Last updated September 15, 2026
This Privacy Notice for CarmelTech LLC ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information? We do not ask for it, apart from your sign-in credentials and the payment details you give our payment providers when you buy something, and we do not otherwise seek it out. But you decide what to write in your log and what to attach, and a document you upload could contain information that the law treats as sensitive. Because of that, the one feature that reads inside your files, attachment search, stays off until you turn it on. Learn more about our AI features and how to control them.
Do we use your information to improve our product? Yes. We analyse how the Services are used, and information from customer accounts, to understand what our users need, to make the product better, and to decide which commercial partnerships to pursue. That is our own purpose, it rests on our legitimate interests, and you can object to it. We do not sell your log and we do not disclose the content of your entries or your files to a commercial partner. Learn more about how we process your information.
Do we collect any information from third parties? We may receive limited attribution data from advertising and analytics partners to help us understand how users discover our Services. If you connect a calendar or a booking feed, we also receive the events or reservations that connection makes available.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties, including advertising platforms to whom we may disclose hashed contact information (e.g., email addresses) to build custom and "lookalike" audiences for marketing campaigns, and advertising partners to whom we report that a sign-up, trial or purchase happened. Learn more about when and with whom we share your personal information.
Do we "share" personal information for targeted advertising? Yes. When we upload hashed email addresses to advertising platforms for audience matching and lookalike targeting, this qualifies as "sharing" for cross-context behavioral advertising under California and other US state privacy laws. We do not receive money in exchange for this disclosure, but you still have the right to opt out. Learn more about your right to opt out of targeted advertising.
Do we share your information with AI assistants you connect? Only when you choose to. If you connect a third-party AI assistant (such as ChatGPT or Claude), the REPSLog data it accesses is shared with that provider and handled under its own privacy policy. If you use our Public API, your data goes to whichever API client you have authorised, which may be one of your own. These connections are optional and limited to eligible subscribers. You can revoke an API key from our developer portal at any time, and disconnect an AI assistant from that assistant's own connector settings. Learn more about AI assistant integrations and our Public API.
How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? The easiest way to exercise your rights is by emailing us at [email protected]. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
Sensitive Information. Different laws define this differently, and the examples here are not a complete list. Depending on where you live it can include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, genetic or biometric data, information about sex life or sexual orientation, and also government identifiers, account credentials, precise location, the contents of your communications, citizenship or immigration status, and financial account information. Apart from your sign-in credentials and the payment details you give our payment providers when you buy something, we do not ask you for any of it, we do not need it to provide the Services, and we ask you not to put it in your log. We cannot rule it out, though, because you choose what to write and what to attach, and a receipt or a document can contain more than the amount on it. The one feature that reads inside your files stays off until you turn it on, on its own screen: see Section 5. Some other data you provide, such as what you dictate or a property address, may also be considered sensitive in some jurisdictions.
Payment Data. We never receive your card number or the security code on your card. They go directly to the app store or payment provider you pay through, and payment is processed there. Our subscription-management provider receives transaction and subscription information used to manage your subscription, and does not handle or store your card details. Depending on how you pay, the providers involved are the app store you bought through and our payment and subscription providers.
Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Google or Apple account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.
Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:
This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
In Short: Some information, such as your Internet Protocol (IP) address and/or browser and device characteristics, is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
Like many businesses, we also collect information through cookies and similar technologies.
Session Replay. Our analytics provider, and on our mobile apps our error-monitoring provider, record and play back user sessions on our Services. Session replays capture your interactions with our Services: screen activity, clicks and scrolls. We use session replays for the purposes of debugging, identifying usability issues, and improving the user experience. Everything you type into a field is masked before the replay leaves your device, passwords included. Other text on the screen is not masked, and images are not masked on the web. Session replays may be captured on both our web and mobile applications.
The information we collect includes:
REPSLog allows you to connect external calendar accounts (Google Calendar, Microsoft Outlook Calendar) so you can view calendar events and convert them into work log entries.
Data accessed: When you connect a calendar account, we access your calendar names, event titles, times, durations, locations, and descriptions. We access this data in read-only mode. We cannot create, modify, or delete your calendar events.
How we use calendar data: We use your calendar events to display them in REPSLog and to let you turn them into work log entries. If you convert an event, the work log entry that results is from then on processed like any other entry, as described in Sections 2 and 5, which includes being indexed so that you can search it. We do not sell the calendar feed, use it for advertising, or use it to train any AI model. Once you convert an event into a work log entry, that entry is treated like the rest of your log.
