Privacy Policy

Effective date: 2026-11-08
Version: 2026-11-08

This Privacy Policy explains how Meridian Labs, LLC, doing business as Regencly ("Regencly," "we," "us"), handles personal information. By checking the box at signup you acknowledge this Policy.

1. Who we are and our two roles

We provide a managed real-estate website and marketing Service to real-estate professionals ("Customers"). We handle personal information in two distinct roles:

• As a controller, for our Customers' own account information (the agent/brokerage account, billing, and how they use our Service). We decide how and why we process it, and this Policy governs it.
• As a processor, for the personal information of our Customers' leads, clients, and site visitors ("End Users") that a Customer's site collects. We process this on the Customer's behalf under our Data Processing Addendum; the Customer is the controller, and the Customer's own privacy policy governs how that data is used.

Marketing you run through your own tools. Email and SMS campaigns are generally sent through a third-party CRM or email/SMS provider that you connect (for example, your existing CRM). When you do that, we pass the relevant data to that provider at your direction, and that provider, together with you, is responsible for those messages and their consent requirements. We are not the sender.

2. Information we collect

From Customers (as controller):

• Identity and contact details (name, email, phone, business/brokerage info)
• Account and authentication data
• Billing information (processed by our payment processor; we do not store full card numbers)
• Usage, device, and log data about how you use our dashboard and Service

From End Users of Customer sites (as processor, on the Customer's behalf):

• Contact information and property interests submitted through forms
• Communications with the Customer
• Device, analytics, and usage data from the Customer's site

3. How we use information

As controller of Customer data, we use it to: provide, host, and operate the Service; support, secure, and improve the Service; process billing; and comply with law. We do not sell or "share" (as defined by CCPA/CPRA) personal information, and we do not use End-User data for our own advertising.

As processor, we use End-User data only to provide the Service to the relevant Customer, per our DPA and the Customer's instructions.

4. How we share information

We share personal information only with:

• Service providers / subprocessors who help us run the Service (hosting, email/SMS delivery, analytics, payment processing), bound by contract;
• Third-party tools you connect (e.g., your CRM/ESP), which receive data at your direction and are your chosen tools;
• Legal and safety recipients where required by law or to protect rights and safety;
• A successor in a merger, acquisition, or asset sale, subject to this Policy.

We publish our subprocessors publicly, with name, purpose, and region, at regencly.com/legal/subprocessors, and we provide at least 30 days' advance notice of changes.

5. Google user data

Some Regencly features work with a Google account that you choose to connect. This section explains what information we receive from Google APIs ("Google user data"), why we use it, and how we store, share and delete it.

5.1 What we access and why

• Sign in with Google. If you sign in with Google, we receive your name, email address and profile picture. We use them only to create your Regencly account and sign you in.
• Gmail (sending only). If you connect Gmail, we ask Google for permission to send email from your Gmail address (the gmail.send permission) and to see which address you connected. We use this only to send the emails you set up in Regencly from your own address, for example the guide a person requests on your landing page. This permission does not let us read, search, change or delete any email in your mailbox, and we never ask for that access. For each email we send for you, we keep the recipient, the time and Gmail's message ID so you can see what was sent.
• Google Business Profile. If you connect your Business Profile, we ask Google for permission to manage it (the business.manage permission). We use it to show your profile's details, reviews and performance numbers in your Regencly dashboard and, when you ask us to, to update your profile details or reply to reviews for you.

5.2 How we store and protect it

The access tokens Google issues to us are encrypted at rest and are used only by our servers. We keep Google user data only while your connection is active, or as long as needed to show you what we sent or changed for you, and we protect it with the safeguards described in Section 10.

5.3 How we use and share it

• We use Google user data only to provide and improve the features described above, which you can see in your Regencly dashboard.
• We do not sell Google user data, and we do not use it for advertising, including retargeting or personalized ads.
• We do not transfer Google user data to anyone else, except to the service providers who host and run these features for us, when you ask us to, when the law requires it, to protect security, or as part of a merger or acquisition with notice to you.
• People at Regencly do not read your Google user data unless you give us permission (for example, to help with a support request), it is needed for security or to investigate abuse, the law requires it, or it has been aggregated and anonymized for internal operations.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

5.4 Limited Use

Regencly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.5 Disconnecting and deleting

You can disconnect Gmail or your Business Profile at any time under Settings, Integrations in your Regencly dashboard. When you disconnect, we delete the access tokens we hold for that connection. You can also remove Regencly's access in your Google Account at myaccount.google.com/permissions. To ask us to delete any other Google user data we hold, email privacy@regencly.com and we will delete it within 30 days.

6. Meta (Facebook and Instagram) data

Some Regencly features work with Meta accounts that a Customer chooses to connect, such as a Meta ad account, a Facebook Page or a Meta Pixel. This section explains what we receive from Meta's platforms ("Meta Platform Data"), why we use it, and how we store, share and delete it. For this data we act as a technology provider working on behalf of the Customer who connected the account.

