How CommunitySync handles your community's data — where it lives, who can see it, what our AI features touch, and how to reach us. Written plainly, and kept current: when our practices change, this page changes.

Last updated: September 8, 2026

Who we are

CommunitySync is operated by Trusun Media Inc., a US company (240 E Palmetto Ave #100, Longwood, FL 32750, United States). We provide a white-label community platform for real-estate organizations: member portals, agent websites, listings, education, marketing tools, and lead management.

It is built and run by two people:

• Jason Ross — Director. Real-estate operations, community and partnerships.
• Marcin Stempniewicz — CTO. Architecture, engineering, and the security practices described on this page.

More about both of us, and how CommunitySync started, is on the About page.

The data we hold

Three kinds:

• Member data — name, email, phone, title, company, photo/logo, bio, and profile settings for the agents and staff who have accounts.
• Lead data — name, email, phone, and message submitted by visitors through lead-capture and questionnaire forms on listings, agent websites, and community websites.
• Content — listings, photos, marketing materials, education content, website pages, and settings your community creates.

We do not process payments and never hold card data.

Where it lives

• Database, authentication, and file storage: Supabase (PostgreSQL), hosted on AWS in the United States (us-east-1).
• Public websites, DNS, and CDN: Cloudflare.
• Transactional email: Resend.
• Application hosting: dedicated servers managed by us.

All traffic is encrypted in transit (TLS), and data is encrypted at rest by our infrastructure providers.

How communities are isolated

Every row of data belongs to a community, and PostgreSQL Row-Level Security enforces that boundary inside the database itself — not just in application code. A member of one community cannot read another community's data. Public pages read through dedicated views that expose only deliberately whitelisted columns (a public listing never exposes the owner's email; a public agent profile never exposes account data). Access inside a community follows roles, and platform-level administration is separated from community administration.

What our AI features touch

AI features (listing descriptions, photo tagging, marketing copy, agent profile lookup) run through OpenRouter, Inc. as a routing layer to model providers (Google, Anthropic, Perplexity). What we send is deliberately scoped:

• Sent to AI: listing photos and descriptions, questionnaire answers, marketing copy inputs, and agent name/company.
• Never sent to AI: leads, email contents, credentials, or authentication data.

Processing is transient — prompts are not used to train models and are not retained beyond operational requirements.

Deletion and retention

Content removed in the app is first held in a recoverable state (so an accidental delete isn't a disaster) and can then be permanently removed. If you want personal data deleted — your own, or a lead who contacted you — email us at the address below and we will remove it from live systems promptly.

Email practices

Every email we send identifies who it's from, carries our mailing address, and includes a working way to opt out. Opt-out requests are honored.

Fair housing

CommunitySync is used to advertise real property, so equal-opportunity advertising matters here. We support the goals of the Fair Housing Act: listing content should describe the property, not the people the author imagines living near it. Publishing agents are responsible for their listings, and we are building automated guardrails that keep AI-generated listing copy away from language referencing protected classes.

Accessibility

We aim for WCAG 2.1 AA on the public-facing pages we host and are improving continuously. If you hit a barrier on a site we host, tell us — we'll fix it.

Certifications

Our security practices follow the principles of the ISO 27001 framework — the concrete measures described above (tenant isolation enforced in the database, encryption, role-based access) are how that shows up in the product. We do not hold third-party certifications such as ISO 27001 or SOC 2, and we won't imply otherwise.

Questions

Anything on this page unclear, or a practice you want detail on: privacy@mycommunitysync.com · +1 407-388-1001.