: to authenticate your account, send notifications, and communicate with you.
• Phone number: to send you SMS-based assistant messages and onboarding communications.
• Referral source: to understand how you discovered Sifta.
• Account credentials and session tokens: to securely authenticate your sessions.

Billing and Subscription Information

• Subscription plan, status, and billing history. Payment card details are handled directly by Stripe and are not stored on Sifta's servers.
• Stripe customer and subscription identifiers used to manage your account.

Connected Account Information (Gmail and Outlook)

• The email address of connected Gmail or Outlook accounts.
• Encrypted OAuth access and refresh tokens, stored solely to maintain your inbox connection.
• Token expiry metadata used to refresh connections automatically.
• Connection status (connected, disconnected, or error).

Email Content and Mailbox Data

• Email content including sender and recipient addresses, subject lines, body text, timestamps, and mailbox labels or folder metadata.
• AI-generated summaries, classifications, and priority scores derived from email content.
• Records of actions taken on emails (e.g., archived, labeled, marked as read) at your direction.

Usage and Interaction Data

• Commands and messages you send to the Sifta assistant via SMS or other interfaces.
• Feature usage patterns and product interaction events (collected via PostHog).
• Onboarding preferences and assistant configuration settings.

Technical and Security Data

• IP address, browser type, device type, and operating system, used for security monitoring and abuse prevention.
• Server logs retained for a limited period for security and debugging purposes.
• Approximate geographic region derived from IP address.

2. How We Use Your Information

We use the information we collect to:

• Authenticate your identity and maintain secure access to your account.
• Connect your Gmail or Outlook inbox through OAuth and keep that connection active.
• Read, analyze, classify, summarize, and prioritize your emails to deliver the core Service features.
• Perform user-enabled actions on your emails, including labeling, archiving, moving, marking as read, or moving to trash.
• Draft email replies on your behalf, saved to your Gmail Drafts folder for your review before sending.
• Send you assistant messages, summaries, and alerts via SMS or other messaging channels you have enabled.
• Send onboarding, product, and support communications.
• Process payments and manage your subscription.
• Improve the reliability, performance, and security of the Service.
• Detect and prevent fraud, abuse, and unauthorized access.
• Comply with applicable legal obligations.

3. Automated Processing and Limited Human Access

Email content and mailbox data are processed primarily by automated software and AI systems to deliver the Service. Sifta employees do not read your emails in the ordinary course of business.

Limited human access to email content or account data may occur only in the following restricted circumstances:

• When you explicitly request support and share content with us as part of that request.
• To investigate fraud, abuse, security incidents, or critical technical issues that cannot be resolved through automated means.
• When required by applicable law, regulation, or a valid legal process.

Any such access is limited to what is reasonably necessary, restricted to authorized personnel, and subject to confidentiality obligations.

4. AI Model Training and Advertising Commitments

We make the following binding commitments about how your data is and is not used:

• We do not sell your data. Your personal information, email content, and usage data are never sold to third parties.
• We do not use your data for advertising. Your email content and personal information are never used to target you or anyone else with advertising.
• We do not train generalized AI models on your emails. Your email content is not used to train, fine-tune, or improve AI or machine learning models that are shared across users or deployed externally.
• Your data is processed solely to deliver and improve the features of the Service for your own account, in a manner consistent with this Privacy Policy.

5. Google API and Gmail Data

If you connect a Google account, Sifta will access Gmail and related Google account data only as needed to provide the features you have enabled. This includes reading, classifying, summarizing, and taking user-directed actions on your emails.

Sifta's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Sifta does not sell Google user data.
• Sifta does not use Google user data for advertising purposes.
• Sifta does not use Gmail or Google Workspace API data to train generalized AI or machine learning models.
• Sifta does not allow humans to read Gmail data except in the limited circumstances described in Section 3 above.
• Sifta only transfers Google user data to third parties as necessary to provide or improve the user-facing features of the Service, as permitted by the Google API Services User Data Policy.

