Terms and policies

RILEY SERVICE PRIVACY POLICY

Last updated: October 18, 2026

This Service Privacy Policy explains how Riley Tech Inc. ("Riley", "we", "us" or "our") collects, uses, discloses, and otherwise processes personal information in connection with the Riley service. It is intended both for the real estate professionals who use Riley and for individuals whose information is handled through the service, including people who communicate with a Riley AI agent.

This policy applies to the Riley platform, its customer relationship management tools, AI agents, communications features, integrations, the Riley mobile apps, Riley-provided phone numbers, the Try Riley demo, and related support services (collectively, the "Service"). It does not apply to Riley's public website, which is covered by a separate Website Privacy Policy.

1. About the Riley Service

Riley provides AI-powered operational and lead-management tools for real estate agents, teams, and brokerages in the United States. Depending on the features selected and configured by a customer, the Service may answer incoming calls, communicate with leads, ask questions and capture relevant details, prepare summaries, arrange appointments and property showings, conduct follow-up communications, maintain customer relationship records, and assist with transaction-related work.

Riley is designed to support the work of real estate professionals, not to replace their judgment. Our customers decide how the Service is configured, which contacts and records are added to the Service, and how Riley AI agents should communicate on their behalf. Any lead qualifications, classifications, rankings, or follow-up priorities generated by the Service are tools for the customer. Real estate professionals remain responsible for reviewing them, managing their client relationships, and making substantive decisions relating to properties, transactions, eligibility, creditworthiness, and the provision of real estate services.

2. Who This Policy Covers

The Service processes information relating to several groups of people. These include customers who contract with Riley, agents, employees, contractors, administrators, and other authorized users who access the Service on a customer's behalf, leads, prospective clients, buyers, sellers, renters, landlords, property owners, and other individuals whose details are maintained in the Service, people who call, text, email, or otherwise communicate with a Riley AI agent acting for a real estate professional, and other participants in the real estate process whose information may appear in the Service, such as property managers, listing-service personnel, attorneys, and representatives of other organizations involved in a sale, purchase, or rental.

Not everyone whose information appears in the Service has a Riley account or a direct relationship with us. A lead may, for example, call a real estate agent's usual telephone number and reach a Riley AI agent, or the agent may add an existing contact or transaction record to the Riley CRM. This policy describes Riley's practices in each of these contexts.

3. Riley's Role and Our Customers' Role

Much of the information in the Service is provided, selected, or generated in the course of work performed for a Riley customer. In that context, the customer decides why the information is used, which information should be added, who may access it, and how the Service should be configured. Riley handles that information to provide the Service in accordance with the customer's instructions and the agreement between Riley and the customer.

The customer is responsible for its own privacy practices. This includes having an appropriate basis for adding information to the Service, providing any notices that it is required to provide, obtaining any permissions that may be required for its communications or use of information, configuring access appropriately, and responding to requests that concern information it controls.

Riley also processes limited personal information as a controller for purposes that we determine ourselves. These purposes include administering customer accounts and commercial relationships, securing and maintaining the Service, providing support, monitoring performance and reliability, preventing misuse, complying with law, protecting our rights, and creating, using and disclosing aggregated or de-identified information for lawful business purposes, including commercial purposes. The rest of this policy explains these activities in more detail.

4. Personal Information We Process

The information processed through the Service depends on how a customer uses and configures it. Because customers control the contents of their CRM and transaction records, Riley does not determine every category of information that may be uploaded. The categories below describe the information we reasonably expect to process.

4.1. Account and professional information

We process information about customers and authorized users, such as names, business contact details, brokerage or organizational affiliation, role, username, account settings, permissions, authentication information, subscription details, and communications with our support or business teams.

4.2. Lead, client, and contact information

The Service may contain names, telephone numbers, email addresses, mailing addresses, preferred methods of contact, relationship notes, lead sources, lead status, qualification indicators, classifications, rankings, follow-up priorities, and similar information about people who have contacted or worked with a real estate professional. It may also include details captured during an interaction, such as whether a person is interested in buying, selling, or renting; preferred locations and property characteristics; budget; timing; availability; and the nature and status of the inquiry.

4.3. Communications, recordings, and transcripts

When communications are handled through the Service, we may process call audio, transcripts, summaries, telephone and messaging metadata, emails, text messages, instructions provided by the customer, responses provided by the individual, and records of follow-up communications. We may also record whether an appointment was requested, offered, confirmed, rescheduled, or cancelled.

If an individual does not wish to continue on a recorded line, the individual may request a direct callback from the relevant real estate professional. Riley will record and pass on the request and end the call. An immediate transfer to a person may not be available.

4.4. Property and transaction information

Customers may use the Service to maintain information about listings, properties, showings, offers, negotiations, transaction milestones, deadlines, parties to a transaction, and related communications and documents. The information will vary depending on whether the transaction concerns a purchase, rental, sale, or other real estate services.

4.5. Documents and sensitive personal information

Customers may choose to upload documents that are commonly used in real estate transactions. Depending on the transaction, these materials may contain government identification details, Social Security numbers, financial statements, bank statements, income or employment information, tax documents, credit information or reports, signatures, guarantor information, background information, and information about household members.

Riley may store, organize, label, classify, or make these documents available within the customer's workspace. Unless Riley and the customer expressly agree otherwise, the Service is not intended to use the contents of these materials to determine a person's creditworthiness, eligibility for housing, or entitlement to proceed with a transaction. Customers should limit the information they upload to what is appropriate for their work and apply suitable access permissions to sensitive records.

4.6. Calendar, integration, and source information

If a customer connects a calendar, email account, communications service, listing source, lead form, or other third-party system, Riley may receive the information and permissions needed to operate the integration. This may include calendar availability, event details, email or messaging content, contact records, listing information, and identifiers that allow records to be synchronized between services.

4.7. Technical and activity information

We and our service providers may collect and analyze information generated through the use and operation of the Service, such as IP address, browser and device information, login and authentication events, account activity, pages and features used, records accessed or changed, timestamps, system configuration, error reports, diagnostic and performance information, security events, and audit logs. We may use this information to authenticate users, maintain sessions, secure and operate the Service, identify and resolve errors, understand feature usage, monitor performance and reliability, provide support, and improve the Service.

4.8. Payment and subscription information

Riley may use a third-party payment processor to process online payments in connection with the Service. In connection with such payments, Riley may receive billing contact information, subscription and payment status, transaction identifiers, and limited or tokenized payment information, but does not receive or store full payment card details processed by the provider.

4.9. Mobile app information

If you use the Riley mobile app, we and our service providers may collect device and app information, such as device model, operating system and app version, language and time zone settings, push notification tokens and permissions, and how you use the app’s features. If you record a voice note, the recording is processed by a speech-to-text service provider so that Riley can act on it. The app may use your device’s biometric features, such as Face ID, to unlock the app, but Riley does not receive your biometric data. The app does not track you across other companies’ apps or websites for advertising. Before the app sends your content to third-party AI providers for its optional AI features, it asks for your permission, which you can change in the app’s settings.

5. Where Personal Information Comes From

We receive personal information from several sources. Customers and individuals who use the Service on their behalf (such as real estate agents, employees, contractors, and account administrators), provide information directly to the Service, including by uploading records and files or connecting third-party services. We also collect information directly from individuals who communicate with a Riley AI agent or otherwise interact with a customer through the Service. In addition, we receive information from customer-enabled integrations and automatically from the devices and systems used to access or operate the Service.

A customer may also add information obtained from its own records, referral sources, listing services, lead platforms, publicly available sources, or other sources it is permitted to use.

Riley generally cannot determine how a customer originally obtained every item contained in its workspace. Customers decide what information to collect and provide to the Service. They are responsible for ensuring that the information was collected appropriately, that it may be uploaded and disclosed to Riley, and that individuals have received any required notices or provided any required permissions or consents. Riley relies on its customers to meet these responsibilities and does not independently verify how they obtained each item of information.

6. How We Use Personal Information

We use personal information as reasonably necessary to provide, administer, maintain, and protect the Service. Depending on the customer's configuration, this may include:

6.1. answering and routing communications on behalf of a customer and identifying the AI agent during the interaction;

6.2. asking questions, recording responses, capturing contact and property preferences, and preparing call or communication summaries;

6.3. qualifying, classifying, ranking, and prioritizing leads and follow-ups, and organizing contacts, documents, and transaction records;

6.4. scheduling appointments and property showings, updating calendars and CRM records, and sending confirmations or follow-up communications;

6.5. responding to questions and proactively assisting customers and leads with administrative next steps in the process of buying, selling, or renting property;

6.6. providing customers and individuals who use the Service on their behalf with access to their accounts, workspaces, records, and integrations;

6.7. processing customer instructions, maintaining account settings and permissions, and providing customer support;

6.8. monitoring availability, performance, and reliability, diagnosing errors, and maintaining logs and backups;

6.9. developing, testing, improving, and offering additional features and related services, including features or services that may be offered in collaboration with selected business partners;

6.10. protecting the Service, customers, and individuals against fraud, unauthorized access, misuse, security threats, and other harmful activity;

6.11. complying with legal obligations, responding to lawful requests, enforcing agreements, and establishing, exercising, or defending legal rights; and

6.12. creating and using aggregated or de-identified information as described below.

When we use personal information to improve the Service, we may analyze how the Service performs, where errors occur, how features are used, and how reliably Riley AI agents complete the administrative and lead-management tasks assigned to them. We use this information to troubleshoot issues, evaluate quality, improve workflows and prompts, and develop or refine Service features.

We may also create, use and disclose aggregated or de-identified information that cannot reasonably be linked to an identifiable person or customer. This may include developing and publicly sharing reports, observations, or content about overall real estate trends, such as market, pricing, or regional behavior patterns. We may use and disclose this information for lawful business purposes, including analytics, research, benchmarking, security, product development, Service improvement, and commercial purposes and may make it available to third parties, including for compensation. We maintain de-identified information in de-identified form, except where necessary to test the effectiveness of our de-identification measures or as otherwise permitted by applicable law. This may include information derived from personal information processed at any time since the Service was first offered, and our rights to this information continue after a customer relationship ends. This paragraph does not apply to information Riley receives through Google APIs, which is handled as described in the section titled “Information Received from Google”.

Riley does not use the Service to make final decisions about whether a person qualifies for a property, loan, credit product, or real estate service. Any lead qualifications, classifications, rankings, summaries or follow-up priorities generated by the Service are tools designed to aid the customer. The customer remains responsible for reviewing relevant information and making its own decisions.

7. Cookies and Similar Technologies

The Service may use session identifiers, local storage, software development tools and similar technologies provided by Riley or its service providers to authenticate users, maintain sessions, remember account preferences, protect and operate the Service, monitor performance and reliability, identify and resolve errors, understand feature usage, and support and improve core platform functions. These technologies may collect information such as IP address, device and browser information, account and session identifiers, actions performed, and the dates and times of interactions with the Service. Disabling technologies that support authentication, security, or core functionality may prevent the Service from operating properly.

8. AI Agents, Recordings, and Human Review

A person who contacts a real estate professional may interact with a Riley AI agent rather than a human receptionist. Riley AI agents are designed to identify themselves as AI when they answer or initiate a communication. The agent may ask questions and respond based on the customer's instructions, capture the information provided, qualify or classify the lead, identify appropriate follow-up steps and take steps such as preparing a summary or scheduling an appointment.

Calls handled through the Service may be recorded, transcribed, and summarized. The recording, transcript, and summary may be made available to the relevant customer and stored in the customer's workspace. The Riley AI agent identifies itself at the beginning of the call and states that the call is on a recorded line. If an individual does not wish to continue on a recorded line, the individual may request a direct callback from the relevant real estate professional. Riley will record and communicate the request to the real estate professional and end the call. An immediate transfer to a person may not be available.

Authorized Riley personnel and service providers may review selected communications, recordings, transcripts, outputs, or related records where reasonably necessary to provide support, investigate reported issues, evaluate how the Service is performing, improve the Service and the quality and safety of its outputs, or protect the Service against misuse and security threats. Access to Riley’s authorized personnel is limited to individuals who require it for these purposes and who are subject to appropriate confidentiality and access controls.

Riley does not use identifiable information about a customer’s leads or clients to train general-purpose or foundation AI models. We also require the AI model providers used in connection with the Service not to use customer or end-client information submitted through Riley to train their general models.

9. How We Disclose Personal Information

We disclose personal information only as reasonably necessary for the purposes described in this policy or as directed by the relevant customer. Depending on the circumstances, recipients may include:

9.1. Riley’s customer and its authorized users, including the real estate professional on whose behalf the information was collected or maintained;

9.2. service providers that support cloud hosting, databases, communications, call recording and transcription, AI model processing, email, calendars, analytics, security, customer support, payment processing, and other Service operations;

9.3. third-party services and integrations that the customer or an authorized user chooses to connect to the Service;

9.4. Riley personnel, contractors, affiliated entities, and professional advisors who require access for operational, technical, legal, financial, security, or support purposes;

9.5. governmental, regulatory, law-enforcement, or judicial authorities when disclosure is required by law or legal process, or is reasonably necessary to protect rights, safety, or security;

9.6. potential or actual investors, lenders, purchasers, successors, or other parties involved in a financing, merger, acquisition, reorganization, sale of assets, or similar corporate transaction, subject to appropriate protections; and

9.7. business partners with whom Riley may offer additional or complementary services.

