Privacy Policy

Agents — real estate professionals who create an account on Cairn and use it to send transaction updates to their clients.

Clients — buyers and sellers whose phone numbers and names are entered by an agent when creating a client link. Clients never create a Cairn account; they access their link without one.

From agents: email address (used for sign-in), name, brokerage name, and an optional notification phone number for client-activity alerts. Passwords are never stored by Cairn — authentication is managed by Supabase, which hashes credentials using industry-standard methods.

From agents on behalf of clients: client name, property address, and one or two client phone numbers. These are entered by the agent, not directly by the client.

Usage data: which phases were advanced, when notes were saved, when clients tapped the "I feel informed" button, and whether a client indicated Cairn was useful. We do not use third-party tracking pixels or behavioral advertising.

Billing: payment card details are handled entirely by Stripe. Cairn never sees or stores full card numbers.

Client phone numbers, names, and property addresses are encrypted at rest using AES-256-GCM before being written to our database. Each field uses a unique initialization vector, and the encryption key is stored separately from the data in an environment secret — meaning a database dump alone cannot reveal client PII.

All data is transmitted over HTTPS. Access to client data in the database is restricted by row-level security: agents can only read transactions they created.

Cairn sends text messages to client phone numbers on behalf of the agent — for example, when the agent advances a phase or saves a note. These are transactional messages, not marketing.

Agents are required to obtain verbal consent from their clients before entering a phone number into Cairn. By creating a client link with a phone number, the agent confirms they have obtained that consent. We timestamp this confirmation.

To stop receiving texts: reply STOP to any Cairn message. Standard message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

We use the information we collect to:

• Deliver transaction update texts to clients
• Show agents their client links and deal progress
• Notify agents when clients open their links or share feedback
• Process payments and manage subscriptions
• Respond to support requests

We do not sell your data. We do not share client PII with third parties except the services listed below that are necessary to operate Cairn.

Supabase — database and authentication hosting. Data is stored in the US.

Twilio — SMS delivery. Twilio receives the recipient phone number and message body. Their privacy policy governs how they handle that data.

Stripe — payment processing. Stripe receives billing information directly; we receive only a customer ID and subscription status.

Active and closed transaction records are retained while the agent's account is active. When an agent deletes a transaction, all PII fields (name, address, phone numbers) are immediately wiped from the database. The transaction record shell is kept for referential integrity; it contains no personal information.

If you close your Cairn account, all your data — including transaction records — is deleted within 30 days.

Depending on where you live, you may have the right to access, correct, or delete personal information we hold about you. California residents have additional rights under the CCPA, including the right to know what data is collected and to opt out of its sale (we do not sell data).

To exercise any of these rights — or to submit a deletion request — email us at hello@cairnclose.com with the subject line "Data Request". We'll respond within 10 business days and complete any deletion within 30 calendar days.

Cairn is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have, contact us and we'll delete it.

We may update this policy as the product evolves. When we make material changes, we'll update the effective date at the top and, where appropriate, notify agents by email. Continued use of Cairn after changes take effect constitutes acceptance of the updated policy.

Questions about this policy or your data? Reach out at hello@cairnclose.com. We're a small team and we read every message.