Privacy Policy

AVANZA CRM is software for real estate professionals operated by Melanite Acquisitions, LLC. Melanite Acquisitions, LLC is the data controller for account holder information described in this policy. This policy takes effect on October 13, 2026. Our privacy contact is Erik Uraje at erik.uraje@gmail.com.

This policy addresses information about account holders and visitors and information customers store about their clients. For account administration, AVANZA determines how information is used. For client records uploaded by an agent or brokerage, that customer generally determines the purposes of use and AVANZA processes the records to provide the CRM. Contact the relevant agent or brokerage about how it uses your information.

Account information may include your name, email address, phone number, brokerage, license information, sign-in information, workspace membership, account status, preferences, and support communications. Password authentication is handled by our authentication provider; passwords are not displayed to AVANZA account administrators.

Workspace information is the data you choose to enter, including client names and contact details, budgets, preferred areas, notes, messages stored in the Inbox, tasks, events, listings, opportunities, campaign records, and transaction details. A stored message is not evidence that it was sent through an external email or text service.

Technical information may include IP addresses, browser and device information, session identifiers, access times, errors, and security or administrative audit records generated by hosting and authentication services. We use this information for service operation, reliability and security.

We receive subscription status, billing identifiers, charge amounts, and limited billing details from the payment provider. Full card information is handled by that provider rather than stored as a CRM record. Paddle handles payment card information under its own privacy notice.

We receive information you enter directly, information supplied by authorized members of your organization, information generated when you use the service, and information from providers you authorize. If you choose Google sign-in, the identity provider supplies information needed to authenticate your account, such as your email and basic profile.

Use contact imports or external integrations only when you have permission to access and process that information. We do not treat uploading a contact as consent from that person to receive marketing.

We use information to authenticate users, create and maintain private workspaces, save records, apply preferences, provide requested support, administer accounts, investigate abuse, maintain reliability, comply with legal obligations, and respond to privacy requests. We also use billing information to manage subscriptions, payment status, and billing notices.

The assistant currently processes CRM information to provide scripted suggestions, not connected AI model responses. We will update this policy and obtain any required consent before introducing new AI processing.

Where a legal basis is required, account and workspace processing is necessary to perform our contract; security, reliability and support rely on legitimate interests; legally required records and disclosures rely on legal obligations; and optional activities requiring permission rely on consent, which you may withdraw.

Infrastructure and authentication are provided through Lovable Cloud and its underlying service providers. They process information needed to host and operate AVANZA. Google is involved if you choose Google sign-in. Paddle.com acts as Merchant of Record for the sale of subscriptions and processes information needed for payments, subscription management, tax compliance, and invoicing. Google Fonts receives technical requests when fonts are loaded. We share information with professional advisers, including legal and accounting advisers, when needed for their services. New connected services will be covered by updated disclosures.

Workspace records are intended to be accessible only to authorized members of that workspace. Authorized platform administration may involve access to account metadata, record counts, audit information, and, for support purposes, records, and such access is recorded in an administrative audit log. A private workspace does not mean that authorized service administrators or infrastructure providers can never access data.

Information may be disclosed where reasonably necessary to comply with law or valid legal process, protect people and the service, investigate fraud, or complete a business transfer, subject to applicable privacy requirements. We do not authorize customers to access other customers’ workspaces.

We use personal information for the service purposes described in this policy. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects. If that changes, we will update this policy and provide any opt-out required by applicable law, including the Virginia Consumer Data Protection Act.

Authentication may use cookies or browser storage to maintain your signed-in session. Hosting and external resources may also receive technical requests when pages load. For example, the current site loads fonts from Google Fonts, which can receive your IP address and browser request information.

Blocking necessary browser storage can prevent sign-in or disrupt the service. The app uses essential session storage for authentication. Optional advertising cookies are not part of the CRM experience. You can manage cookies through your browser settings. If optional tracking is introduced, we will disclose its purpose and provide legally required choices before enabling it.

We maintain reasonable technical and organizational safeguards, including encrypted HTTPS connections, authenticated access, and workspace access controls designed to limit access to the correct account. We rely on infrastructure providers for applicable hosting and authentication safeguards and review our security practices periodically as features and providers change.

No internet service can guarantee absolute security. Protect your credentials, sign out of shared devices, limit unnecessary sensitive records, and report suspected unauthorized access to erik.uraje@gmail.com. We will respond to confirmed security incidents and provide notifications required by applicable law, including Va. Code § 18.2-186.6.

While an account is active, we retain records as needed to provide the workspace and for legitimate business or legal purposes, taking into account the nature of the information, the customer’s instructions, security needs, and legal requirements.

After cancellation, records may be retained to fulfill recovery, export or deletion requests, resolve disputes, and meet legal obligations. Request a copy or deletion through erik.uraje@gmail.com. We delete or anonymize information when it is no longer needed for these purposes; retention is not a guarantee of continued account access.

Billing and tax records, support communications, and security or audit logs may require different retention periods. Deleted information may remain in protected backups until those backups expire. Backups are subject to the infrastructure provider’s retention and deletion cycles and are not used for ordinary access after deletion.

Depending on your location and whether applicable privacy laws cover AVANZA, you may have rights to access, correct, delete, or obtain a copy of personal information, and to opt out of certain sales, sharing, targeted advertising, or profiling. Some laws provide appeal rights and rights for authorized agents. These rights are subject to identity verification and lawful exceptions.

Email erik.uraje@gmail.com with your request. Do not include a password or sensitive identification document in the initial email. We may ask for proportionate information to verify your identity and will respond within the time required by applicable law. If a request is denied, you may reply to seek an appeal where applicable. We will not unlawfully discriminate against you for exercising privacy rights.

If your information was entered by an agent or brokerage, contact that business first. AVANZA may refer your request to the responsible customer or assist it as required by law. The categories described in this policy include identifiers, account and commercial information, internet activity, and information you submit. Contact us for details of disclosures relevant to your request.

The service is intended for business users who are at least 18 years old and is not directed to children under 13. Do not knowingly enter information collected from children without a lawful basis and any required parental consent under the Children’s Online Privacy Protection Act. If you believe a child has provided information improperly, contact us so we can investigate and take appropriate action.

AVANZA is operated in the USA. Information may be processed in the USA and other countries where our infrastructure and service providers operate. Where applicable law requires transfer safeguards, we use applicable adequacy decisions, standard contractual clauses or other lawful safeguards. Contact us for information about transfers affecting your data.

Where GDPR or equivalent laws apply, you may request access, rectification, erasure, restriction, portability or objection, withdraw consent, and complain to your supervisory authority. We respond to GDPR requests within one month, subject to lawful extensions, and comply with other applicable response periods.

We will publish dated policy updates and give appropriate notice of material changes. We will reflect new processing activities in this policy before or when they begin and obtain additional consent where legally required.

Contact Melanite Acquisitions, LLC, attention Erik Uraje, at erik.uraje@gmail.com for privacy questions or requests.