Last updated: October 29, 2026
Direct REI ("we," "us," or "our") operates the Direct REI platform. This policy describes what data we collect, why, and how we protect it.
When you create an account we collect your name, email address, and a password. Passwords are hashed and never stored in plain text.
To enable outreach on your behalf, you may connect external communication accounts (such as email or messaging accounts). When you do, we store the access details needed to send and receive on your behalf. These credentials are encrypted at rest using industry-standard encryption and decrypted only momentarily when the platform performs an action you've initiated.
You may upload or create contact records (names, email addresses, phone numbers, mailing addresses, property details, notes, custom fields) and outreach content such as email sequences, SMS templates, and direct-mail templates. We store this data in your account so the platform can execute campaigns on your behalf.
Messages sent through the platform and replies received are stored in your account to power conversation history, automated reply generation, and analytics.
If you turn on link click tracking for a campaign, the links in that campaign's messages go out as short Direct REI links that open the original page. When a recipient clicks one, we record when it was clicked, the browser's user-agent string, and a one-way fingerprint made from the network address and browser that cannot be reversed and changes every day. We use this to show you who clicked and to keep automated visits (such as email security scanners and link previews) out of your numbers. We do not record what the recipient does after the page opens, and we do not track whether emails are opened.
If you add a Personalized Line to a campaign message (Pro and Scale plans), we use the contact's name, company, title, market, website, the domain of their email address, and any public profile links you saved for them to look them up on the public web — or, for a property owner, the location of their property to find nearby places — and an AI service writes one sentence for that contact. We only read pages anyone can see without logging in, we never use people-search or background-check sites, we never keep where a contact lives, their age, or their relatives, and the sentence never covers personal topics such as health, family, finances, or legal matters. The facts found are kept with your account for up to 90 days. Each sentence is kept, together with the one fact it was written from, for up to 180 days after it is sent.
When you use Oliver, the AI assistant built into Direct REI, we store your messages, its replies, and the actions it took for you, so the conversation stays in your history and Oliver can pick up where you left off. Inside the app, a conversation with Oliver is visible only to the person who had it.
If your account uses the Team page (Pro and Scale plans), we store what you and your admins enter about the people on your team: name, job title, start date, work email and phone, and status. We also store the time clock: when each person clocked in and out and took breaks, notes on their time, every change to it with who made it and why, time fix requests, announcements with who read and confirmed them, and your team's scripts, objection answers and training. Location is saved only if the account owner turns on location at clock in and out, and only when the person's browser allows it; it is rounded to about 10 meters. The account owner and admins can see this for the people they manage, an admin cannot see the owner's records, and everyone else sees only their own. If you use pay and time off, we also store each person's pay rates, payroll details (employment type, payroll provider ID, usual hours, last day), bonus rules, one-off bonuses and reimbursements, the pay worked out for each pay period once it is closed, time off requests and decisions, paid time off balances and their history, and any personal email, phone, home address and emergency contact the person or an admin enters. No money moves through Direct REI for pay. Who's out is visible to the whole team, without the kind of time off or any note. If you use the schedule, we store each shift (who, when, what, where and a note), requests to pick up an open shift or for someone to cover, and the days and times each person says they can or can't work. The posted schedule is visible to the whole team, drafts only to the owner and admins, and availability only to the person and whoever manages them. People on your roster don't need a Direct REI login. Do not type Social Security numbers, bank details or other sensitive personal information into these fields.
If you use team documents, we store the files you, your admins or the person upload — such as tax forms, identification, licenses, certifications and agreements, which can contain sensitive information like tax ID numbers — together with each file's name, type, expiry date and who added it, the requests you send asking someone for a document, documents sent for e-signature and their signed copies, and onboarding checklists and their progress. Files are kept in private storage that only the person and the account owner and admins who manage them can open, through links that expire after a few minutes; a document marked for admins only is hidden from the person too, and nobody else on the team can see any of it. Notifications and emails about team documents never name the document. Oliver can see a team document's title and status but never its contents. Team documents are kept until you delete them or your account closes. You are responsible for which documents you collect and how long you keep them.
If you use performance reviews, we store the reviews, 1:1 meeting notes and private notes that the account owner and admins write about the people they manage — a rating, what went well, what to work on, notes and goals — with a snapshot of that person's numbers for the review period when one is attached, plus when it was shared, when the person acknowledged it and any comment they add. A draft or a private note is visible only to the account owner and the admins who manage that person; a review is visible to the person once it is shared with them, and to nobody else on the team. Notifications and emails about reviews never include what was written. Reviews are kept until they are deleted or your account closes.
If you use meetings and meeting polls, we store each meeting or poll — its name and note, the time (or the days, hours and length offered), who set it up and who is invited, the video meeting link added to it, the Team Chat conversation it was posted in, and the time that was picked — and, for a poll, the half hours each invited person marked as free. A meeting or poll and everyone's answers are visible to the people invited to it; one for chosen people is also visible to the account owner; one started in a direct message is visible only to the people in that message. Meetings and polls are kept until they are deleted or your account closes.
If you invite people from outside your team to a meeting, we store their name and email address (and the contact record they came from, when they were picked from your CRM) and where each invite email stands. Their invite, update and cancellation emails are sent from the email account you connected to the platform, in your name, with the meeting time, the video link and calendar links; we don't send them marketing or use their address for anything else. Contacts who opted out of your emails, or whose email bounced, are not emailed. If you save your Zoom, Google Meet or Microsoft Teams links in Settings, we store those links on your own profile so they can be added to the meetings you set up.
Payments are processed by a third-party payment processor. We do not store credit card numbers, bank account details, or other sensitive payment data on our servers.
If you let buyers put a deposit down on a property through a website you host with us, the buyer's name, email address, phone number (if given), the amount, whether they agreed to your deposit terms, and the network address the request came from are stored in your account with the deposit. The payment itself is made on Stripe's checkout page and goes to your own connected Stripe account; card and bank details go to Stripe, never to us. We keep a reference to your Stripe account so deposits reach it, and we receive Stripe's notice when a deposit is paid or refunded.
We track aggregate usage metrics (such as messages sent, automated replies generated, and contacts created) to operate the service and enforce plan limits. We do not use third-party advertising trackers.
If you reach our website by clicking one of our ads, we note which ad it was and which of our pages you were shown, and keep that note in your browser for up to 30 days. If you create an account during that time, we save the same details with your account so we can tell which ads bring in customers. This stays with us: we do not send your email address or any other personal information to the company that showed the ad.
We do not sell your data. We do not use your data for third-party advertising, and we do not share it with advertising networks or data brokers. We do not share your contact lists or message content with other users of the platform.
We rely on a small number of trusted service providers to operate the platform, including for cloud hosting, authentication, database services, payment processing, content generation, and message delivery. These providers process data on our behalf under contracts that restrict their use of the data to what is necessary to provide their service. We select providers based on their security and privacy practices, including, where applicable, commitments not to use customer data to train their models. A current list of categories of providers we use is available on request.
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data, contact records, message content, and connected-account credentials within 30 days. Anonymized usage statistics and billing records required for legal or accounting purposes may be retained longer. If you have opted out of marketing messages, we also keep your email address or phone number on a do-not-contact list indefinitely — that record exists solely so we cannot contact you again, it is never used for any other purpose, and deleting it would defeat your opt-out.
You may request to:
To exercise these rights, email us at info@directrei.com.
Opting out of marketing does not require you to contact us: the unsubscribe link in every marketing email is one click and takes effect immediately, as does replying STOP to a text.
We use only essential cookies and browser storage: to keep you signed in and, if you came to our website from one of our ads, to remember which ad (see “Our own ads” above). We do not use advertising, analytics, or tracking cookies.
Direct REI is not intended for use by anyone under 18. We do not knowingly collect data from minors.
Your data may be processed in countries other than your own. By using the platform, you consent to such processing. We take reasonable steps to ensure your data is treated in accordance with this policy regardless of where it is processed.
We may update this policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the platform after changes constitutes acceptance of the revised policy.
Questions about this policy? Email us at info@directrei.com.