Privacy policy

Effective September 25, 2026

GCI Vault ("we", "us") makes software that helps independent real estate agents track their deals, deadlines and money. This policy covers the GCI Vault app, on the web and on phones, and this website. If you have a question about it, email support@gcivault.com.

What we collect

Your account

Your name, your email address, how you sign in (with Google or with a code we email you; GCI Vault has no passwords), your time zone and your settings.

The records you add

The people and properties you work with, your listings and deals, deadlines, showings and ratings, notes you type or dictate, and documents you upload, such as contracts, closing statements and receipts, with the details we read from them. It also includes the money side: commission, expenses and mileage.

Bank and card accounts you connect

If you choose to connect a bank or card account, our partner Plaid gives us the account's name, balance and transactions. The connection is read-only: we can't move money, and we never see or store your bank username or password. You can disconnect an account at any time.

Your devices and sign-ins

The devices you're signed in on (a device name you can change, and your browser or app version), when you signed in and last used each one, and the IP address a request came from, which we keep only as a one-way keyed hash, never as the address itself. We use this to keep your account secure and to let you see and sign out your devices.

Problem reports you choose to send

When you use Report a problem, you see exactly what will be sent before you send it: your description; a screenshot of the screen you were on, if you keep it; and diagnostics you can switch off. The diagnostics are the addresses of the app's last requests with their status, timing and request IDs, recent errors, and your app version, device, operating system and settings. They never include what was in those requests, client names or contact details, dollar amounts, documents or bank data.

Messages

The emails you send us, and our replies.

The web app does not use your device's location, and this website sets no cookies.

How we use it

• To run GCI Vault for you: showing your pipeline, working out deadlines and commission, importing transactions and keeping your records in step across your devices.
• To keep your account secure: signing you in and spotting a sign-in session that has been copied or stolen.
• To send the emails and notifications the service needs, such as sign-in codes, and the reminders and summaries you choose to receive.
• To bill you for your subscription, once billing begins, and to answer your questions and fix problems.

Information about other people

The records you add include details about your clients and contacts. We process that information on your behalf, to provide GCI Vault to you, and for no other purpose. If you send a client a link to rate a home they have seen, the page they open shows only that home, and we save the rating and note they choose to give. If you send a referral to another agent, they get the details you chose to share.

Who helps us run GCI Vault

We share information only with companies that help us run GCI Vault, only what each needs, and only for that job:

• Plaid connects the bank and card accounts you choose to link. Plaid's end user privacy policy covers how Plaid handles that connection.
• Cloudflare runs our domain, forwards email sent to our addresses and hosts this website.
• Resend delivers our emails, such as sign-in codes.
• Google, only if you choose to sign in with Google. We then receive your name, email address and Google account ID.
• Stripe will process subscription payments when billing begins. We never see or store your full card number.

We store your data on servers in the United States. We will also disclose information when the law requires it. If GCI Vault is ever sold or merged, your information would go with it, under this policy, and we would tell you first.

How long we keep it

• While your account is open, we keep your records so the app works.
• You can export everything at any time, as CSV and JSON files, with the documents you've uploaded.
• Uploaded documents are kept for a limited time after the deal they belong to ends, and we email you before any of them are deleted. The details you recorded from them, such as dates and amounts, stay.
• Records of sign-in attempts and ended sessions are deleted after a year.
• If you close your account, you can still sign in, read and export your data for 60 days. After that we delete your records and files. We keep a minimal record that the account existed, and billing records for as long as the law requires.

How we protect it

Everything travels over encrypted connections. Our database keeps each account's records apart from every other account's. Bank connection tokens and your documents are encrypted with keys kept separately from the database. Sign-in sessions are tied to the device they were made on, and you can see your devices and sign any of them out. No system is perfectly secure, but we work to protect your information, and we'll tell you promptly if a breach affects you.

Your choices and rights

• See and correct your information in the app.
• Export all of it at any time.
• Disconnect bank and card accounts, and change which notifications you get.
• Close your account and have your data deleted, as described above.

Depending on where you live, you may have further rights, such as to know, correct or delete what we hold about you. We honour these requests from everyone. Email support@gcivault.com, and we will never treat you differently for asking.

Children

GCI Vault is for real estate professionals and is not meant for anyone under 18.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.

Contact

Email support@gcivault.com.