Privacy Policy

1N599 Labs ("Company," "we," "our," or "us") operates the ELARA AI platform ("Platform" or "Service") — an AI-powered real estate technology platform. Our principal place of business is 401 Forsyth Drive, Princeton, Texas 75407, United States.

For residents of the European Economic Area (EEA) and United Kingdom, 1N599 Labs is the data controller for personal data collected through the Platform.

This Privacy Policy applies to all personal data collected by 1N599 Labs through:

• The ELARA AI website and web application
• Mobile applications, APIs, and embeddable widgets
• Email, chat, and telephone communications with our team
• Third-party integrations connected to your ELARA account

It does not apply to third-party websites linked from our Platform. Those sites have their own privacy policies, which we encourage you to review.

3.1 Data You Provide Directly

• Identity data: name, username, profile photo
• Contact data: email address, phone number, mailing address
• Account credentials: hashed passwords, MFA tokens
• Property data: listing details, photos, documents, pricing
• Financial data: billing information, payment card details (processed by PCI-DSS compliant third parties; we do not store raw card numbers)
• Professional data: license numbers, brokerage affiliation, NMLS ID (for Loan Officers)
• Identity verification data: government-issued ID scans, selfies (processed by our identity verification adapter; retained per verification provider policy)
• Communications: messages, support tickets, survey responses

3.2 Data Collected Automatically

• Log data: IP address, browser type, operating system, referring URLs, timestamps
• Device data: device identifiers, hardware model, network information
• Usage data: pages visited, features used, clicks, search queries, session duration
• Location data: coarse location derived from IP address (not GPS unless you grant permission)
• Cookie and tracking data: session tokens, analytics identifiers (see Section 12)

3.3 Data From Third Parties

• Social login providers (Google, Apple) — name, email, profile picture
• MLS / listing syndication platforms
• Background check providers (with your consent)
• Credit bureaus via Loan Officer partners (with your written authorization)
• Public records (property ownership, tax assessments, permit data)

For individuals in the EEA, UK, or Switzerland, we process personal data only where we have a lawful basis under GDPR Article 6:

Where we rely on legitimate interests, you have the right to object at any time (see Section 9). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

• Registering and maintaining your account
• Providing AI-powered real estate services (listing creation, staging, document generation, market analysis)
• Matching buyers, sellers, agents, Loan Officers, and vendors on the platform
• Processing payments and issuing receipts
• Sending transactional communications (receipts, security alerts, system notices)
• Sending marketing emails — only with your explicit consent; unsubscribe at any time
• Improving and training AI models using anonymized, aggregated data only — we never use identifiable personal data for AI training without your explicit opt-in
• Detecting fraud, abuse, and unauthorized access
• Complying with legal obligations (tax reporting, court orders, regulatory requests)
• Enforcing our Terms of Service and Compliance Policy

We do not sell, rent, or trade your personal data.

We may disclose personal data to:

• Platform participants you engage with: Agents, brokers, Loan Officers, vendors, or buyers/sellers you initiate contact with — limited to what is necessary for the transaction
• Service providers (data processors): Cloud hosting (AWS/Vercel), payment processors (Stripe), analytics (anonymized), email delivery, identity verification — all bound by data processing agreements and prohibited from using your data for their own purposes
• Professional advisors: Lawyers, accountants, auditors under confidentiality obligations
• Regulatory and law enforcement: When required by applicable law, subpoena, court order, or to protect the rights, property, or safety of 1N599 Labs, its users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets — you will be notified via email and/or prominent site notice

1N599 Labs is based in the United States. If you access the Platform from outside the US, your data will be transferred to and processed in the United States. For EEA/UK users, we ensure appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, and UK International Data Transfer Agreements (IDTAs) as applicable.

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any right, email privacy@elara.ai or contact our Data Protection Officer at dpo@elara.ai. We will respond within 30 days (extendable by 60 days with notice for complex requests). We may require identity verification before fulfilling certain requests.

California residents have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Categories and specific pieces of personal information collected, sold, or disclosed in the past 12 months
• Right to Delete: Deletion of personal information (subject to exceptions)
• Right to Correct: Correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising
• Right to Limit Sensitive Personal Information: Restrict use of sensitive PI to providing requested services
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights

To submit a verifiable consumer request, email privacy@elara.ai with subject line "California Privacy Request." You may also authorize an agent to submit requests on your behalf by providing written authorization.

Shine the Light (CA Civil Code §1798.83): We do not disclose personal information to third parties for their direct marketing purposes without your consent.

The Platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal data, we will delete it promptly. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@elara.ai.

For users between 13–17, we recommend parental guidance. Certain services (e.g., financial products, lease agreements) require users to be 18 or older.

We use the following categories of cookies and similar technologies:

Do Not Track: We honor browser Do Not Track (DNT) signals for analytics cookies. You may also manage cookie preferences in your account settings.

ELARA AI's AI agents process property data and documents to provide automated services including photo enhancement, market pricing, document generation, and buyer-seller matching. Regarding automated decision-making:

• AI-generated valuations, descriptions, and recommendations are informational tools only — not binding decisions
• No automated decision produces a legal or similarly significant effect on you without human review
• Identity verification and background check outcomes can be appealed by contacting support
• You can request a human review of any AI-assisted decision
• We do not use personal data for AI training without explicit opt-in

1N599 Labs implements technical and organizational measures to protect your personal data against unauthorized access, loss, or destruction:

• Encryption in transit: TLS 1.3 for all data transmissions
• Encryption at rest: AES-256 for all stored data
• Access controls: Role-based access, principle of least privilege, MFA for all staff
• Infrastructure: SOC 2 Type II compliant cloud providers
• Regular penetration testing and vulnerability assessments
• Incident response plan with 72-hour breach notification to regulators (GDPR Art. 33) and affected users

No system is 100% secure. If you discover a security vulnerability, please responsibly disclose it to security@elara.ai.

We may update this Privacy Policy periodically. For material changes, we will notify you by email (at least 30 days in advance) and display a prominent notice on the Platform. Continued use of the Platform after the effective date constitutes acceptance of the revised policy. We maintain an archive of prior versions available upon request.

For privacy-related inquiries, requests, or complaints: