RealFlow Privacy Policy
Draft — last updated 17 July 2026. This is a starting draft for Google's OAuth verification and general use. It has not been reviewed by a lawyer. Before relying on it for a paid, public launch, have a solicitor check it — this covers the basics but isn't a substitute for legal advice.
Who we are
RealFlow is a voice assistant app for real estate agents, built and operated by Davide Diana. Contact: ironkeyestates@gmail.com
What information we collect
- Account information: your email address and profile name, used to sign you in and identify your data.
- Voice notes: when you record a voice note, the audio is sent to OpenAI's transcription service to convert it to text. We do not keep the raw audio recording after transcription — only the resulting text note is stored, in your account.
- Notes: the polished text of your voice notes, categorised by you as personal or business, stored in our database under your account only.
- Calendar access: if you connect Google Calendar, RealFlow requests permission to read and write events on your calendar so it can read your day back to you and make changes you ask for by voice. This access token is stored securely on your own device, not in our central database.
- Usage and cost data: to keep the service reliable and affordable, we log which features were used, when, and an estimated processing cost — this log does not include the content of your notes, emails, or calendar entries.
How your information is used
- To provide the core features: turning your voice into notes, reading your calendar back to you, and making calendar changes you request.
- To diagnose problems (for example, confirming whether a request succeeded or failed) without inspecting the private content involved.
- We do not sell your data, and we do not use it for advertising.
Who else processes your data
To provide the service, some data is sent to these processors, only as needed to perform the specific task:
- OpenAI — audio transcription (Whisper) and text-to-speech.
- Google (Gemini API) — turning raw transcripts into polished notes and classifying voice commands.
- Google Calendar API — reading and writing your calendar events, only after you connect your account and only for your own calendar.
- Supabase — hosts our database and backend functions.
Each of these processors has its own privacy practices governing how they handle data sent to them; we only send what's necessary for the specific feature you used.
Data retention and deletion
Your notes and account data are kept for as long as your account is active. You can request deletion of your account and all associated data at any time by emailing ironkeyestates@gmail.com.
Security
Calendar access tokens are stored on your own device, not centrally. Notes and account data in our database are protected so that only you can access your own records.
Children
RealFlow is not directed at, or intended for use by, anyone under 18.
Changes to this policy
If this policy changes in a way that matters, we'll update this document and change the "last updated" date above.