Privacy policy

This policy covers vacantloop.com and the VacantLoop application at platform.vacantloop.com, operated by TNENI Labs LLC (“we”). It is written to be read rather than to be survived, and it says what the software actually does.

Two different relationships

When you visit this website or ask for a demo, we are the controller of the information you give us.

When a landlord uses the application, that landlord decides what goes into their workspace — their inventory, their leads, their brokers, their conversations. We process it on their instructions and for no other purpose. If you are a prospect or a broker whose details are in a customer’s workspace, that customer is the right first point of contact, and we will help them respond.

What we collect

• Demo requests. Your name, work email, company, an optional description of your portfolio, and anything you write in the message box. It is emailed to us; the website does not store it in a database.
• Account information. For application users: name, email address, a hashed password, organization membership and role.
• Customer content. Buildings, suites, rates, media, leads, prospects, brokers, and the email conversations a customer captures into their workspace, including the raw inbound message.
• Operational records. Audit entries for creates, edits, status changes and sends; error and access logs; and what the email provider reports back about a message — its delivery identifier, and whether it bounced or was marked as spam. A hard bounce marks that address unusable for future outreach, which is the point of collecting it.
• Website analytics. None today. This site sets no advertising or analytics cookies and does not track you across other sites. If that changes, this section changes with it before the code does.

The application uses cookies only to keep you signed in and to remember your light or dark theme preference. There is no advertising cookie anywhere in either surface.

Why we use it

• To provide the application to the customer who put the data in it.
• To reply to a demo request or a support message.
• To keep the service secure and working: rate limiting, abuse prevention, debugging, and the audit trail a customer needs to see who did what.
• To meet a legal obligation where one applies.

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we do not use one customer’s content to answer another customer’s questions.

AI processing

Summaries, suite matching, and reply drafts are produced by sending the relevant conversation and retrieved master records to a third-party model provider. Separate decision support evaluates redacted conversation text for leasing intent, commercial questions, reply path, and readiness. Contact names, email addresses, and phone numbers are removed from that decision request. AI recommendations remain subject to human review, and a person on the customer’s team approves every message before it is sent. Customer content is processed to provide these outputs and is not used by us to train a model.

Who processes data for us

• Application hosting and delivery — Vercel (United States).
• Database — Neon, managed PostgreSQL (United States).
• File and image storage — Backblaze B2, for suite photos and attachments.
• Email — Resend, for sending, for receiving replies and inquiries, and for reporting what happened to a message after it was sent.
• AI model provider — Anthropic, for summarising, matching and drafting.
• AI decision provider — TypeSafe AI, for evaluating redacted inquiry context and returning reviewable decision signals.
• Business research — SerpApi, for customer-requested searches using a qualified prospect’s business name and public business address.
• Optional sign-in — Google, only for customers who choose to use “Sign in with Google”.

Each is used for the purpose named and bound to it. We will update this list before adding a processor that touches customer content.

How long it is kept

• Customer content — for as long as the customer keeps their workspace, and deleted or returned on request when an engagement ends.
• Demo requests — kept in our email while the conversation is live and while it is reasonable to follow up.
• Audit records — retained for the life of the workspace, because their value is precisely that they are not editable after the fact.
• Password reset links — thirty minutes, single use.

Your choices

• Access, correction, export or deletion. Email us and we will action it, or route it to the customer whose workspace holds the record.
• Opting out of outreach. Every outreach email carries a signed unsubscribe link, and the opt-out is honoured at send time rather than at list-build time.
• Residents of states or countries with statutory privacy rights — including California, Texas and the EEA/UK — may exercise them at the address below, and we will not discriminate against you for doing so.

Security

Isolation between customers, human approval on outbound messages, and attributable changes are described on the security page, including what we do not have.

Children

This is business software for commercial real estate. It is not directed to anyone under 18, and we do not knowingly collect their information.

Changes

If this policy changes materially we will update the effective date above and tell active customers directly rather than relying on you to re-read the page.

Contact

info@tneni.com — privacy questions, data requests and vulnerability reports all reach a person here.