Booking calendars. You can also add a booking calendar by pasting a link from a platform such as Airbnb or Vrbo. We store that link, encrypted, and check it regularly so your bookings stay up to date without you opening the app. We keep the stay itself, meaning the dates, the number of nights, the platform, the property it belongs to and, on some platforms, the booking's reference code, so that your history survives after the platform stops publishing it.
Token and link storage: OAuth access and refresh tokens, and booking calendar links, are encrypted before being stored in our database. Deleting your account deletes them.
Event data retention: Events from a connected Google or Microsoft calendar are fetched on demand and displayed in real time; we do not store them on our servers. Bookings from a booking calendar are stored, as described above, and are deleted with your account.
Revoking access: You can disconnect a calendar account at any time from the Calendar settings within REPSLog. You can also revoke access directly from your account settings:
Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Our use of information received from Microsoft Graph APIs will adhere to the Microsoft APIs Terms of Use.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. Where a third party acts as our service provider, our agreement with it restricts what it may do with your personal information to what we have instructed, and it may not disclose that information except to its own authorised subprocessors, or where our agreement with it or the law allows. Some of the recipients listed below do not act on our behalf: the advertising platforms, and any third-party service you choose to connect yourself, act independently under their own terms and privacy policies, and the entries below say which are which.
The categories of third parties we may share personal information with are as follows:
We also may need to share your personal information in the following situations:
In Short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.
We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, so that we can measure and retarget our own advertising on other websites. REPSLog itself does not display advertisements.
To the extent these online tracking technologies are deemed to be a "sale"/"sharing" (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by submitting a request as described below under section "DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?"
Necessary Cookies: These cookies are essential for the Services to function properly. They enable core features like authentication, security, and session management.
Analytics Cookies: These cookies help us understand how you use the Services, which features are most popular, and where we can improve. We use a product analytics provider, including session replay, on our web and mobile applications, and a website analytics provider on our marketing website (reps-log.com).
Marketing Cookies: These cookies help us measure the effectiveness of our marketing campaigns and understand how users discover REPSLog. We use an install attribution provider for this.
On our web application, we display a cookie consent banner. For users in the EU/EEA, the United Kingdom and Switzerland, we operate in opt-in mode: analytics and marketing cookies are disabled until you actively consent. For users in other regions, we operate in opt-out mode: analytics and marketing cookies are enabled by default, but you can opt out at any time through the cookie settings.
Our website analytics provider tracks and analyses the use of our marketing website (reps-log.com). The advertising features we may use include remarketing, display-network impression reporting, and demographics and interests reporting. You can opt out of this tracking with the browser add-on at https://tools.google.com/dlpage/gaoptout, and of the advertising features through My Ad Center and the equivalent setting on mobile. Other opt-out routes include https://thenai.org/how-to-opt-out/ and https://thenai.org/how-to-opt-out/advertising-privacy-settings-on-mobile-devices/.
In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.
As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). This section explains what they do with your information.
We provide the AI Products through third-party service providers ("AI Service Providers"). Depending on which AI Product you use, the content and other information described below is shared with and processed by one of them in order to provide that feature. They act as our processors under agreements that bar them from training their models on your data. See also "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?".
Our AI Products are designed for the following functions:
Our AI Service Providers process your content under written agreements, on our instructions, to return the result to your account. Under those agreements neither may use what we send to train their models. They may also retain what they receive for limited periods, for security, abuse prevention or running their service, depending on the provider, the service and its configuration, as set out in their own terms and our agreements with them. Because of that, turning a feature off cannot reach back into a request we have already made, nor into the log our infrastructure provider keeps of those requests, which is described in Section 15. The results are stored in your account. You and anyone you have delegated access to can see them. Our own staff can see them only where that is needed to provide or support the Services, or to carry out the internal analysis described below, and only subject to our access controls.
The AI Products are not all controlled the same way, because they do not all carry the same risk. This is how each one works and why.
Features you trigger yourself, namely AI-powered descriptions and speech-to-text, run only when you press the button. Nothing is sent unless you ask for it. Where data protection law requires a legal basis, these are necessary for the performance of our contract with you: you asked us to write up or transcribe the entry, and that is the service.
