This Privacy Policy explains how Malli ("Malli," "we," "us," or "our") collects, uses, stores, shares, and protects information when you visit themalli.ai, join our waitlist, opt in to receive text messages or emails from us, or otherwise interact with our products and services (collectively, the "Services"). By using the Services, you agree to this Privacy Policy.
Malli is a software product that provides AI-assisted lead generation, organization, follow-up, and scheduling tools for real estate operators. For privacy questions, opt-out requests, data access or deletion requests, or any other inquiry under this Policy, contact us at info@themalli.ai.
We use the information we collect to:
Malli operates an SMS messaging program (the "SMS Program") for users who have provided their mobile phone number and affirmatively consented to receive text messages from us.
You opt in by visiting themalli.ai, entering your mobile phone number in the waitlist form, and actively checking the SMS consent checkbox (unchecked by default). Consent to receive text messages is not a condition of joining the waitlist or any purchase. You may join the waitlist without providing a phone number or without opting in to SMS.
If you opt in, you will receive recurring marketing and informational text messages from Malli (for example, early-access announcements, product updates, feature releases, event invitations, and webinar reminders and access links). Messages may be sent using automated technology.
Message frequency varies. You can typically expect approximately 2–6 messages per month.
Message and data rates may apply, depending on your wireless carrier and plan. Malli does not charge you for SMS messages.
The SMS Program is available only to individuals who are 13 years of age or older with a valid U.S. or Canadian mobile phone number on a supported wireless carrier. By opting in, you represent that you are the account holder of the mobile number you provide or have the account holder's permission to do so.
Wireless carriers (including but not limited to AT&T, T-Mobile, Verizon, Sprint, U.S. Cellular, Boost, Cricket, MetroPCS, Virgin Mobile, and most other major U.S. and Canadian carriers) are not liable for delayed or undelivered messages. T-Mobile is not liable for delayed or undelivered messages.
4.8 Mobile information non-sharing (mandatory disclosure). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
In plain English: your phone number, your SMS opt-in, the consent record we store for it, and any related "mobile information" are not sold, rented, leased, lent, traded, transferred, sublicensed, or otherwise disclosed to any third party, affiliate, lead generator, marketing partner, or other organization for their marketing or promotional use. The only parties who ever touch your mobile information are subprocessors who help us deliver the messages you consented to (see Section 5).
We share limited information with vetted service providers who help us run the Services under written confidentiality and data-protection obligations. These include:
These service providers may only use your information to perform services for Malli — not for their own marketing or advertising.
We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to (a) comply with a legal obligation, (b) protect the rights, property, or safety of Malli, our users, or the public, or (c) investigate or prevent fraud, abuse, or security incidents.
If Malli is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to the protections of this Policy or a comparable successor policy.
If you connect your Google account, Malli requests access only to the specific scopes listed below, and only after you approve them on Google's OAuth consent screen. You can review and revoke this access at any time at myaccount.google.com/permissions.
| Google scope | Why Malli requests it | Sensitivity |
|---|---|---|
openid, email, profile |
Authenticate you and identify your Google account (your name and email address) so we can link the connection to your Malli account. | Non-sensitive |
.../auth/gmail.readonly |
Read incoming email related to your real estate pipeline (for example, lead, seller, and broker messages) so Malli can surface, summarize, and organize them and draft suggested follow-ups for your review. | Restricted |
.../auth/gmail.send |
Send only the follow-up emails you have reviewed and approved, from your account, on your behalf. Malli does not send email without your action or a rule you have configured. | Sensitive |
.../auth/calendar.events |
Create, read, and update calendar events to schedule tours, calls, and follow-ups. Malli accesses event data only — not unrelated calendar settings. | Sensitive |
.../auth/drive.file |
Open and store only the specific files you create with, or explicitly open in, Malli (for example, a deal document Malli generates). Malli cannot see the rest of your Google Drive. | Per-file access |
We request the narrowest scopes needed for these features. We do not request full Google Drive access, and we do not read calendar entries or Drive files beyond what is described above.
OAuth tokens are stored encrypted at rest in Google Cloud Secret Manager. Google user data that Malli processes (such as email content used to generate a summary or draft) is handled on access-controlled infrastructure, encrypted in transit, and retained only as long as needed to provide the feature you requested. We do not allow humans to read your Google user data except (a) with your explicit consent, (b) where necessary for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized and is used to maintain or improve the Services. Malli's staff do not read your email, calendar, or files for any other purpose.
You can disconnect Malli from your Google account at any time from your Malli settings or at myaccount.google.com/permissions. When you revoke access, Malli stops accessing your Google data and deletes stored Google user data tied to that integration within 30 days, except where retention is required by law. You can also request deletion at any time by emailing info@themalli.ai.
Malli's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, Malli:
We use a small number of strictly necessary cookies to keep our website working (for example, session cookies for authenticated areas). We may also use privacy-respecting analytics to understand aggregate site usage. You can control cookies through your browser settings. Disabling cookies may affect some features of the site.
We use industry-standard administrative, technical, and physical safeguards to protect your information against unauthorized access, alteration, disclosure, or destruction. OAuth tokens and other secrets are stored encrypted at rest in Google Cloud Secret Manager. Administrative access to production systems is restricted to authorized personnel. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. The SMS Program is restricted to individuals 13 years of age or older. If you believe we have inadvertently collected information from a child under 13, please contact us so we can delete it.
Malli operates primarily for users in the United States and Canada. If you access the Services from outside the U.S. or Canada, you understand that your information may be transferred to, stored, and processed in the U.S. By using the Services, you consent to that transfer.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Material changes will be communicated by posting a prominent notice on the site and, where appropriate, by emailing users on our list. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
Questions, concerns, or requests under this Policy? Email info@themalli.ai.