6.1 What we access and why

• Ad accounts and results. If you connect a Meta ad account, we read your campaigns, ads and their results (such as spend, reach, clicks and leads) to show them in your Regencly dashboard next to the inquiries your site receives.
• Managing your ads. When you ask us to, we create, edit, pause or compare ads in your own ad account. Housing ads run under Meta's Housing special ad category. No ad goes live and no budget changes without your approval.
• Lead forms. If you run Meta lead ads, we receive the leads people submit through your forms so they appear in your Regencly lead inbox.
• Facebook Pages. We see the Pages you connect so your ads and lead forms can run from them.
• Your Meta Pixel. If you add your Meta Pixel to your landing pages, it reports page views and submitted inquiries to your own Meta ad account so you can measure your ads. It does not load for visitors whose browsers send a Global Privacy Control or Do-Not-Track signal.

6.2 How we use and share it

• We use Meta Platform Data only to provide these features to the Customer who connected the account, never for our own purposes or for another Customer.
• We keep each Customer's Meta Platform Data separate and never combine it with another Customer's data.
• We do not sell Meta Platform Data, we do not use it for our own advertising, and we do not use it to build audiences for anyone else.
• We use lead form data only so the Customer can respond to that lead.
• We share Meta Platform Data only with the service providers who host and run these features for us, when you ask us to (for example, sending a lead to the CRM you connected), or when the law requires it.
• We do not use Meta Platform Data to develop, improve or train generalized artificial intelligence or machine learning models.

6.3 How we store and protect it

The access tokens Meta issues to us are encrypted at rest and are used only by our servers. We keep Meta Platform Data only while your connection is active, or as long as needed to provide the features above, and we protect it with the safeguards described in Section 10.

6.4 How to delete your data

• Remove Regencly's access. On Facebook, open Settings and privacy, then Settings, then Business integrations, and remove Regencly. In Meta Business Suite, open Settings, then Integrations, and remove Regencly. When our access ends, we delete the access tokens we hold for it.
• Ask us to delete it. Email privacy@regencly.com with the subject "Delete my Meta data" and the name of your business or Facebook account. We delete the Meta Platform Data we hold for you within 30 days and confirm by email.
• When an account closes. We also delete it when your Regencly account closes (see Section 9) or when Meta asks us to.
• If you filled in an agent's form. The agent who ran the ad controls your information. Contact them directly, or email privacy@regencly.com and we will pass your request to them and help them act on it.

7. Your privacy rights

7.1 U.S. residents (CCPA/CPRA, and equivalent state rights)

Depending on where you live, you may have the right to: know/access the personal information we hold, delete it, correct it, opt out of "sale"/"sharing" and targeted advertising, and limit the use of sensitive personal information, with no discrimination for exercising these rights. We honor Global Privacy Control (GPC) signals. As a matter of policy we extend core access, deletion, and correction rights to all U.S. residents, regardless of state thresholds. To exercise your rights, email privacy@regencly.com (or use the request form we provide).

Note: the Florida Digital Bill of Rights applies mainly to very large businesses (roughly $1B+ in revenue), so it likely does not yet apply to us, but we follow its spirit regardless.

If you are an End User of a Customer's site, direct your requests to that Customer (the controller); we will assist them as their processor.

7.2 EEA / UK / Switzerland (GDPR)

Where the GDPR/UK GDPR applies, we honor your rights of access, rectification, erasure, portability, restriction, and objection, and rights regarding automated decisions. We rely on appropriate lawful bases and use recognized international-transfer safeguards (Standard Contractual Clauses, the UK Addendum/IDTA, and the Swiss addendum). Contact privacy@regencly.com to exercise these rights.

8. Cookies and tracking

We describe the cookies, SDKs, and pixels we use and their purposes, and provide a preferences mechanism where required. We honor GPC and Do-Not-Track signals. The consumer-facing tenant sites we operate carry no advertising pixels of our own. A Customer may add its own Meta Pixel to its landing pages; that Pixel reports to the Customer's own ad account, is described in Section 6, and does not load for visitors who send a GPC or Do-Not-Track signal.

Links in emails sent for an agent. When we send an email for a Customer, such as a request for a review after a closing, its links go through our address (agents.regencly.com) and then straight to the page named. When you click one, we record which link and when, the country and internet provider the click came from, the browser and device details your browser sends, and whether it looks like an automatic mail filter. The agent sees whether and when you opened it. We do not keep your IP address, and we do not sell these records or use them for advertising. Only the agent's account, our staff and the service providers that run our platform can see them. We keep them until the agent's account closes (see Section 9). The unsubscribe link is never tracked.

9. Data retention

We keep personal information only as long as needed for the purposes above, then delete or de-identify it. For Customer accounts, retention follows the offboarding sequence in our Terms: on cancellation the site goes dark, you have a 30-day self-serve export window, and we delete Customer Data within 30 days afterward, with backups purged on standard rotation. You may also request immediate deletion at any time. We may retain limited records where required by law (e.g., tax/financial) or subject to a legal hold.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, and we will notify affected parties of a data breach as required by law and our DPA. No system is perfectly secure.

11. Children

The Service is not directed to children and we do not knowingly collect personal information from children under 13 (or process sensitive data of minors under 16). If we learn we have, we will delete it.

12. International users

We are based in the United States and process information here and with our subprocessors. Where we transfer personal information internationally, we use the safeguards described in Section 7.2.

13. How to contact us

Meridian Labs, LLC (d/b/a Regencly) 8992 Chauvet Way, Boca Raton, FL 33496 Privacy: privacy@regencly.com

14. Changes to this Policy

We may update this Policy. For material changes, we will seek your affirmative re-consent before you continue using the Service (see the Terms). We keep prior versions and post an effective date and change summary for each.

Version History