Privacy & Security

1. Our Commitment to Your Privacy

Real Direct Jamaica ("the Platform," "we," "us," or "our") is committed to protecting the privacy and security of your data. This page explains how we safeguard your personal information when you use our Platform to list, browse, or inquire about real estate properties in Jamaica.

2. Data Encryption

All data on the Platform is encrypted at rest and in transit using industry-standard encryption protocols. This means your personal information — including contact details, messages, and property listings — is protected whether it is being stored or transmitted across the internet.

3. Security Certifications & Compliance

Our infrastructure maintains the highest standards of security compliance:

• SOC 2 Type II — independently audited for security, availability, and confidentiality.
• ISO 27001 — international standard for information security management systems.
• GDPR Compliant — we process personal data in accordance with the General Data Protection Regulation.
• PCI DSS — all payment processing is PCI DSS-compliant. Your card information never touches our servers.

We conduct regular penetration testing and maintain a responsible vulnerability disclosure program.

4. Data Access Controls

We employ strict, role-based access controls to ensure that only authorized users can access specific data:

• Sellers and agents can only see their own property listings, leads, messages, and tasks.
• Buyers can only see their own conversations and favorited properties.
• Platform administrators have controlled, audited access for support and moderation purposes only.

All API keys, credentials, and sensitive configuration are managed through secure secrets management — never exposed in the application code.

5. Payment Security

All payments on the Platform — including agent subscriptions, listing verifications, and premium services — are processed by Stripe, a PCI DSS Level 1 certified payment provider. Your credit card number and payment details are transmitted directly to Stripe's secure servers and are never stored on our platform.

6. Data Hosting

Your data is hosted on secure cloud infrastructure with servers located in the United States. The infrastructure is protected by enterprise-grade firewalls, 24/7 monitoring, and automated threat detection.

7. Your Data Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — request correction of inaccurate or incomplete data.
• Delete — request deletion of your account and associated data.
• Export — request an export of your data in a portable format.
• Object — object to certain processing of your data.

When you request data deletion, your records are removed from active systems immediately and permanently purged after a 30-day grace period (for safety and dispute resolution purposes).

8. What Data We Collect

We collect only the data necessary to operate the Platform:

• Account information — name, email, phone number, and role (agent, homeowner, or buyer).
• Property listings — details, images, and descriptions you submit.
• Messages and inquiries — communications between buyers and sellers.
• Usage data — page views, property visits, and interaction analytics to improve the Platform.
• Payment records — order history and transaction references (card data is never stored).

9. AI & Automated Processing

The Platform uses third-party AI service providers — OpenAI and Google — to power AI property search, the inquiry assistant, listing tools, photo enhancement, text extraction, price estimates, lead qualification, and conversation insights. Before any AI feature runs, the app asks for your permission and shows what data will be shared. You can decline and continue using the Platform without AI features.

What data is sent: only the content needed to process your request — the text you type (search descriptions, questions, and property details you describe), photos you upload for AI enhancement or text extraction, and any contact details you choose to type into a form yourself (such as when creating a listing). Your account name and email are never sent to these providers; they stay in your Real Direct account records.

How it is used: your data is sent to OpenAI and Google solely to process your specific request. These providers act as our processors, are contractually prohibited from using your data to train their models, and provide the same or equal protection as we do. AI-generated content is always labeled as such and should be reviewed before reliance. We do not sell or share your personal data with any other third party for their own purposes.

10. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. If you delete your account, your personal data is permanently removed within 30 days, except where retention is required by law (e.g., financial transaction records).

11. Third-Party Services

We use trusted third-party providers for payment processing, email delivery, and analytics. All providers are bound by strict data processing agreements and are required to maintain industry-standard security practices. We never sell your personal data to third parties.

12. Reporting Security Issues

If you believe you have discovered a security vulnerability on our Platform, please report it responsibly through our contact page. We take all reports seriously and will investigate promptly.

13. Contact Us

For any questions, requests, or concerns regarding your privacy and data security, please contact us through our contact page. Our team is ready to assist you with any privacy-related inquiries.