Privacy Policy

Who we are What we collect Google user data Microsoft data Ads and lead pages How we use it Sharing Retention and deletion Security Your choices Contact

Limited Use disclosure. Belvedere's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we are

Belvedere is an online workspace for real estate agents, built and run by LJ Kennedy in Spokane, Washington ("Belvedere," "we," "us"). The app is at app.trybelvedere.com and our homepage is trybelvedere.com. This policy applies to the Belvedere website and app, including the Belvedere Google Calendar and Microsoft Outlook calendar connections. Questions go to [email protected].

It covers two groups of people: agents and teams who use Belvedere ("agents"), and the clients and other contacts whose information agents keep in Belvedere ("contacts").

What we collect

From agents

Account details: name, email, phone, brokerage, license and MLS membership numbers, markets, logos, photos, email signatures and branding choices.
Billing details handled by Stripe. We see your plan and payment status, not your full card number.
Work you create: CMAs, reports, notes, tasks, appointments, emails, templates, files and settings.
Basic technical data, such as sign-in times, browser and device type, and error logs, used to keep the service running and secure.

About contacts

Agents add the people they work with: names, emails, phone numbers, addresses, property interests, notes, linked people (for example a spouse or co-buyer) and the history of messages sent. The agent decides what to add and is responsible for having a proper basis to contact those people. We process this information on the agent's behalf.

Listing and public data

Belvedere shows listing and market data from MLS feeds an agent is authorized to use, and from public sources such as public records and Google Maps/Places.

Calendar data (only if you connect a calendar)

Connecting a Google or Microsoft calendar is optional. What we access and how we handle it is described in the next two sections.

Google user data

This section applies to information Belvedere receives from Google when an agent clicks Connect next to Google Calendar in Belvedere's Calendar.

What Google user data we access

Your Google account email address (scopes openid and email), so Belvedere can show which account is connected.
Your Google Calendar events (scopes https://www.googleapis.com/auth/calendar.readonly and https://www.googleapis.com/auth/calendar.events): event title, start and end time, all-day flag, location, attendee email addresses, the calendar it belongs to, and a link to open the event in Google Calendar.

Belvedere writes to your Google Calendar only when you act in Belvedere. It creates, updates or deletes events only in these cases:

When you add, move, edit or delete an appointment in Belvedere, the same change is made to its copy on your primary Google Calendar. Belvedere tags that copy with a private Belvedere appointment ID so the two stay linked.
When you edit or delete one of your own Google Calendar events from inside Belvedere.

Belvedere never changes or deletes other Google events on its own, and never changes events you can only view.

How we use Google user data

To show your own Google Calendar events in your Belvedere calendar (day, week, month and schedule views), next to the appointments and tasks you keep in Belvedere, so you can see your whole day in one place.
To keep Belvedere appointments and their Google copies in step. If you change or delete a Belvedere appointment's copy in Google Calendar, Belvedere updates or deletes the matching Belvedere appointment, and copies the change to your other connected calendar if you have one.
To label an event with a contact's name when an attendee's email address matches a contact in your own Belvedere contact list. This match happens on screen and is not saved.

We use Google user data only to provide and improve these features, which are visible in Belvedere's Calendar. We do not use it for anything else.

How we store and protect Google user data

We store your Google email address and the access and refresh tokens Google gives us. Tokens are encrypted with AES-256-GCM before they are saved, and the encryption key is kept separately from the database.
We do not keep a copy of your Google Calendar events. Events are fetched from Google when you open the calendar and held in server memory for up to 3 minutes so the page loads quickly. Then they are discarded.
For appointments you create in Belvedere, we save the Google event ID and last-updated time of each Google copy with the Belvedere appointment, so the two stay linked. If a change made in Google is brought back into Belvedere, it is saved as part of your own Belvedere appointment.
All data moves over encrypted HTTPS connections, and access to production systems is limited to the people who run Belvedere.

Who we share Google user data with

Your Google user data is shown only to you, the signed-in agent who connected it. It is not shown to other agents, team leaders or contacts. It is processed on our hosting provider, Render, which runs Belvedere's servers and database for us. We do not share, transfer or disclose Google user data to anyone else, except:

if needed for security, such as investigating abuse;
to comply with applicable law; or
as part of a merger, acquisition or sale of Belvedere, and only after getting your explicit consent first.

What we never do with Google user data

We do not sell Google user data.
We do not use or transfer it for advertising, including targeted, personalized, retargeted or interest-based ads.
We do not transfer it to data brokers or information resellers.
We do not use it to determine creditworthiness or for lending purposes.
We do not use it to build databases or lists for any purpose other than showing you your own calendar.
We do not use it to develop, improve or train artificial intelligence or machine-learning models.
No person at Belvedere reads your Google user data unless you ask us to help with a specific problem and agree to it, it is needed for security (such as investigating a bug or abuse), or the law requires it.

Retention and deletion of Google user data

Google Calendar events are kept in memory for no more than 3 minutes.
The Google event IDs saved with Belvedere appointments are deleted when you delete the appointment or close your account. After you disconnect Google, they are no longer used.
Your Google email address and tokens are kept only while your Google Calendar stays connected.
When you click Disconnect in Belvedere's Calendar settings, we delete the stored tokens and email right away and ask Google to revoke Belvedere's access.
When your Belvedere account is closed, we delete any calendar connections and tokens along with the account.
You can also remove Belvedere's access at any time from your Google Account permissions page. After that, Belvedere can no longer read or update your calendar, and the connection shows as expired in Belvedere. Click Disconnect to delete the leftover connection record.
To ask us to delete your data, email [email protected]. We will confirm within 30 days.

Microsoft data

This section applies to information Belvedere receives from Microsoft when an agent clicks Connect next to Microsoft (Outlook / Teams) in Belvedere's Calendar. It works for Microsoft work or school accounts and personal Microsoft accounts.

What we access

Your basic profile and email address (Microsoft Graph permission User.Read), to show which account is connected.
Your Outlook calendar events, with read and write access (Calendars.ReadWrite): subject, start and end time, all-day flag, location, online (Teams) meeting details, free/busy status, whether it was cancelled, attendee email addresses, and a link to open the event in Outlook.
offline_access, so the connection keeps working without asking you to sign in every hour.

Belvedere writes to your Outlook calendar only in the same cases described for Google: to copy appointments you add, move, edit or delete in Belvedere, and when you edit or delete one of your own Outlook events from inside Belvedere. It does not read or send your email.

How we use, store and share it

We use, store, protect, share and delete Microsoft data in exactly the same way as Google user data, as described above. It is used only to show your own events in your Belvedere calendar and keep your Belvedere appointments in sync with Outlook. Tokens are encrypted. Events are held in memory for no more than 3 minutes. It is shown only to you. We do not sell it, use it for advertising or marketing, transfer it to third parties, or use it to train AI models.

How to revoke access

Click Disconnect in Belvedere's Calendar settings. We delete the stored tokens right away.
Personal Microsoft accounts: you can revoke Belvedere's access at any time at account.live.com/consent/Manage.
Work or school accounts: you can review and remove apps at myapps.microsoft.com. Your organization's administrator can also remove Belvedere for everyone in the organization.

Ad accounts and ad lead pages

This section applies when an agent uses Belvedere's Ads tools, and to people who visit an agent's ad lead page.

Connected ad accounts (agents)

An agent can connect their own Meta (Facebook and Instagram) ad account and their own Google Ads account. Belvedere uses that access only to create, pause, resume and report on the ads and audiences the agent sets up in Belvedere, in the agent's own accounts.
For Google Ads this uses the scope https://www.googleapis.com/auth/adwords. Google Ads data is used only to provide these features, under the same Limited Use rules described in the Google user data section above. We never sell it, never use it to advertise to anyone ourselves, and never combine one agent's ad data with another's.
Ad spend is charged by Meta or Google to the agent's own payment method. Belvedere never sees or stores card numbers.
Connection keys are kept on Belvedere's servers, are never shown in the browser, and are deleted when the agent clicks Disconnect.

Ad lead pages and retargeting (visitors)

When an agent turns on retargeting, that agent's own Meta pixel and Google tag load on that agent's lead pages. They place cookies that tell Meta and Google you visited the page, started the form, or sent it. The agent can then show you related ads later, for example a reminder about a home value report or a home you looked at.
These audiences are built only from visits to the agent's own lead pages. They are never built from age, gender, family status, ZIP code or any other protected characteristic, and housing ads follow Meta's and Google's housing-ad rules.
Meta and Google handle that cookie data under their own privacy policies: Meta Privacy Policy and Google Privacy Policy.
Your choices: click "Don't track me" at the bottom of any lead page to stop the pixel and tag from loading on that device. Belvedere also honors the Global Privacy Control signal from your browser. You can manage ad preferences in your Meta ad preferences and Google My Ad Center.
Information you type into a lead page form (such as your name, email, phone and address) goes to the agent's Belvedere CRM so the agent can answer your request. It is not sent to Meta or Google.

How we use information

To run Belvedere: build reports and CMAs, send the emails and texts an agent asks us to send, show calendars and tasks, and keep the CRM up to date.
To bill subscriptions and provide support.
To keep the service secure, prevent abuse and fix problems.
To tell agents about important changes to the service.

We do not sell personal information, and we do not use contacts' information to market to them ourselves.

Emails and texts to contacts

When an agent sends an email or text through Belvedere, it is sent on that agent's behalf. Contacts can unsubscribe from emails with the link in each message, or reply STOP to texts, and Belvedere honors those requests for that agent.

We share information only with service providers that help us run Belvedere, and only for that purpose:

Render: hosting and database
Resend: email delivery
Twilio and SMS gateway providers: text messages, when an agent turns texting on
Stripe: payments
Google: Maps and Places, Google Calendar if you connect it, and Google Ads if an agent connects it
Meta: Facebook and Instagram ads, if an agent connects a Meta ad account
Microsoft: Outlook calendar if you connect it

Within a team, a team leader can see team activity and the contacts their role allows. Team leaders cannot see an agent's connected Google or Microsoft calendar. We may also share information if the law requires it, to protect people's safety, or as part of a sale or merger of Belvedere. In a sale or merger, this policy still applies, and we will ask for your consent before transferring any Google or Microsoft calendar data.

How long we keep information

We keep account and CRM data while the agent's account is active. When an agent closes their account, we delete or anonymize their data within 90 days, except records we must keep for legal, tax or billing reasons. Calendar connections are deleted as described above. Backups are overwritten on a regular schedule.

Security

Information travels over encrypted HTTPS connections. Calendar tokens are encrypted at rest, and only the people who run Belvedere can access production systems. No system is perfectly secure. If a breach affects your information, we will tell you promptly, as well as Google or Microsoft when their data is involved.

Your choices and rights

Agents can view, edit or delete most of their data in the app, disconnect calendars at any time, or ask us to export or delete everything.
Contacts who want to see, correct or delete their information should ask the agent they work with first. You can also email us, and we will help or pass the request to the agent.
Depending on where you live, you may have more rights under state privacy laws. We honor those requests when they apply.

Children

Belvedere is for working real estate professionals and is not meant for anyone under 18.

Changes to this policy

If we change this policy, we will update the date above. If we ever want to use Google or Microsoft calendar data in a new way, we will update this policy and ask for your consent in the app first. For other important changes, we will tell agents in the app or by email.

Contact

LJ Kennedy, Belvedere · Spokane, WA · [email protected] · (907) 330-7920