Semantic search runs in the background, because an index has to exist before a search can use it. Where data protection law requires a legal basis, it rests on our legitimate interests in giving you a search that actually finds what you meant: the processing is on the content of your own log, including anything you have written about other people; it is for your benefit; it is limited to your entry descriptions; and the result is used only to answer searches inside your account, apart from the copy in the analytics warehouse described below. You can object at any time under Settings > AI and privacy. Objecting stops us sending anything further and stops us using what we derived, straight away, and the derived data itself is then deleted as described below. The switch is available on every plan. Because there is no keyword search in REPSLog, objecting means search will no longer work for your account.
Activity suggestions are off until you turn them on. Nothing about your entries is sent for this purpose beforehand. Where data protection law requires a legal basis, we rely on the performance of our contract with you: once you turn the feature on, the processing is necessary to provide it. Turning them off stops it and deletes what we derived.
Attachment search is off until you turn it on, on its own screen, separately from everything else. We keep it separate because reading inside a file is a bigger step than reading the line of text you typed, and it should be its own decision rather than something bundled into another one. Where data protection law requires a legal basis, we rely on your consent. Please do not attach a file holding sensitive information about somebody else, and if you have one, leave this feature off. You can turn it off at any time under Settings > AI and privacy, on its own and without losing search, and we delete the descriptions we were using. A copy of those descriptions written to our analytics warehouse before you turned the feature off stays there while your account is open, and is removed when you close it, as described below. If you want it removed sooner, object using the contact details in this notice and we will do it. Turning it off does not affect what we lawfully did before.
When we delete what we derived. Whenever you object to a feature or withdraw a consent, we stop sending anything further and stop using what we derived from your data straight away, and the derived data is then stored only until it is deleted. Deleting the derived data we were using (the search index built from your entries, the descriptions of your files, the list of activities we worked out) takes up to 31 days. A copy already written to our analytics warehouse is a separate thing: the search index copy there is removed on the same schedule, and the rest stays until you close your account or ask us to remove it sooner. That window exists so that changing your mind, or switching something off by accident, costs you nothing: the window is 30 days and the deletion job runs within a day of it closing, which is where the 31 comes from. Turn it back on within 30 days and nothing is deleted, and you do not have to wait for it to be built again. If you would rather not wait, contact us using the details in this notice and we will delete it sooner.
Our analytics warehouse keeps a history, and you should know how that behaves. It holds earlier versions of entries you have since edited or deleted, so a copy can outlive the entry itself. Closing your account deletes your information from the systems that run the Services, and removes the information that identifies you from the warehouse, as described under "What we do with your log for our own purposes" below. Both are subject to the limited provider retention described above.
What we keep after you close your account, and why. Closing your account removes your entries, your files, your properties and everything we derived from them from the systems that run the Services. A few things are deliberately kept. Apart from the AI request log described below, none of them holds what you wrote:
Your entries, your files, your properties, your categories and participants, your preferences, your Public API keys and passkeys, your delegation relationships, your calendar connections and booking calendars, the totals we worked out from them and the counters that track your use of daily limits are all deleted with your account, except for the usage records described above, which are what is left of your entries and properties once the text, the addresses and the names have been taken out. What we keep rests on our legal obligations, for the tax and billing records, and otherwise on our legitimate interest in paying the people who refer customers to us, keeping accurate books, being able to answer you about past support conversations, and understanding how our product is used over time. You can object to any of it using the contact details in this notice. If you want us to look again at anything here, contact us using the details in this notice.
You decide what goes into your log, and you are responsible for it. You choose what to write, whom to write it about, and what to attach. Where your entries or files concern other people, such as tenants or contractors, you are responsible for having a lawful reason to record that information and for telling those people whatever the law requires. Please do not upload a file you have no right to hold. If a person who appears in a customer's log contacts us, we will help that customer respond. See the contact details in this policy.
What we do with your log for our own purposes. Separately from running the features above for you, we keep a copy of your entries and your properties in our own analytics warehouse, which we query across accounts. It keeps a history rather than a snapshot, so it also holds earlier versions of entries you have since edited or deleted. We use it to understand who our users are and what they need, to see which features work and which do not, to improve the product, and to decide which commercial partnerships to pursue so that we can offer our users better services. The copy includes the text of your entries, the numerical representation we derived from each one, your property addresses, the file names of anything you attach and any note kept against a file, including one an AI feature drafted for you. It also includes your settings, including the record of the AI choices you have made. The files themselves are not copied there; they stay in storage.
