Privacy Policy

Effective Date: October 12, 2026 | Version 1.8

What’s changing in version 1.8 (effective October 12, 2026)

• Advertising measurement: if you came to our website by clicking an ad on Google, Meta (Facebook or Instagram), LinkedIn or Microsoft Advertising (Bing), and you then request a call or create an account, we may tell that ad platform, sending the click identifier from the ad you clicked, a SHA-256 hash of your email address and the details of that step listed under “Advertising Measurement” below. If your account later becomes active or makes its first payment, we may tell the platform again, with the amount and currency for a payment. The platform uses this only to count which of our ads led to a request, a signup or a payment. We do not send your name, phone number, or anything about your deals or documents.
• Outside Europe: if you visit from outside the European Economic Area, the United Kingdom and Switzerland, this is on unless you opt out. You can opt out with “Turn off analytics” in the cookie notice or “Cookie settings” in the page footer, with the “Opt out of ad measurement” control on our Do Not Sell or Share page, or by having your browser send a Global Privacy Control or Do Not Track signal. If you are signed in when you opt out, it is also turned off for your account.
• Europe, the UK and Switzerland: this happens only if you choose “Accept All” in the current version of the cookie banner. An “Accept All” given to an earlier version does not count, and we show you the banner once more.
• Not retroactive: it never applies to anyone who requested a call or created an account before October 12, 2026.
• Since version 1.7 (effective October 11, 2026), which first described advertising measurement, this version lists every item we send (including a random reference number for each step, the currency of a payment, the page address and click time Meta receives, and the consent settings Google receives), also turns advertising measurement off for your account when you opt out while signed in, counts only an “Accept All” given to the current cookie banner, and starts advertising measurement on October 12, 2026 instead of October 11, 2026.
• Google Analytics works as described in version 1.6 (effective October 6, 2026), and this version carries the rest of version 1.6 unchanged. We still do not sell personal information.

Information We Collect

This Privacy Policy describes how Real Deal Pro, Inc. ("Real Deal Pro," "we," "us") collects, uses, and shares personal information when you use the Real Deal Pro platform. We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support.

Types of Information:

• Account information (name, email, phone number)
• Deal and client data you enter into our CRM system
• Document content and metadata
• Communication records and support interactions
• Usage data and analytics — daily, aggregate counts of which public pages and tools are used, and, where Google Analytics is on, the pages you view and the actions you take on our website and application (see “Website Measurement and Server Logs”)
• Device and browser information (browser type, device class)
• IP addresses — for security, abuse prevention and audit trails, and as part of short-lived hosting and content-delivery logs (see “Website Measurement and Server Logs”)

How We Use Your Information

We use the information we collect to provide, maintain, and improve our services.

Primary Uses:

• Provide and operate the Real Deal platform
• Process transactions and manage your account
• Send service-related communications
• Provide customer support
• Improve our services and develop new features
• Ensure security and prevent fraud
• Comply with legal obligations

Website Measurement and Server Logs

First-party, cookieless counters

When you load a public page (the home page, an article, or a free tool), your browser sends us a small message naming the page, what happened on it (loaded, used, printed or copied, clicked through), the referring site’s host name only, and any campaign tags (utm_source, utm_medium, utm_campaign) in the link you followed. We store only daily totals. We do not store your IP address, user-agent, a cookie, a device fingerprint, an account identifier, or the time of your individual visit, so these totals cannot identify you and do not depend on your cookie-banner choice. If you would rather your browser not be counted at all, see “Cookieless Measurement and Local Storage” in our Cookie Policy.

Hosting and content-delivery logs

Our hosting providers (Amazon Web Services — CloudFront for the website, App Runner for our API) keep a log of each request: date and time, requesting IP address, browser user-agent, page or endpoint requested, referring page, and query parameters such as campaign tags. We use these logs to keep the service secure and reliable and to produce aggregate statistics about how many visitors reach each page and where they came from; when we do, we read the logs in memory and keep only daily totals. We do not build profiles of individual visitors, do not link the logs to your account, and do not share them. Website logs are deleted automatically after 180 days; API request logs are kept for no more than 12 months.

Google Analytics

We use Google Analytics 4 to understand, in aggregate, how our website and application are used. When it starts depends on where your browser says you are, which we read only from your device’s time-zone setting (we do not look up your IP address to decide):

• European Economic Area, United Kingdom and Switzerland (and any browser whose time zone we cannot read or that reports a generic zone such as UTC): Google Analytics loads only if you choose “Accept All” in the cookie banner. You can withdraw that choice at any time by clicking “Cookie settings” in the page footer, which reopens the banner. As a safeguard for a device whose time zone is set to another region, we also tell Google Analytics to set no cookies for any visit that Google itself locates in one of these countries; such a visit sends Google only a cookieless signal.
• Everywhere else, including the United States: Google Analytics loads when you first view a page, and the cookie notice at the bottom of the page tells you so. You can turn it off at any time by choosing “Turn off analytics” in that notice or by clicking “Cookie settings” in the page footer, which reopens it. Turning it off stops Google Analytics on the page at once, deletes the Google Analytics cookies we can reach, and keeps it off on later visits in that browser until you turn it back on.

In every region, we honour the Global Privacy Control and Do Not Track browser signals: if your browser sends either, Google Analytics does not load, whatever you chose in the banner. Google Analytics also never loads on the private links we send by email (document signing, invoice payment, team invitation, collaboration, verification and closing-binder links), never loads for our own team’s browsers or for a browser that carries the do-not-count flag described in our Cookie Policy, and can always be blocked with your browser’s cookie settings or a content blocker.

What it collects: the pages you view (address and title) and the page that referred you, actions such as starting a sign-up or a trial, your device type, browser, operating system, screen size and language, and an approximate location (country, region and city) that Google derives from your IP address. Google Analytics 4 does not log or store IP addresses. It sets two cookies on our site, _ga and _ga_<ID>, which hold a random identifier so that repeat visits can be counted; they expire after up to two years, and some browsers delete them sooner. We have switched off Google signals and ad personalization, so this data is not used for advertising, is not linked to your Google account and is not used to build advertising profiles. Google processes it for us under its terms for Google Analytics. Event- and user-level data is kept for the data-retention period set in our Google Analytics property (Google offers 2 or 14 months); Google’s aggregate reports are not affected by that setting.

Advertising Measurement

From October 12, 2026, we measure which of our ads work by telling the ad platform that showed an ad when a person who clicked it takes one of these steps with us: requests a call through our “Book a call” form, creates an account, becomes an active user (records a first deal and sends a first document for signature within 14 days of signing up), or makes a first payment.

What we send: the click identifier that the ad platform added to the link you clicked (Google’s gclid, gbraid or wbraid, Meta’s fbclid, LinkedIn’s li_fat_id or Microsoft’s msclkid), a SHA-256 hash of your email address, the name and time of the step, a random reference number we generate for that one step so it is never counted twice (it is not your account number, and every step gets a different one), and, for a first payment, the amount and currency. Meta also receives the address of the page on our website where you requested the call (for the other steps, our home page address) and the time we first saw your click (when we do not know it, the time of your first visit to our website or of the step). Google also receives two consent settings: whether you chose “Accept All” in the current cookie banner, and that ad personalization is not allowed. A hash is a one-way code: the platform can only match it to an email address it already has. We send these items only to the platform whose ad you clicked. We do not send your name, phone number, IP address, browser details, or anything about your deals, clients or documents, and we do not use this to create advertising audiences or to choose which ads you see.

Who receives it: Google (Google Ads), Meta Platforms (Facebook and Instagram ads), LinkedIn and Microsoft (Microsoft Advertising). Each receives it under its own advertising terms and privacy policy, and uses it to report and improve the performance of our ads.

Your choice: if you visit from outside the European Economic Area, the United Kingdom and Switzerland, this is on unless you opt out. You can opt out at any time with “Turn off analytics” in the cookie notice or “Cookie settings” in the page footer (which also turns off Google Analytics), with the “Opt out of ad measurement” control on our Do Not Sell or Share page, or by having your browser send a Global Privacy Control or Do Not Track signal. These choices apply in the browser where you make them, and, if you are signed in to your account in that browser, your browser also tells our server to stop it for your account (and for call requests made with the same email address). You can also email privacy@real-deal-pro.com and we will stop it for your account or your call request; anything already sent cannot be recalled from the platform. In the European Economic Area, the United Kingdom and Switzerland, this happens only if you choose “Accept All” in the current version of the cookie banner, which describes it; an “Accept All” given to an earlier version does not count, and when the banner changes we show it to you once more.

Not retroactive: it never applies to anyone who requested a call or created an account before October 12, 2026, even if they take a later step after that date. It never applies to our own staff and test accounts.

What we keep: the click identifier is stored with your call request or your account’s attribution details and deleted with them. Our record of what was sent holds the platform, the step, the time, the reference number and the platform’s reply, but no email address and no click identifier.

Real Estate Transaction Data

As a real estate transaction management platform, we process sensitive transaction data that is subject to industry regulations and best practices.

Transaction Data Includes:

• Property addresses and descriptions
• Purchase prices and financial terms
• Buyer and seller information
• Contract documents and amendments
• Closing dates and contingencies

Data Retention: Real estate transaction data is retained for a minimum of 5 years (typically 5–7 years depending on your state's real estate commission rule and IRS recordkeeping requirements). This ensures records are available for legal, regulatory, and audit purposes.

Data Subject Requests (DSAR)

You have rights regarding your personal data. Depending on your state of residence, these may include the right to access, correct, delete, or port your information — see the California and Iowa sections below for the rights specific to you.

Your Rights Include:

• Access: Request a copy of your personal data
• Correction (where granted by your state's privacy law): Request correction of inaccurate data. Note: the Iowa Consumer Data Protection Act does not grant a right to correct — see the Iowa Privacy Rights section below.
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request transfer of your data in a machine-readable format
• Objection: Object to certain processing of your data

To exercise your rights, contact:

privacy@real-deal-pro.com

We will respond to your request within 45 days (extendable to 90 days where permitted by Cal. Civ. Code §1798.130(a)(2)). Some requests may be subject to verification procedures to protect your privacy.

Note: Deletion requests may be limited where we are required to retain records for legal, regulatory, or contractual purposes (e.g., signed contracts, audit trails for e-signatures).

Electronic Signature Data Handling

Our electronic signature services comply with the Electronic Signatures in Global and National Commerce Act (ESIGN) and the Uniform Electronic Transactions Act (UETA).

E-Signature Data We Collect:

• Signature images and typed signatures
• Audit trails including timestamps, IP addresses, and user agent information
• Signer identity verification data
• Document integrity verification (hashes)
• Consent records for electronic signature

This data is retained in accordance with legal requirements and industry best practices to ensure the validity and enforceability of electronic signatures.

Retention Period: E-signature data, including audit trails, is retained for a minimum of 5 years (typically 5–7 years depending on your state's real estate commission rule). This ensures signed documents remain legally enforceable under the federal ESIGN Act, 15 U.S.C. §7001(d), and applicable state UETA statutes (Iowa UETA — Iowa Code Chapter 554D).

Data Retention

• Transaction and e-signature records: retained for the periods stated in “Real Estate Transaction Data” and “Electronic Signature Data Handling” above (a minimum of 5 years), because the law requires them to remain available.
• Analytics and logs: aggregate statistics that cannot identify you are kept indefinitely; website access logs are deleted after 180 days, API request logs after no more than 12 months, and error-monitoring events after 90 days. Google Analytics event- and user-level data is kept for the data-retention period set in our Google Analytics property (2 or 14 months), and its cookies expire after up to two years.
• Attribution details attached to your account (the campaign link and referring page that brought you here) are deleted with your account.

Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS) and at rest (AES-256)
• Secure cloud infrastructure (AWS)
• Regular security audits and penetration testing
• Access controls and authentication requirements
• Employee security training

Third-Party Sharing

We do not sell your personal information. We may share information with:

• Service providers who assist in operating our platform
• The advertising platform whose ad you clicked (Google, Meta, LinkedIn or Microsoft), limited to the items listed in “Advertising Measurement” (the click identifier, a hashed email address and the details of the step), unless you opt out
• Legal authorities when required by law or legal process
• Business partners with your consent
• Other parties in connection with a merger, acquisition, or sale

Service Providers

We work with the following third-party service providers to operate our platform. Each provider has their own privacy policy governing their use of your data:

Provider	Purpose	Data Shared
Firebase (Google)	Authentication & identity	Email, name, authentication tokens
Stripe	Payment processing & billing	Name, email, payment method details, billing address
Amazon Web Services — S3	Document, template, packet, and verification-document storage	Uploaded PDFs, signed documents, government-ID images, signature renderings
Amazon Web Services — SES	Outbound transactional email (fallback path)	Recipient email and name, transactional message content
Amazon Web Services — CloudFront	Content delivery network for the website and its access logs (see “Website Measurement and Server Logs”)	IP address, user-agent, requested URL, referrer and query string of each request; retained up to 180 days
Amazon Web Services — App Runner	API hosting and request logs	IP address, user-agent, requested endpoint of each API request; retained no more than 12 months
Resend	Outbound transactional email (primary path)	Recipient email and name, transactional message content, deliverability events
Neon (Serverless Postgres)	Managed Postgres database hosting	The entire application database (all account, deal, client, invoice, and document records), encrypted in transit and at rest
Sentry	Application error and performance monitoring (legitimate-interest basis under GDPR Art. 6(1)(f) — used solely to detect and fix crashes and slow requests)	Stack traces, internal user ID, and request path. Our API removes IP addresses, user-agent strings and personal fields before sending. Browser-side error and performance reports may include your IP address, which Sentry uses only to derive an approximate location and which we do not use for marketing; session recording is switched off. Sentry retains events for up to 90 days.
Google Analytics 4	Aggregate website- and application-usage analytics. In the European Economic Area, the United Kingdom and Switzerland, loaded only after you choose “Accept All” in the cookie banner. Elsewhere, loaded from your first page view; turn it off at any time with “Turn off analytics” in the cookie notice or “Cookie settings” in the page footer. Never loaded when your browser sends a Global Privacy Control or Do Not Track signal, or on the private links we email. Google signals and ad personalization are off; not used for advertising or cross-context behavioral profiling.	Pseudonymous client identifier (_ga / _ga_<ID> cookies), pages viewed and referrer, actions taken, device, browser, screen and language, and approximate location derived from your IP address (Google Analytics does not store the IP address)
Google Maps Platform (Places)	Address autocomplete	The partial address strings you type into any address field
Google OAuth	Social sign-in (optional)	Email, name, profile photo
Microsoft OAuth	Social sign-in (optional)	Email, name, profile photo
Track1099 (Avalara)	IRS Form 1099-NEC and 1099-K e-filing and recipient delivery for hung-license affiliates (engaged only when the year-end tax-filing feature is enabled for your workspace)	Recipient full legal name, mailing address, taxpayer identification number (TIN) entered on Form W-9, and total annual non-employee compensation paid

Each sub-processor has its own privacy policy governing its use of your data; follow the linked policy for the controlling terms. We require every sub-processor under contract to provide at least the level of data protection we provide under this Privacy Policy. Business customers who require a data processing agreement can review our standard Data Processing Addendum.

California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Your California Rights:

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions
• Right to Correct: You can request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information. You can opt out of advertising measurement at any time (see “Advertising Measurement” and our Do Not Sell or Share page)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Categories of Personal Information Collected:

• Identifiers: First and last name, email address, phone number, avatar image, Firebase user ID, and the names, emails, phone numbers, and mailing addresses of clients, buyers, sellers, cooperating agents, lenders, attorneys, and title contacts that you choose to record on your deals; and, where Google Analytics is on, the random identifier in its _ga cookies; and, where advertising measurement applies, the click identifier of an ad you clicked (gclid, gbraid, wbraid, fbclid, li_fat_id or msclkid).
• Professional and Employment Information: Real estate license number, license state, license expiration, brokerage affiliation, role (independent agent, team realtor, broker-owner), Errors & Omissions insurance carrier and policy number, and any uploaded license documents.
• Government ID and Verification Records: Full legal name, date of birth (encrypted at rest), government-issued ID type and uploaded ID image, and, where applicable, the last four digits of your Social Security Number (stored as a one-way hash) collected solely for identity verification and FCRA-compliant background screening.
• Commercial Information: Deal records (deal value, deal type, transaction side, MLS number, property address, closing date, current phase), invoices (amounts, line items, terms, memos), and commission/transaction-fee records.
• Financial Information: Stripe customer and Stripe Connect account identifiers, capability flags, invoice and payment-intent IDs, and your invoice business profile (business name, address, phone, email, brokerage, license, logo). We do not store full payment-card numbers or CVV — those are handled directly by Stripe.
• Geolocation Data: Approximate location derived from IP address at the time of legal acknowledgments, brokerage-agreement signing, e-signature events, login activity, and audit-logged events, and, for website statistics only, a coarse region (for example “US Central”) derived from the network edge location that served a request, kept only as a daily count. We also send the partial address strings you type to Google Maps Places for autocomplete suggestions; you can avoid this by typing addresses manually.
• Internet and Network Activity: Request paths, user-agent strings, session timestamps, and rate-limit telemetry tied to your account. IP addresses and user-agent strings captured at consent and at e-signature events are retained as part of the audit trail; sensitive consent-IP fields on account-level records are stored encrypted at rest. Both are housed in our managed Postgres instance, which is itself encrypted at rest and in transit. Separately, for every visitor to our website (with or without an account), our hosting providers’ access logs record IP address, user-agent, requested URL, referring page and query string for up to 180 days (website) or 12 months (API), used for security and aggregate measurement as described in “Website Measurement and Server Logs”. Our first-party page counters store no identifiers at all. Where Google Analytics is on (see “Website Measurement and Server Logs”), it records the pages you view, the referring page, actions taken, device and browser details and an approximate location, linked to its cookie identifier, for our own analytics only.
• Authentication and Consent Records: Firebase UID, MFA secret (encrypted), accepted Terms / Privacy / Invoice Legal versions and timestamps, SHA-256 hashes of accepted document text, and email deliverability flags (bounces, spam complaints) reported back to us by Resend / AWS SES.
• Electronic Signature Data: Typed, drawn, or uploaded signature image renderings, the signer's typed name, the signed-at timestamp, IP address, and user-agent — retained alongside the related document to support ESIGN/UETA evidentiary requirements.
• User-Generated Content: Contract PDFs, custom templates, packet bundles, brokerage agreement copies, signed documents, and verification ID images that you upload to the platform.
• Inferences: Document-verification scores, address-match scores, amount-discrepancy flags, CRM client-tier ratings (A/B/C/D/past), and computed deal priorities and next-action recommendations.

Do Not Sell My Personal Information:

Real Deal does not sell your personal information to third parties. We do not engage in the sale of personal information as defined by the CCPA/CPRA. We use Google Analytics for our own measurement only, with Google signals and ad personalization switched off. From October 12, 2026, if you clicked one of our ads, we may send that ad platform the ad’s click identifier, a hashed email address and the other items listed in “Advertising Measurement” to measure the ad. Some privacy laws treat that kind of disclosure as “sharing”. You can opt out of it at any time on our Do Not Sell or Share page or with “Turn off analytics”, and we treat Global Privacy Control as an opt-out signal: it keeps both Google Analytics and advertising measurement off.

