ControlLaunchPad is a CRM for real estate teams and other businesses that work with leads. This policy explains what information we collect, why, who we share it with, how long we keep it and the choices you have. We've tried to write it in plain English.
The short version: we use your information to run the service, we never sell it, and the data you keep about your own leads and clients belongs to you.
ControlLaunchPad is operated by Control LaunchPad LLC ("ControlLaunchPad", "we", "us"), 30 N Gould St, Ste 62372, Sheridan, WY 82801, United States. You can reach us about privacy at support@controllaunchpad.com.
This policy covers our website (controllaunchpad.com), the ControlLaunchPad app (app.controllaunchpad.com) including when it's installed on a phone, our API, and the public pages we host for our customers, such as booking pages, lead-capture forms, the website chat widget, client request forms and unsubscribe pages.
For account information we're the controller. When you sign up, sign in, pay us or contact us, we decide how that information is used, as this policy describes.
For our customers' data we're a processor (service provider). Our customers are agents, teams and brokerages. The leads, contacts, conversations, deals and files they keep in ControlLaunchPad ("Customer Data") belong to them, and we handle it only to provide the service to them, following their instructions and our Terms of Service.
If you're a lead or client of one of our customers, for example because you filled out a form, booked a showing, texted a business or chatted on its website, that business decides how your information is used. Please contact them with questions or requests. If you contact us, we'll pass your request to them and help them respond.
Information you give us
- Account information: your name, email address, password (stored only as a one-way hash), optional phone number, email signature, time zone, and two-step sign-in settings.
- Workspace information: your workspace's name, industry, time zone, teams, roles and settings, and the people you invite.
- Billing information: your plan, seats, billing period, AI credit purchases and usage, invoices and payment history. Card details go directly to Stripe, our payment processor. We never receive or store full card numbers; we keep only the card brand, last four digits and expiry date so you can recognize the card.
- Business details for carrier registration: if you register your texting numbers with US carriers through a Telnyx account you connect, the business details you enter (such as legal business name, tax ID, address and contact) are sent to Telnyx for that registration.
- Messages to us: what you send our support team through in-app chat or email.
Customer Data our customers put into the service
Leads and contacts (names, phone numbers, email addresses, mailing and property addresses, birthdays, notes, tags, custom fields and qualification answers), deals and closings, tasks, appointments, files and photos, texts, emails, website chats, call logs, and, where a customer turns them on, call recordings and voicemails. It also includes what visitors type into a customer's booking pages, forms, chat widget or client request forms. For those pages we also record the visitor's browser type, the page and referring page (including campaign tags) and the consent choices they made.
Information collected automatically
- Sign-in and device information: the sessions you're signed in on, with the browser and operating system read from your browser's user agent, so you can see and sign out your devices.
- Security information: IP addresses, used to slow down repeated sign-in attempts and protect public forms from abuse. We keep only keyed hashes of them for this, and sign-in counters are deleted within 24 hours. Our hosting providers keep standard server logs, which include IP addresses, for a limited time.
- Activity in the app: actions in your workspace, such as who changed a lead or a setting, recorded in the workspace's activity history and audit log.
- Push alerts: if you turn on phone or browser alerts, the delivery address your browser gives us for that device.
Information from services you connect
- Google Calendar or Outlook: see Google and Microsoft calendar data below.
- Facebook and Instagram lead ads, Google Ads lead forms, portal emails (such as Zillow or Realtor.com) and webhooks: the leads those services send to your workspace.
- Texting and calling providers: delivery status of texts, call details and, where turned on, recordings and voicemails.
- Stripe: whether a payment succeeded, failed or was refunded.
- To provide the service: run your workspace, deliver the texts, emails and calls you and your automations send, sync calendars you connect, and show you your data.
- To handle your account and billing: sign-up, the card check at the start of your trial, subscriptions, invoices, and billing emails (such as a failed payment, a card about to expire, or your trial ending in 3 days).
- To send service messages: email verification, password resets, invitations, the alerts you choose in Settings → Notifications, and important notices about the service or these policies.
- To keep the service secure: prevent fraud, spam and abuse, enforce our Terms, and investigate problems.
- To support you: answer your questions. When you ask for help, or when needed to investigate abuse or keep the service secure, our support staff may open a read-only view of your workspace for up to 15 minutes at a time; each view is recorded with its reason.
- To improve the service: understand, in aggregate, which features are used and where things go wrong.
- To meet legal obligations: tax, accounting and lawful requests.
We don't use Customer Data for our own marketing, we don't sell it, and we don't use it to build advertising profiles.
Some features use artificial intelligence: the brief at the top of a lead, message drafts and reply ideas, call summaries, the dashboard's morning briefing and "Ask your CRM". These features are powered by Claude, through Anthropic's commercial API.
- When you use one of them, we send Anthropic only what that feature needs, such as the relevant lead's details and recent conversation, your call notes, or your question with a summary of the data you can already see.
- Your data is never used to train AI. We don't use Customer Data to train AI models, and under Anthropic's commercial terms, Anthropic doesn't use it to train its models either. Anthropic may keep it for a limited time under its own policies, for example to detect misuse.
- We save what these features write, such as a lead's brief or your morning briefing, with your workspace's data, so it doesn't have to be made again each time you look.
- For billing and to keep costs in check, we record each AI request: the feature, when, the person it was for, and the credits and amount of text (tokens) it used. This record doesn't include the text itself.
- Owners and admins can turn AI features off for the workspace. While they're off, nothing is sent to Anthropic.
- AI output can be wrong. Drafts and suggestions are never sent on their own: a person reviews and sends them. Please check them before you do.
- We never send Google user data to Anthropic or use it for AI.
ControlLaunchPad's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Each person can connect their own Google Calendar or Outlook calendar to ControlLaunchPad. When you do, we ask for permission to read your calendars and to add, change and remove events, and we use that access only for two things you can see in the app:
- Busy times: we read when your events start and end and whether they show you as busy, so your booking pages don't offer times you're already taken. We don't read event titles, descriptions, locations or other attendees. Busy times are kept in memory for a short time to keep booking pages fast, never stored in our database.
- Appointments on your calendar: when an appointment is booked with you in ControlLaunchPad, we add it to your calendar (with the lead's name and contact details and a link back to the lead) and update or remove it if the appointment changes. We only change events we created.
- We also read your calendar list and your account's email address, so you can choose which calendars count and see which account is connected.
We use Google and Microsoft calendar data only to provide these features. We don't use it for advertising, we don't sell it, we don't transfer it to anyone except as needed to provide these features, for security or to comply with the law, and we don't use it to develop, improve or train AI or machine-learning models. People at ControlLaunchPad don't read it unless you ask us to for support, or it's needed for security or the law.
Your access tokens are encrypted. You can disconnect at any time in Settings → Integrations or My account: we revoke our access at Google and delete the tokens we hold. You can also remove our access in your Google Account permissions or, for Microsoft, at account.microsoft.com (personal accounts) or myapps.microsoft.com (work accounts).
Our customers use ControlLaunchPad to text their own leads and clients: replies to inquiries, appointment confirmations and reminders, follow-ups and, with consent, offers. Each customer is responsible for having the consent the law requires before texting someone.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.
We use text-messaging opt-in records only to deliver the messages requested and to honor opt-outs. Replying STOP turns texts off and adds the number to that business's do-not-contact list; replying START turns them back on. See our SMS terms.
- Account information: while your account is open. If you ask us to close it, we delete or anonymize it, except what we must keep for legal reasons.
- Customer Data: for as long as the customer keeps it. Customers can delete leads, conversations and files at any time. If a subscription ends, we keep the workspace so it can be reopened, until the customer asks us to delete it.
- Deleting a workspace: when a customer asks, we close the workspace straight away and permanently delete its data after a 30-day holding period, so a mistaken request can be undone.
- Backups: encrypted backup copies are deleted on a rolling schedule, normally within 30 days; the most recent copy is kept until a newer one replaces it.