We are telling you this plainly because it is the part of this notice that a reader is most likely to be surprised by. This work is internal and it is carried out on our own behalf rather than yours, which means that for it we are responsible as a controller in our own right, and it rests on our legitimate interests in understanding and improving our business. We do not sell your log, we do not publish it, and we do not disclose the content of your entries or your files to a prospective or actual commercial partner as part of this analysis. You can object to this processing at any time using the contact details in this policy. We will stop using your log for this purpose. The copy in the warehouse is made automatically as you keep using REPSLog. When you close your account we remove the information in it that identifies you, and keep the rest.
What is removed: the text of your entries and anything we derived from it, the file names of anything you attached and the descriptions our AI providers wrote of those files, your property addresses and the names you gave them, your email address, your IP address (replaced with a blank placeholder), and your location beyond the country and state.
What remains is a record of how the product was used and what was bought. In full, so that you are not surprised by it:
About the dates in those records. The dates inside your entries, properties and settings are reduced to the day. But each record also carries the time it was created, edited or deleted, and your sign-up, trial, purchase, renewal and cancellation events carry their own timestamps, and those are not reduced. So the day-level reduction is real but partial, and we would rather say so than let you assume otherwise.
We keep them because they tell us how REPSLog is used, and we would otherwise lose that history every time somebody leaves. We keep them for as long as they tell us something useful about how REPSLog is used, and then aggregate them, so that what is left describes groups of users rather than any single account.
These records are pseudonymised, not anonymous, and the difference matters. They stay attached to an internal account number. That number is not your name or your email, and nothing in your entries, your files or your settings survives to connect it to you, because those are gone. But it can still be connected back to you through the billing, referral, support and administrative records listed above, which we keep for their own reasons, and through our routine backups for the period described in Section 8. We say pseudonymised rather than anonymous because anonymous would mean nobody could make that connection, and that is not the case here.
This applies on every plan, including the free plan and lapsed subscriptions. You can contact us using the contact information provided if you would like help, or a copy or deletion of your data.
Separately from the AI Products described above, eligible subscribers can connect their REPSLog account to third-party AI assistants, currently ChatGPT (OpenAI) and Claude (Anthropic), and can access their data through our Public API. These integrations are optional and off by default; they are only active if you choose to connect them.
This is different from the AI Products above. With the AI Products described earlier, we send limited data to AI service providers acting on our behalf to power in-app features. With these integrations, you connect an assistant or API client and direct it to read your data or create, update, and delete entries for you. The assistant's provider receives your data and handles it as an independent party under its own terms and privacy policy, which we do not control.
What is shared. When you use a connected assistant or the Public API, the data accessed may include your account email address, display name, and subscription status; your work log entries (descriptions, durations, dates); properties (including addresses); categories; participants; hours summaries, dashboards, and statistics; and limited account settings. The assistant or API client accesses this data through defined operations to carry out the requests you make.
Authentication. Access is authenticated through our identity provider, which is bridged to your existing REPSLog account, and, for the Public API, through API keys you generate in our developer portal. You are responsible for keeping API keys confidential.
The third party's policy governs. Once your data is shared with an AI assistant provider at your direction, that provider processes it under its own privacy policy and terms, not this Privacy Notice. We are not responsible for the provider's data practices. We recommend reviewing the privacy policy of any assistant you connect, for example: OpenAI and Anthropic.
Your control and how to disconnect. Connecting an assistant or creating an API key is entirely your choice. You can revoke an API key at any time in our developer portal, and disconnect an assistant from that assistant's own connector settings. Deleting your REPSLog account does both. Disconnecting stops further access going forward; it does not retrieve data the third party already received, nor does it delete entries already created in your account. To delete data in your REPSLog account, see Section 18.
In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.
Our Services offer you the ability to register and log in using your third-party social media account details (like your Google or Apple logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. We receive the account identifier and the profile information the provider makes available for signing in, which is usually your name, your email address and, where the provider supplies it, a profile picture.
We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.
In Short: You may grant other users access to view or manage your account data. You control who has access and can revoke it at any time.
Our Services include an account delegation feature that allows you to invite other users to access your account data. When you delegate access:
If you are a delegate accessing another user's account, you acknowledge that you are accessing someone else's personal data and agree to use it only as authorized by the account owner and in accordance with this Privacy Notice.