To Exercise Your Rights:

Submit a request by emailing privacy@real-deal-pro.com. We process consumer privacy requests by email only. We will verify your identity before processing your request, and we will respond within 45 days (extendable to 90 days where permitted by Cal. Civ. Code §1798.130(a)(2)). You may designate an authorized agent to make a request on your behalf.

Iowa Privacy Rights (Iowa Consumer Data Protection Act)

If you are an Iowa resident, you have rights under the Iowa Consumer Data Protection Act (Iowa Code Chapter 715D, the “ICDPA”), which took effect on January 1, 2025.

Your Iowa Rights:

• Right to Confirm and Access: You may confirm whether we process your personal data and access the personal data we hold about you.
• Right to Delete: You may request deletion of personal data you provided to us, subject to the legal-retention exceptions described above (signed real-estate transaction records, signed brokerage records, tax records, e-signature audit trails).
• Right to Portability: You may receive a copy of your personal data in a portable, machine-readable format (we deliver as JSON for relational data and original-format files for documents).
• Right to Opt Out of Sale: You may opt out of any “sale” of your personal data. We do not sell your personal data, and we do not engage in targeted advertising. Advertising measurement (see “Advertising Measurement”) tells an ad platform that an ad it already showed led to a step on our site; we do not use it to choose the ads you see, and you can opt out of it. (Unlike some other states’ privacy laws, the Iowa CDPA grants an opt-out right for the sale of personal data but does not create a separate right to opt out of targeted advertising.)

What the Iowa CDPA does NOT grant you (important differences from the California CCPA/CPRA): the ICDPA does not grant a right to correct inaccuracies (unlike CCPA/CPRA), does not require opt-in consent for sensitive-data processing (it uses a notice-and-opt-out model), and does notgrant Iowa consumers a private right of action — enforcement is exclusive to the Iowa Attorney General, who must give us a 90-day cure period before bringing any enforcement action under Iowa Code §715D.8.

To Exercise Your Iowa Rights:

Send a request to privacy@real-deal-pro.com identifying your account email and the right you wish to exercise. We will respond within 45 days as a matter of our internal policy (Iowa Code §715D.3(2) permits up to 90 days, extendable by an additional 45 days — we commit to the more consumer-favorable 45-day standard). If we deny your request, you may appeal that decision within a reasonable period by emailing the same address with the subject line “Appeal of ICDPA decision”; we will respond to the appeal within 60 days.

Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users without unreasonable delay after discovering the breach, consistent with state breach-notification statutes such as Iowa Code §715C, Cal. Civ. Code §1798.82, Tex. Bus. & Com. Code §521.053, and other applicable state law
• Provide details about the nature of the breach and the types of data affected
• Describe the measures we are taking to address the breach and prevent future incidents
• Provide guidance on steps you can take to protect yourself
• Report to relevant regulatory authorities as required by law

Notification will be sent via email to the address associated with your account. We may also post a notice on our platform if the breach affects a large number of users.

Children's Privacy

Real Deal is designed for use by licensed real estate professionals and is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18.

If we learn that we have collected personal information from a child under 18, we will take steps to delete that information as quickly as possible. If you believe that a child under 18 has provided us with personal information, please contact us at privacy@real-deal-pro.com.

Contact Us

If you have questions about this Privacy Policy or our data practices:

Email: privacy@real-deal-pro.com

Mail:
Real Deal Pro, Inc.
Attn: Privacy Officer
761 Arlington Drive
Iowa City, IA 52245

Real Deal Pro is the SaaS product operated by Real Deal Pro, Inc. (the “Operator”), a software company that is not a real estate brokerage. Real Deal Realty, PLLC is a separate, independently licensed Iowa real estate brokerage; users on own-brokerage plans (Solo, Team) are NOT in a brokerage relationship with either company — Real Deal Pro, Inc. acts solely as the software vendor and data controller in that context.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by posting a notice on our platform prior to the changes becoming effective.

The "Effective Date" at the top of this page indicates when this policy was last revised.