Effective date: 28 July 2026
This policy describes how AIRAmax processes personal data through the AIRAmax real-estate CRM (the "Service"). It is published at /privacy on the Service's public site and is the privacy policy referenced by the Service's Google OAuth consent screen.
Placeholder — before this policy is published to production, replace this paragraph with AIRAmax's registered company name, registered office address and company registration number (IČO). This document intentionally does not invent that data.
Two different roles appear in this policy and they are not the same:
If you are a broker's client and have a question about your data, please contact the agency you are working with directly — they are the controller and can act on your request. If you are an AIRAmax user (a broker or agency admin) with a question about your own account, see Contact below.
AIRAmax offers optional Gmail and Google Calendar connections (Settings → Moje prepojenia). This section names the Google user data these connections access, and is the section Google's OAuth verification specifically requires.
Scopes requested and why:
| Scope | What it lets us do | Why we ask for it |
|---|---|---|
Gmail read (gmail.readonly / gmail.modify-equivalent) | Read your inbox messages | Show your e-mails inside the CRM inbox, match them to contacts, and let AIRA (the in-product AI assistant) suggest a next step |
| Gmail send | Send e-mail as you | Let you reply to a client from inside the CRM, from your own address |
| Calendar read/write | Read and create/update calendar events | Two-way sync of viewings and tasks with your Google Calendar |
What we do with it: Gmail messages you have connected are copied into AIRAmax's database so they can be displayed in the CRM inbox and linked to the right contact. Message content is also sent to an AI model so it can be classified (e.g. "this is a viewing request") and summarised — see §3 below for exactly which provider sees what. Calendar events are synced in both directions so a viewing booked in AIRAmax appears on your Google Calendar and vice versa. We do not read Google data outside these two connections (for example, we do not access Google Drive, Google Contacts, or any other Google product).
How long we keep it: synced Gmail messages and calendar events are kept for as long as the connection stays active, subject to the org's configured retention windows (Settings → GDPR). Disconnecting a Google account (Settings → Moje prepojenia → Odpojiť) immediately stops all further sync. You additionally get an explicit choice at disconnect time between "Ponechať synchronizované správy v CRM" (keep already-synced messages) and "Vymazať synchronizované správy z CRM" (delete already-synced messages from AIRAmax's database right away) — choosing the latter is the fastest way to have your Gmail content removed from our systems.
Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Connected Gmail messages are processed by an AI model so that AIRAmax can classify a message (e.g. inbound lead vs. spam vs. an existing client), summarise it, and — where you ask for it — draft a suggested reply or extract a structured property/demand record from it. This processing routes to one of two providers, both of which are listed with the rest of AIRAmax's sub-processors on the sub-processors page:
Neither provider uses this content to train their models. This is a contractual commitment from both providers, not a default behaviour we are merely hoping for.
Beyond connected Gmail/Calendar data, running the Service involves the account and usage data any CRM needs: broker and agency account details, the properties/demands/contacts/deals an agency enters, uploaded photos and documents, e-mail and messaging history handled through AIRAmax's own inbox (independent of any Google connection), billing data (processed by Stripe), and standard technical logs. Property documents and inbox attachments are stored as private objects and served to your browser only via short-lived, signed URLs — they are never publicly listable.
Retention windows for client and prospect contact data are configurable per agency (Settings → GDPR) and apply going forward from when they are set. Google-sourced data specifically follows the shorter path described in §2: it stops syncing the moment you disconnect, and you can request immediate deletion of everything already synced via Settings → Moje prepojenia → Odpojiť → Vymazať synchronizované správy z CRM. Account data is deleted or anonymised when an agency's subscription ends, subject to any legal obligation to retain billing records for longer.
AIRAmax uses a small number of sub-processors to run the Service — hosting, e-mail delivery, billing, error monitoring, and the two AI providers described above. The full list, including which of them can see Google user data, is published separately on the sub-processors page so it can be updated on its own schedule without re-publishing this whole policy.
Depending on your role (see §1) you have the rights GDPR gives a data subject with respect to whichever party is your controller: access to your data, correction, erasure, restriction of processing, data portability, and the right to withdraw consent at any time. To exercise a right against AIRAmax as controller (your own broker/admin account), or to ask a question about this policy, use the contact details below.
Some sub-processors (Google, OpenRouter, Stripe) are US-based or process data on US infrastructure. Where that applies, transfers rely on the sub-processor's own EU-US Data Privacy Framework certification or Standard Contractual Clauses, as applicable to that provider.
We may update this policy as the Service changes. Material changes — in particular, any change to which Google user data we access or which sub-processor sees it — will be reflected here with an updated effective date, and, where required, we will ask connected users to re-consent.
For questions about this policy, a data subject rights request against AIRAmax as controller, or anything else related to how AIRAmax processes personal data, contact [email protected].