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Most purposes in this notice do not require us to keep your personal information for longer than twelve (12) months past the termination of your account. The exceptions are the records listed under "What we keep after you close your account" in Section 5, which are kept for the reasons and periods described there. Note: if you cancel your subscription but do not delete your account, uploaded assets (images and documents) may be retained for up to 3 years from cancellation as described in our Terms and Conditions. Requesting account deletion removes your log and everything we derived from it, except for the records listed under "What we keep after you close your account" in Section 5.
When we have no ongoing legitimate business need to process your personal information, we delete or anonymise it. Our routine backups are the one exception: a copy can survive there for up to 60 days after deletion, and it is isolated from any further use until the backup expires on its own. We do not restore a backup in order to bring deleted information back.
Account Deletion: When you request account deletion, we delete your work log entries, properties, categories, participants, preferences (including any third-party AI assistant or Public API connection settings stored with your account), Public API keys, passkeys, files, delegation relationships, your calendar connections and booking calendars (including the bookings we stored), the totals we derived from your entries, and the counters that track your use of daily limits. We remove the information that identifies you from the copy of your log in our analytics warehouse within about two days, and not at the same instant, because that store is written in batches and cannot be edited safely while a batch is still settling. It is checked again every day after that, because the products we take analytics from can send us a fresh copy of a record we have already cleaned.
We also remove your information from Firebase Authentication, our push notification provider, our product analytics provider (including the events recorded against your account), and the identity provider for AI assistant and Public API connections, and we ask the advertising platforms we work with to drop you from their audience lists. We do not currently remove your account identifier from our website and marketing analytics provider, which is listed under "What we keep after you close your account" above. Some providers keep information for the reasons given under "What we keep after you close your account" in Section 5, and our AI providers may hold a request they have already received for a limited period of their own.
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. The Services are intended only for people aged 18 or older, and by using them you represent that you are at least 18. Persons under 18 are not permitted to use or register for the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at [email protected].
In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. You will then be removed from the marketing lists. However, we may still communicate with you (for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes).
If you would at any time like to review or change the information in your account or terminate your account, you can:
Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. After that we keep only the categories described under "What we keep after you close your account" in Section 5, for the reasons given there.
Cookies and similar technologies: Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. You may also manage your cookie preferences through our cookie consent banner on our web application.
If you have questions or comments about your privacy rights, you may email us at [email protected].
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to Do Not Track or other browser opt-out preference signals, including Global Privacy Control. To opt out, use the Do Not Sell or Share My Personal Information control in Settings, or email us, which we do honour. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.
We have collected the following categories of personal information in the past twelve (12) months:
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Email address, username, unique personal identifier, online identifier, Internet Protocol address, account name, device identifiers | YES |
| B. Personal information (California Customer Records statute) | Name, email address, account information | YES |
| C. Protected classification characteristics | Gender, age, date of birth, race and ethnicity, national origin, marital status | NO |
| D. Commercial information | Transaction information, purchase history, subscription details, payment information | YES |
| E. Biometric information | Fingerprints and voiceprints. We do not collect these. Dictation audio is sent for transcription and is never used to build a voiceprint or any other template that could identify you by your voice (see row H) | NO |
| F. Internet or other similar network activity | Browsing history, search history, online behavior, interest data, and interactions with our websites and applications | YES |
| G. Geolocation data | Approximate location based on IP address | YES |
| H. Audio, electronic, sensory, or similar information | Microphone audio sent for transcription; images and documents uploaded to work log entries | YES |
| I. Professional or employment-related information | Work log information about your professional or business activities | YES |
| J. Education Information | N/A | NO |
| K. Inferences drawn from collected personal information | Inferences drawn from usage patterns and AI-generated suggestions (e.g., predicted task durations) | YES |
| L. Sensitive personal Information | Account login credentials. Content you choose to write or attach may also contain it | YES |
We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:
Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"
Learn more about how we use your personal information in the section "HOW DO WE PROCESS YOUR INFORMATION?"
We collect and share your personal information through:
Will your information be shared with anyone else?
We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"
We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.
We do not sell your personal information for monetary consideration. However, under California's Consumer Privacy Act (as amended by the CPRA) and similar US state privacy laws, the terms "sell" and "share" are defined broadly. In particular, "share" includes disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands.