Service providers that handle personal information for Riley are expected to process it for the services they provide and to apply protections appropriate to the nature of the information and their role. A list of material service providers or subprocessors may be made available to customers through contractual documentation.

When we receive a government or law-enforcement request for personal information, we consider its legal basis and scope. Where appropriate and permitted by law, we may seek clarification, request that the disclosure be narrowed, or challenge the request.

10. Integrations with Other Services

Depending on the features made available by Riley, the Service may allow a customer to connect third-party accounts, applications, or services, such as email accounts, calendars, communications services, lead sources, listing platforms, document management tools, or other systems used in the customer’s business. When a customer enables an integration, Riley may access and exchange information with that third party in accordance with the customer’s instructions and the permissions granted through the integration. Customers should review those permissions before enabling an integration and may be able to modify or revoke them through Riley or the relevant third-party service.

Third-party services have their own terms and privacy practices. Riley does not control how a third party uses information after the customer has directed Riley to disclose it to that service, except to the extent Riley has engaged the third party as its own service provider.

11. Information Received from Google

If a customer connects a Google account to the Service, Riley may access Gmail and Google Calendar data through Google APIs, within the permissions the customer grants when connecting the account. Depending on the features used, Riley may read email messages to identify and handle lead inquiries and related conversations, send email on the customer’s behalf, and read and create calendar events to arrange appointments and showings.

Riley uses information received from Google APIs only to provide and improve the user-facing features of the Service that the customer has chosen to use. Riley does not use this information for advertising, does not sell it, and does not use it to develop, improve or train generalized artificial intelligence or machine learning models. Riley personnel do not read this information unless the customer has asked or agreed to it for specific messages or data, it is needed for security purposes such as investigating abuse, it is necessary to comply with law, or it has been aggregated and anonymized for internal operations. Riley shares this information with service providers only as needed to provide those features.

Riley’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. A customer can disconnect a Google account at any time in the Service or in its Google account settings.

12. Communications Choices

Communications sent through the Service may include replies to an inquiry, appointment scheduling and reminders, follow-up messages, transaction-related communications, and other messages sent in response to an individual or in accordance with the relevant customer’s instructions and configuration. Riley may send these communications without the customer approving each message individually. The customer can pause Riley or require confirmation for particular actions. Because Riley sends these communications for the customer, requests to change communication preferences may be shared with or handled by that customer.

You may ask Riley or contact the relevant real estate professional to request that follow-up communications be stopped or changed. Riley records and applies the request on the customer’s behalf and makes it available to the customer. A request to stop promotional communications does not necessarily prevent communications that are necessary to respond to an active request, manage an appointment or transaction, provide a requested service, address security, or comply with law. You may also ask for the real estate professional to contact you directly. Riley will record and communicate that request, but may not be able to transfer you immediately.

Text messages. Where text messaging is enabled, Riley may send text messages on behalf of a customer. You can reply STOP to stop receiving text messages from that sender, or HELP for help. Message and data rates may apply. We do not share mobile phone numbers, or text message opt-in data and consent, with third parties or affiliates for their marketing or promotional purposes. Text message opt-in data and consent are not shared with any third party, except service providers that help deliver messages.

13. Your Privacy Rights and Choices

Depending on where you reside and subject to applicable law, you may have rights regarding your personal information. These may include the right to:

13.1. confirm whether personal information about you is being processed and request access to it;

13.2. receive information about the categories and sources of personal information, the purposes for which it is used, and the categories of recipients to whom it is disclosed;

13.3. request correction of inaccurate personal information;

13.4. request deletion of personal information;

13.5. request a portable copy of certain personal information;

13.6. opt out of certain sales, sharing, targeted advertising, or profiling, if Riley engages in processing to which such a right applies;

13.7. limit certain uses or disclosures of sensitive personal information, where applicable;

13.8. use an authorized agent to submit a request on your behalf;

13.9. appeal a decision regarding your request, where applicable; and

13.10. not receive discriminatory treatment for exercising your privacy rights.

Riley does not currently sell personal information, share it for cross-context behavioral advertising, process it for targeted advertising, or disclose it for third parties’ own marketing purposes.

If your request concerns information that Riley maintains for a real estate professional or brokerage, that customer will ordinarily be responsible for the request. You may contact the relevant professional directly. If you contact Riley, we may ask for information that allows us to identify the relevant customer and may forward the request to that customer or assist it in responding.

For information that Riley processes for its own purposes, you may submit a request to privacy@getriley.ai.

We may take reasonable steps to verify your identity and, where relevant, your authority to act for another person. We will respond within the period required by applicable law.

Please note that rights are not absolute, and we may decline or limit a request where permitted, including where information must be retained for security, legal compliance, the protection of other individuals, or the establishment or defense of legal claims. If applicable, our response will explain how to appeal a decision.

14. Data Retention, Export and Deletion

Riley retains personal information for as long as reasonably necessary to provide and maintain the Service, fulfill the purposes described in this policy, comply with legal and contractual obligations, resolve disputes, protect the security and integrity of the Service, and enforce its agreements.

In determining the appropriate retention period, Riley may consider the nature, volume, and sensitivity of the information, the purpose for which it was collected or processed, the duration of the customer relationship, the customer’s instructions, the risks associated with continued retention, applicable legal, contractual, accounting, or regulatory requirements, relevant limitation periods, and the time required to complete ordinary backup and deletion cycles.

Customers may request a copy of information maintained in their workspace during the subscription term and for up to 30 days following termination or expiration of the customer relationship. Riley will provide the requested information in a reasonably available format, subject to the applicable agreement, technical limitations, and legal requirements. Customers are responsible for requesting any information they wish to retain during that period.

After that period, Riley may delete, de-identify, or make the information inaccessible in its active systems, unless a longer period is required or permitted for legal, security, evidentiary, fraud-prevention, dispute-resolution, or other legitimate purposes. Where the applicable agreement requires Riley to return or delete customer information, Riley will do so in accordance with that agreement and applicable law.

Account deletion. A customer can ask us to delete its Riley account at any time in the Riley mobile app (Settings, then Privacy & account) or by emailing support@getriley.ai. When we receive a request, we close the account and stop Riley’s activity for it, and we generally delete or de-identify the account’s information within 30 days. We may keep the information described in this section, such as limited records of requests, transactions, consents and opt-outs, and information we need for legal, security or dispute purposes.

Information may remain in backups for a limited additional period and will be protected from further use, except where restoration is required for security or disaster-recovery purposes. Backup copies will be deleted or overwritten through Riley’s ordinary backup and recovery cycles.

Riley may retain aggregated or de-identified information that cannot reasonably be linked to an identifiable person or customer for a longer period. Riley may also retain limited records necessary to document privacy requests, account activity, transactions, security events, or compliance with legal and contractual obligations.

15. Data Security

Riley maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction. These safeguards may include access controls, authentication measures, encryption, logging and monitoring, secure development practices, personnel controls, and vendor review, as appropriate to the nature of the information and the risks involved.

Customers are responsible for managing their authorized users, account permissions, connected services, and the devices through which they access the Service. No system can be guaranteed to be completely secure. If you believe that information in the Service may have been accessed or used without authorization, please contact us promptly at privacy@getriley.ai.

16. International Processing and Transfers

Personal information processed through the Service may be stored, accessed and processed in the United States and in other countries where Riley, its personnel and service providers operate. As a result, personal information may be transferred to, accessed from, or processed in countries outside the country or state in which the relevant individual is located.

Privacy and data protection laws in those jurisdictions may differ from those that apply where the individual resides. Where required by applicable law, Riley takes reasonable steps designed to ensure that personal information transferred or accessed across borders is subject to appropriate contractual, technical, and organizational protections.

17. Children's Privacy

The Service is intended for real estate professionals and is not offered directly to children under 18. Riley does not permit children to create their own Service accounts. A customer may, however, upload information about household members or other minors where it is relevant to a real estate transaction. The customer is responsible for ensuring that it is appropriate and lawful to provide that information to the Service. If you believe that information about a child has been handled inappropriately, please contact the relevant customer or Riley at privacy@getriley.ai.

18. Changes to This Policy

We may update this policy from time to time to reflect changes in the Service, our practices, technologies, or legal requirements. We will make the updated policy available through the Service or another appropriate location and revise the date shown at the top. Any updated version will take effect when it is posted, unless a later effective date is stated. If required by applicable law, we will provide additional notice of material changes.

19. Contact Us

If you have questions about this policy or Riley's privacy practices, or wish to submit a privacy request concerning information Riley processes for its own purposes, please contact:

Riley Tech Inc. | privacy@getriley.ai | 800 N King Street, Suite 304-3185, Wilmington, DE 19801, United States