Privacy Policy

For information a business puts into the platform about its own clients, leads, contacts and staff, that business decides what is collected and why. We act as its service provider (a "processor"): we store and process the data to run the platform for that business, and for no other purpose. If you are a client of a business that uses Newment and want to see, correct or delete your information, contact that business first. We will help it respond.

For account information about the people who use the portal, and for data about how the platform itself is used, NewMent decides how it is handled, and this policy applies directly.

• Account information. Name, email, phone, job title, profile photo, password (stored only as a hash), the organizations and roles you belong to, and sign-in details. If you sign in with Google we receive your name, email and profile picture from Google.
• Data businesses store about their customers. Clients, leads and contacts (names, emails, phone numbers, property addresses, notes), deals and projects, tasks, bookings, proposals, invoices, reviews and form submissions.
• Messages. Emails, text messages and in-portal chats sent through the platform. When a team member connects Gmail, we sync the email threads they have with the business's clients so they appear on the client's record.
• Calls, texts and voicemail through integrations. When a business connects a phone provider, we receive call logs, text messages, voicemails and, where the business records calls, recordings and transcripts.
• Files. Photos, videos, voice notes, documents, drawings and other uploads. Photos can carry location data in their metadata, and the field log can attach your device's location to a site note if you allow it.
• Usage and activity data. Pages viewed and actions taken in the portal, time spent, device and browser type, and push notification subscriptions. We keep IP addresses for about a day to limit repeated sign-in and password-reset attempts.
• Public pages. When someone opens a business's share link (a project page, playbook or presentation), we record the visit: device type, browser, time spent and how far they read. If the link was personal to them, the visit is credited to them by name.

• to provide the platform and the features a business turns on;
• to send the emails, texts and notifications a business or user asks us to send;
• to run AI features a business uses, such as drafting replies, summarizing calls and meetings, reading invoices, and generating images;
• to keep the platform secure, prevent abuse and fix problems;
• to support customers, bill them, and meet our legal obligations.

We do not use data a business stores about its clients for our own marketing, and we don't sell it.

These companies process personal information for us, under contract, to deliver the platform. Some of them are used only when a business turns on or connects the feature in question.

• Railway: application hosting and the main database.
• Cloudflare: file storage (R2) and DNS for connected domains.
• Anthropic (Claude) and Google (Gemini): AI features, including transcription. The content sent is what the feature needs, such as the message being drafted or the call being summarized.
• Resend: sending and receiving email, and delivery, open and click tracking for email campaigns.
• Twilio: text messages and phone calls.
• Voiceful: calls, texts and voicemail for businesses that connect it, with real-time updates delivered through Pusher.
• Google: sign-in, Gmail, Calendar, Drive, Chat, Maps and Places, when connected or used for addresses.
• Meta: connecting Facebook and Instagram accounts a business links, to publish its posts.
• PandaDoc: proposals and contracts. Square: point-of-sale data. PrintNode: printing to office printers.
• Tavily and Firecrawl: web search and reading public websites for research features.
• RentCast, Realtor.com data via RapidAPI, Los Angeles city and county GIS services and OpenStreetMap: property, zoning and map data. These receive a property address, not a person's name.
• Smart device providers (Tuya, Google Nest, SmartThings) when a business connects its own devices, and browser push services (Apple, Google, Mozilla) to deliver notifications.

A business's own website can also include analytics or advertising tags that the business adds itself (for example Google Analytics or a Meta pixel). Those are the business's choice and governed by its own privacy policy.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

We use a small number of first-party cookies. None are used for advertising.

• Sign-in session: keeps you signed in to the portal.
• activeOrg: remembers which organization you last switched to, for one year.
• platformOrg and viewAs: used only by platform staff and admins when they support an account; they expire within hours.
• nm_vid: set when someone reads a business's public share page, such as a playbook. It holds a random visitor ID so repeat visits count as one reader in that business's reading statistics. It lasts 400 days and is not shared with other sites.

Your browser can block or delete cookies. If you block the session cookie you won't be able to sign in.

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• ask us to correct inaccurate information;
• ask us to delete it, subject to exceptions the law allows;
• opt out of the sale or sharing of your personal information, and limit use of sensitive information;
• not be treated differently for using any of these rights.

To make a request, email legal@newment.co with the subject line "Privacy request". We will confirm we got it within 10 business days and answer within 45 days. We will need to verify your identity, usually by matching details we already have. You can use an authorized agent, who must show us your signed permission.

If your information was put into Newment by a business you deal with, we are that business's service provider. We will pass your request to the business, or ask you to send it there, and help it respond.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the past 12 months.

We keep account and customer data for as long as the account is active, because the business needs it to run. When a business closes its account, it can export its data, and we then delete it or remove the identifying details, except where we have to keep something by law or to resolve a dispute. Copies in backups are overwritten on their normal cycle. Sign-in rate-limit records, which include IP addresses, are cleared after about a day.

Data travels over HTTPS. Passwords are stored as hashes, never in readable form. Each business's data is kept separate from every other business's, and inside a business, access follows the roles and permissions its admins set. No system is perfectly secure, so if we learn of a breach that affects your information, we will tell the affected businesses and, where the law requires, the people affected.

Newment is a tool for businesses. It is not directed to anyone under 18, and we don't knowingly collect personal information from children. If you think a child's information has reached us, email us and we will delete it.

We will update this policy when what we do changes, and change the date at the top. If a change is material, we will tell account owners before it takes effect.

Privacy questions and requests: