Xanara Property Partners

XPP Property Scout privacy policy

Effective 17 October 2026

This policy explains how XPP Property Scout ("Property Scout"), a private property acquisition research tool operated by Xanara Property Partners ("Xanara", "we"), accesses, uses, stores and shares information obtained from Google user data. Property Scout is used only by Xanara for its own research and only connects to Gmail mailboxes controlled by Xanara.

1. Information we access

With the account holder's permission, Property Scout uses read-only Gmail access (https://www.googleapis.com/auth/gmail.readonly). It reads:

• property listing alert emails, such as saved-search alerts from New Zealand property websites; and
• relevant real estate agency correspondence, such as listing announcements, from recognised property senders.

Other emails may be listed when Property Scout searches the mailbox, but their content is not used. Property Scout cannot send, delete, label or modify email.

2. How we use it

We use the information only to identify properties for Xanara's acquisition research. Property Scout extracts listing details (address, suburb, bedrooms, bathrooms, price or sale method, listing headline, listing link and alert date), screens them against Xanara's criteria, removes duplicates and prepares a shortlist for review by Xanara's acquisitions team. We do not use Gmail data for advertising, we do not sell it, and we do not use it to train artificial intelligence or machine learning models.

3. What we store

• Extracted listing details (as above) and limited message information (the Gmail message identifier, sender, subject line and date received), used to avoid processing the same email or property twice.
• Working records and reports of each run (shortlists, screening results and activity logs), which contain the extracted listing details above.
• Access credentials (the OAuth tokens that allow read-only access).

Property Scout does not keep a copy of full email messages. This information is stored on a Xanara-controlled computer, in Xanara's CRM (HubSpot) and in Xanara's Cloudflare account, as described in sections 4 and 5.

4. Sharing and service providers

We do not sell, rent or otherwise disclose Gmail-derived information to third parties. It is processed only by the following service providers acting for Xanara:

• HubSpot (Xanara's CRM): shortlisted properties are recorded as CRM deals containing the extracted listing details, the alert headline and date, and the listing link.
• Cloudflare (hosting): stores Property Scout's access credentials as encrypted secrets and, for the hosted version of the tool, extracted listing details and message identifiers in a Cloudflare database.
• Tavily (web search): may receive a property address, listing agent name and agency in order to find publicly available agent contact details. It does not receive email content.
• Anthropic (Claude, an AI assistant): used by Xanara to build, test and troubleshoot Property Scout. In doing so it may process excerpts of alert emails and extracted listing details.

Xanara personnel who operate the tool or review the shortlist can see this information. We may also disclose information where required by law.

5. Retention and deletion

Extracted listing details, message identifiers, reports and logs are kept for as long as they are needed for Xanara's property research, and are deleted by Xanara when no longer required. Automatic backups of Property Scout's working records are deleted after 30 days. CRM deals are kept in HubSpot in line with Xanara's normal business records. Access credentials are kept until access is revoked.

The account holder can revoke Property Scout's access at any time at myaccount.google.com/permissions. Once access is revoked, Property Scout can no longer read the mailbox.

6. Security

Gmail access is limited to read-only permission, and the software refuses any broader permission. All connections to Google, HubSpot and Cloudflare use encrypted (HTTPS) connections. Credentials are held only on Xanara-controlled systems.

7. Google API Services User Data Policy

Property Scout's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Changes and contact

We will update this page if Property Scout's use of Google user data changes. Questions or deletion requests: raj@xanara.co.nz.