You may revoke Sifta's access to your Google account at any time through your Google Account Permissions. Revoking access will disconnect your Gmail inbox and disable all Gmail-related features.

6. Microsoft and Outlook Data

If you connect a Microsoft account, Sifta will access Outlook and Microsoft 365 email data only as needed to provide the features you have enabled. This includes reading, classifying, summarizing, and taking user-directed actions on your emails.

• Sifta does not sell Microsoft user data.
• Sifta does not use Microsoft user data for advertising purposes.
• Sifta does not use Outlook or Microsoft 365 connected data to train generalized AI or machine learning models.
• Sifta does not allow humans to read Outlook data except in the limited circumstances described in Section 3 above.

You may revoke Sifta's access to your Microsoft account at any time through your Microsoft Account App Permissions. Revoking access will disconnect your Outlook inbox and disable all Outlook-related features.

7. Third-Party Service Providers (Subprocessors)

Sifta relies on trusted third-party service providers to operate the Service. These providers process data only as necessary to perform their specific function and are bound by confidentiality obligations. We do not authorize them to use your data for their own purposes.

Our current subprocessors include:

• Supabase: database, authentication, storage, and serverless compute.
• Stripe: payment processing and subscription billing.
• OpenAI: language model processing for email analysis and summarization.
• PostHog: product analytics and usage event tracking.
• Messaging and SMS providers: delivery of assistant messages and notifications.
• Cloud infrastructure vendors: hosting and compute infrastructure.
• Google and Microsoft: connected account providers for Gmail and Outlook integrations.

We will update this list when we add or change subprocessors. If you have questions about a specific provider, contact us at privacy@getsifta.com.

8. Data Retention and Deletion

We retain your account information, subscription records, and connected inbox data for as long as your account is active or as reasonably necessary to provide the Service, resolve disputes, maintain security, and comply with legal obligations.

Email content, AI-generated summaries, action logs, and mailbox metadata are retained only as long as necessary to operate the Service for your account. Backup systems may retain copies for a limited additional period before they are purged.

To request deletion of your data, email us at privacy@getsifta.com. We will process your request within 30 days and confirm deletion in writing. Upon deletion, your data will be removed from active systems. Removal from encrypted backup systems may take an additional period consistent with our backup retention schedule.

Some aggregate, non-identifiable statistics (such as total user counts) may be retained for internal reporting and are not linked to your identity.

9. Security

We implement industry-standard technical and organizational measures to protect your information:

• All data is transmitted over TLS (HTTPS), never in plaintext.
• Data at rest is encrypted where supported by our infrastructure providers.
• OAuth tokens are encrypted at the application layer before storage using AES-256-GCM.
• Access to user data is restricted to authorized personnel with a legitimate need.
• Rate limiting and abuse-prevention controls are applied to all public endpoints.
• Security events and access to sensitive data are logged and monitored.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify affected users promptly in the event of a breach involving personal data, as required by applicable law.

10. Product Analytics (PostHog)

We use PostHog to understand how users interact with our website and Service. PostHog may collect pages visited, clicks, session behavior, browser and device type, approximate geographic region, and custom events such as form submissions and feature usage.

PostHog does not receive your email content. You can learn more about PostHog's data practices at posthog.com/privacy.

11. Children's Privacy and Minimum Age

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, please do not use the Service or submit any personal information to us.

The Service is additionally not directed at children under 13 years of age. If you believe a minor has provided us with personal information, please contact us at privacy@getsifta.com and we will promptly delete it.

12. International Use

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States or other jurisdictions where our service providers operate. By using the Service, you acknowledge that your data may be subject to the laws of those jurisdictions. You are responsible for complying with applicable local laws when using the Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify active users by email. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us:

Sifta Privacy Team

Privacy inquiries: privacy@getsifta.com

Legal notices: legal@getsifta.com

We aim to respond to all privacy requests within 30 days.

Review our Terms of Service

Understand your rights and obligations when using Sifta.

Terms of Service →