Privacy Policy

Who we are and who this covers

Mullion is software that real estate agents use to run their websites, listing pages, open house sign-ins, signs and leads. It is provided by Aleph Developments (“we”, “us”).

This policy covers two groups of people:

• Home buyers, sellers and visitors who use a website, listing page, sign QR code or open house sign-in page run on Mullion. Here the agent you contact is in charge of your information — they decide how to follow up with you. We store and process it for them, under contract, and use it for nothing else.
• Agents and their teams who have a Mullion account. Here we are in charge of your account information.

What we collect

If you contact an agent or sign in at an open house

• What you type: your name, phone number, email address, message, the address of a home you ask about or want valued, your buying timeline, and whether you already work with an agent.
• At open houses: whether you agreed to be contacted. If you say no, the agent's list marks you “don't contact”.
• The page you sent it from and the time.

When you visit an agent's site, listing page or scan a sign

• We count page views and QR code scans so agents can see which signs and listings people use. To count each visitor once, we keep a one-way code made from your IP address and browser type mixed with a secret. We do not store your IP address, and the code can't be turned back into it.
• We use no advertising trackers, no analytics cookies, no session recording and no third-party pixels. Fonts and scripts are served from our own servers, so loading a page doesn't tell Google or any other company you visited.
• Some agents' own websites show posts from other services, such as Instagram videos. When one of those embeds loads, that service receives your visit and may set its own cookies, under its own privacy policy.

If you have an agent account

• Your name, email, password (stored only as a one-way hash), and two-step sign-in secret if you turn it on.
• Your business details and content: profile, licence details, brokerage, photos, listings, website text, sign designs and files.
• Billing records from our payment processor (we never see or store full card numbers), domain orders and print orders.
• A security log of failed sign-ins (using a one-way code instead of your IP address).

How it's used

• To deliver your message or sign-in to the agent, and to email them a notice about it if they've asked for that.
• To show the agent counts of views, scans and enquiries, and a seller report that never includes visitor names.
• To run, secure and back up the service, and to bill agents.

We never sell personal information, never share it for advertising, and never use it to train AI models. We don't contact buyers or sellers ourselves.

Who else handles it

Only the agent you contacted, and the companies that run parts of the service for us. Each may use the data only to provide their service to us.

We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale of the business (the new owner would be bound by this policy).

How long we keep it

• Enquiries and sign-ins stay in the agent's account until the agent deletes them or closes the account.
• When an agent closes their account, their data is deleted straight away from the live system. Encrypted nightly backups roll off within 90 days at most (normally 14).
• View and scan counts are kept as long as the listing's account exists.

Your choices and rights

• Don't want to be contacted? Tell the agent, or at an open house leave the “may contact me” box unticked.
• See, correct or delete what you sent an agent: ask the agent you contacted; they can do it from their Desk. You can also write to us at the contact details at the bottom of this page and we'll pass it on and make sure it's done, normally within 30 days.
• Agents can download everything in their account from the Desk at any time, and ask us to close the account; we delete it within 30 days of the request.
• We don't sell or share data for targeted ads, so there is nothing to opt out of. We honour Global Privacy Control signals anyway.
• Depending on where you live (for example California, Washington or the EU), you may have extra rights. Contact us and we will respond as the law requires. We won't treat you differently for using them.

Security

All traffic is encrypted (HTTPS). Passwords are hashed, accounts are walled off from each other, sign-in attempts are rate-limited, two-step sign-in is available, and backups are encrypted. No system is perfectly secure; if a breach affects your information we will notify you and the authorities as Washington law (RCW 19.255) and other applicable laws require.

Children

Mullion is for adults buying, selling and working in real estate. It isn't directed at children under 13 and we don't knowingly collect their information. If you think a child has sent us information, contact us and we'll delete it.

Changes

If we change this policy we'll update the date above, and tell agents in the Desk beforehand if the change is significant.

Contact

Questions or requests: the contact details at the bottom of this page.