- Unconfirmed sign-ups: if an email address is never confirmed, the saved card is released and the sign-up expires after 30 days.
- Billing records: as long as tax and accounting laws require.
- Saved AI results (such as lead briefs and briefings): until they're made again or replaced, and deleted with the lead, person or workspace they belong to. Records of AI requests: while the workspace exists.
- Webhook delivery logs: 30 days.
- Support conversations: while your account is open, so we can follow up on earlier questions.
- Everything between your browser and us travels over HTTPS.
- Passwords are stored only as salted one-way hashes (bcrypt).
- Keys for services you connect, calendar tokens and two-step sign-in secrets are encrypted with AES-256-GCM, and so are our backups.
- Two-step sign-in with an authenticator app, which workspace owners can require for their team; our own staff must use it.
- Roles and permissions inside each workspace, and an audit log of changes on Business and Enterprise plans.
- Repeated sign-in attempts are slowed and locked out, and you can see and sign out your signed-in devices.
- Staff access to a workspace is read-only, limited to 15 minutes at a time and recorded with its reason.
No system is perfectly secure. If a breach affects your personal information, we'll tell you and the authorities as the law requires.
We store our database and files in the United States. Some of our service providers process information in other countries. Where the law requires it, for example for information from the European Economic Area, the United Kingdom or Switzerland, we rely on approved safeguards such as the European Commission's Standard Contractual Clauses.
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- correct it (you can edit most of it yourself in My account and your workspace);
- delete it;
- take it with you (you can export leads and deals to CSV at any time, and ask us for a full export of your workspace);
- object to or restrict some uses, and withdraw consent where we rely on it;
- not be treated differently for using these rights.
To make a request, email support@controllaunchpad.com from the address on your account, or tell us which business's lead you are. We'll confirm who you are before acting, and answer within the time the law sets (usually 30 to 45 days). You can use an authorized agent; we may ask for proof they're acting for you. If your request is about Customer Data, we'll pass it to the business that controls it.
You choose which alerts reach you by email or push in Settings → Notifications. Service emails about your account, security and billing can't be turned off while your account is open.
This section adds to the rest of this policy for residents of California and other US states with privacy laws. In the last 12 months we collected these categories of personal information, from you, from your workspace and from the services you connect, for the purposes in How we use information:
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email address, phone number, account ID | Hosting, email, messaging, payment and AI providers, and calendars you connect |
| Customer records | Billing contact and the last four digits of a card | Stripe |
| Commercial information | Plan, seats, invoices and payment history | Stripe |
| Internet or other network activity | Sign-in sessions, actions in the app, IP addresses for security | Hosting providers |
| Audio and electronic information | Call recordings and voicemails, when a customer turns them on | Twilio |
| Professional information | Brokerage or business name, role | Hosting providers |
| Sensitive personal information | Account sign-in credentials | Not disclosed; used only to sign you in |
We haven't sold or shared personal information for cross-context behavioral advertising in the last 12 months, and we don't knowingly do so for anyone under 16. We use sensitive personal information only to provide the service, so there's nothing to limit. We treat a Global Privacy Control signal as a request not to sell or share, which we already don't do.
Control LaunchPad LLC is the controller of account information. We process it to perform our contract with you (providing the service and billing), for our legitimate interests (keeping the service secure, improving it and sending service messages), to comply with the law, and with your consent where we ask for it (such as push alerts). You can complain to your local data protection authority.
For Customer Data, the customer is the controller and we're its processor. Customers who need a data processing agreement can ask at support@controllaunchpad.com.
ControlLaunchPad is a business tool and isn't meant for anyone under 16. We don't knowingly collect personal information from children under 16. If you think a child has given us personal information, email us and we'll delete it.
We'll update the date at the top when this policy changes. If a change is significant, we'll tell account owners by email or in the app at least 30 days before it takes effect.
- Privacy questions and requests: support@controllaunchpad.com
- Everything else: support@controllaunchpad.com
- Mail: Control LaunchPad LLC, 30 N Gould St, Ste 62372, Sheridan, WY 82801, United States
Questions? support@controllaunchpad.com
Back to top