Accordingly, when we upload hashed contact information (such as email addresses) to advertising platforms to build custom audiences, exclude existing customers, or generate lookalike/similar audiences for our marketing campaigns, this qualifies as "sharing" of personal information for targeted advertising under those laws. This happens in two ways. For audience matching we upload hashed email addresses and nothing else. Separately, when you sign up, start a trial or buy a subscription, we send a record of that event to our advertising partners, so we can tell which campaigns work. That record carries a hashed email address, a hashed account identifier, the amount paid, and the network information your device sends with any web request: your IP address, your browser or app user agent, and the city, postal code and country those imply. The categories involved are Category A (identifiers), Category F (internet or other network activity) and Category G (geolocation, no finer than a postal code, never precise location). We do not share sensitive personal information, work log content, property addresses, financial account information, or precise geolocation with advertising platforms.
Separately, if you connect a third-party AI assistant or use our Public API, any personal information made available through that connection is disclosed at your direction to carry out the request you make. We do not treat this as a "sale" of personal information or as a "share" for cross-context behavioral advertising, and we receive no payment for it. See Section 5 for details.
You can opt out of the audience matching at any time. The easiest way to do so is to use the "Do Not Sell or Share My Personal Information" option in the Settings screen of the REPSLog app (on iOS, Android, and web). Submitting a request through that screen is logged to our system and processed without any further action on your part. Alternatively, you may email us at [email protected] with the subject line "Do Not Share My Personal Information" and include the email address associated with your account. We will process requests within the timeframes required by applicable law, normally within 15 business days, and will exclude your information from future audience uploads. We do not discriminate against users who exercise this right.
To be clear about what that opt-out does not cover. It stops us adding you to advertising audiences. It does not currently stop the sign-up, trial and purchase records described above, which we send for campaign measurement and which carry your account identifier. If you want those stopped as well, email us at [email protected] and we will do it by hand.
The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
Depending upon the state where you live, you may also have the following rights:
To exercise these rights, you can contact us by emailing us at [email protected], or by referring to the contact details at the bottom of this document.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at [email protected]. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"
In Short: If European, United Kingdom or Swiss data protection law applies to our processing of your personal information, you may have additional rights under those laws.
CarmelTech LLC is the data controller responsible for your personal information. If you have questions or concerns about how your data is handled, contact us at [email protected].
We process your personal information based on the following legal grounds:
The AI features are not all on the same basis. Speech-to-text and AI-powered descriptions are necessary for our contract with you, because you asked for them. Semantic search rests on legitimate interests and you can object to it. Activity suggestions are off until you turn them on. Attachment search is off until you turn it on. Section 5 explains each one and how to change it.
Our users write about their work, which sometimes means writing about other people, such as tenants, contractors, colleagues or clients, and attaching documents that mention them. We did not collect that information from those people. We do not build a directory of them and we do not collect their contact details from them directly. Reaching each of them individually would mean reading through our customers' private records to find a way to contact them. Weighing that against the number of people mentioned across our customers' logs, and the fact that we receive their information as part of records our customers create rather than by collecting it from them, we have assessed that contacting each person individually would involve disproportionate effort within the meaning of Article 14(5)(b) GDPR. This notice is public, and it is the information we provide instead.
Our customer decides what to record about you and why, and is responsible for that decision. If you believe a REPSLog user holds information about you, you can contact that person directly, or contact us at [email protected] and we will help. If applicable law gives you rights in personal information we control about you, contact us and we will assess the request, taking account of any exceptions that apply and of the rights of our customer and of other people. Where we act on it, we will tell our customer what we have done.
Under GDPR and equivalent laws, you have the following rights:
REPSLog is built for United States real estate investors documenting hours for the IRS, and your personal information is stored and processed in the United States, which may have different data protection laws from your country of residence.
We rely on the following mechanisms for international data transfers:
If you are in the EEA, you can contact your local data protection authority. A list of data protection authorities is available at: https://www.edpb.europa.eu/about-edpb/our-members_en
If you are in the UK, you can contact the Information Commissioner's Office (ICO): https://ico.org.uk/
If you are in Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/
Our Services use the following third-party tools to enhance functionality, analyze performance, and improve user experience. We also keep our own analytics warehouse, which holds a copy of your entries and is described in Section 5; it is not a third-party tool, so it is not listed here, but it is the place where most of the analysis we do on your log actually happens.
Analytics and session replay. Usage metrics, device information and product events, so we can see how the Services are used and what is failing. This provider also records session replays on our web and mobile apps, with everything you type into a field masked.
Error monitoring and crash reporting. Crashes and performance data, your account identifier, whether your email is verified, when your account was created, and a short trail of what the app was doing beforehand. On our mobile apps one of these providers also records a replay of a small sample of sessions, and of any session in which an error occurs, with all text and images masked. These carry no part of your work log.
Push notifications. Account and device identifiers and device tokens, so we can send the notifications you have asked for.
Backend services. Authentication, database and file storage. This is where your account and your log actually live.
Payments and subscription management. Your purchase history and subscription status, so we can bill you and give you what you paid for. Card details go to the payment provider, never to us.
Install attribution. Device identifiers and install data, so we can tell which campaigns and which partners brought you to us, and pay the people who refer customers.
Email delivery. Your email address and the contents of the emails we send you, plus delivery status.
Customer support. Your support conversations and the email address you contacted us from.
Identity for connected assistants and the Public API. An account identifier, so a connection you authorise can be tied to your account.
Infrastructure and content delivery. Request data such as IP addresses and headers, for security and performance. Our server-side AI requests are also routed through this provider, and it stores a log of them: the request we sent, the reply we got back and the time, tagged with your account identifier. For the AI features that means the text of the entries we send for indexing, the content of an AI-written description or an attachment description, and the audio of a dictation take only where the live connection was unavailable and the app sent the take as a single file. The normal live dictation path does not go through this provider. These logs have no fixed expiry; the provider keeps them until a storage limit is reached and then deletes the oldest first, and they are not deleted when you close your account.
Property valuation lookup. The street address of a US property you have added, so that a data provider can look up a publicly available market estimate of what it is worth. We use those estimates to understand the size of the portfolios our customers manage. We do not show them to you, we do not share them, and no part of your work log is sent.
Address autocomplete and maps. What you type into an address field, so that a mapping provider can suggest and resolve a real address.
Sign-in providers. If you sign in with Google or Apple, that provider confirms your identity to us and learns that you use REPSLog.
Connected calendar providers. If you connect a Google or Microsoft calendar, we exchange requests with that provider on your behalf to read the events you asked us to read.
Website and marketing analytics. Usage of our marketing website, and a record of the account events that matter to our marketing, meaning sign-up, trial start and purchase, together with your account identifier in full and, where the visit came from an advertisement, the click identifier and the amount paid. It never receives your work log.
AI providers. The content you ask an AI feature to act on, as described in Section 5: entry text for search and suggestions, the file itself for attachment search, audio for dictation, and, so that a result comes back with your own names in it, your property names and addresses and your category and participant names. They act as our processors under agreements that bar them from training their models on your data.
Advertising platforms, for audience matching. Hashed contact information such as email addresses, so they can match you to an existing account and include you in, or exclude you from, our campaigns. Only hashed identifiers, never your work log entries, properties or other Service content. Each platform acts as an independent controller of any matched data under its own terms. To opt out, see the instructions in Section 13.
Advertising partners, for conversion measurement. When you sign up, start a trial or buy a subscription, a record of that event, so we can tell which campaigns work. It carries a hashed email address, an account identifier, the amount paid, and, where the event is relayed from your browser or app, the network information your device sends with any web request: your IP address, your user agent, and the city, postal code and country those imply. One of these partners receives the account identifier hashed; the other receives it as it stands. It never carries your work log entries, your files or your property addresses. To opt out, see the instructions in Section 13.
Data Collection and Sharing: These tools may collect and process data such as device identifiers (e.g., IDFA, GAID), IP addresses, app usage and interaction data, crash logs and performance metrics, and purchase and subscription details. This data may be shared with our service providers and partners to improve app functionality, measure performance, and optimize user experience.
Your Choices: You can manage your preferences and limit certain types of data collection:
We describe these by what they do rather than by naming each supplier, because suppliers change and a name in a notice goes stale the day one does. If you want to know which company performs a particular function, ask us using the contact details in this notice and we will tell you.
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
If you have questions or comments about this notice, you may email us at [email protected] or contact us by post at:
CarmelTech LLC 18034 Ventura Blvd #2059 Encino, CA 91316 United States
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please email us at [email protected].