CoreCollect

Privacy Policy

Last updated: July 3, 2026 · Effective: July 3, 2026

This Privacy Policy explains what information CoreCollect LLC ("CoreCollect," "we," "us," or "our") collects, why we collect it, how we use and share it, and what rights you have. If you use the CoreCollect Service, this applies to you.

The short version: we collect what we need to run the Service, we don't sell your data, we don't use it to train AI models, and we don't run advertising or third-party trackers.

1. Who This Policy Applies To

This policy covers three groups of people:

• Brokerage owners and admins who sign up for a CoreCollect account
• Agents invited to use CoreCollect by their brokerage
• Tenants, movers, and property representatives who receive documents (like lease confirmations) through CoreCollect and sign or respond to them

2. What We Collect

Information you give us directly

Category	Examples
Account info	Name, email, phone, brokerage name, admin username
Business info	Brokerage address, license numbers, tax ID, logo, contact details
Agent info	Name, phone, email, agent ID number
Transaction data	Guest cards, lease confirmations, movers forms, invoices, commission amounts, payment status
Third-party contact data	Tenant, property, and mover names and contact info that you or your agents enter

Information we collect automatically

Category	Examples
Session data	Login timestamps, actions taken in the app, audit log entries
Signature metadata	IP address, browser type, timestamp when a tenant or mover signs a document (used for fraud detection)
Device data	Browser type, operating system, screen size (used to display the app correctly)
Local storage	Your session token and preferences, stored in your browser only

We do not use cookies for tracking, advertising, analytics, or profiling. We use your browser's local storage only to keep you logged in and remember your preferences.

3. Why We Collect It

We use the information above for the following purposes:

• Running the Service. Creating your account, showing your data, generating PDFs, sending emails, calculating commissions.
• Preventing fraud. Signature metadata (IP, browser, timestamp) is captured to help detect fraudulent lease confirmations and forged signatures.
• Communicating with you. Sending welcome emails, account notifications, service updates, and support responses.
• Billing. Calculating and collecting the 3.5% platform fee on collected commissions.
• Security and compliance. Maintaining audit logs, investigating security incidents, complying with legal obligations.
• Improving the Service. Understanding usage patterns in aggregate to make CoreCollect better. We do not sell aggregate data or use it for advertising.

4. Who We Share It With

Service providers we use

We share limited data with the third-party companies that help us run the Service:

Provider	What they do	What we share
Firebase (Google)	Database, file storage, hosting	All account and transaction data you enter (encrypted at rest)
EmailJS	Email delivery	Recipient email address, subject line, message content
Netlify	Website hosting	Standard web server logs (IP address, request path)
Stripe	Payment processing (when applicable)	Billing name, email, amount, brokerage identifier

Each of these providers has their own privacy practices governing their use of the data. We choose providers with strong security and privacy commitments.

What we do NOT do

• We do not sell your data to anyone, ever
• We do not share your data with advertising networks or marketing services
• We do not use your data to train AI or machine learning models
• We do not share one brokerage's data with another brokerage
• We do not run analytics or session-recording tools

Legal disclosures

We may disclose your information if required by law, court order, or valid subpoena, or if we reasonably believe it's necessary to protect the rights, safety, or property of CoreCollect, our users, or the public. We will notify you if legally permitted.

Business transfers

If CoreCollect is involved in a merger, acquisition, or sale of assets, your data may transfer to the successor entity. You will be notified in advance.

5. How Long We Keep It

• While your account is active: We keep your data as long as you use the Service.
• After you cancel: We delete your data from active systems within 90 days of cancellation. Backup copies may persist for up to 12 additional months in encrypted archives, after which they are permanently deleted.
• Audit logs: Retained for at least 7 years for compliance and fraud investigation purposes.
• Signature metadata: Retained for at least 7 years as evidence in case of disputes over signed documents.

6. Your Rights

Regardless of where you live, you have these rights:

• Access. Ask us what data we have about you.
• Correction. Ask us to fix inaccurate data.
• Deletion. Ask us to delete your data (subject to legal retention requirements).
• Portability. Get a copy of your data in a machine-readable format.
• Objection. Object to specific uses of your data.

To exercise any of these rights, email team@getcorecollect.com. We'll respond within 30 days.

Note for brokerage employees and tenants: If you're an agent, tenant, or property representative whose data was entered into CoreCollect by a brokerage, the brokerage is the primary "data controller." Contact the brokerage directly for access, correction, or deletion requests related to their business records. We will assist as needed.

7. California Residents (CCPA)

If you're a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what categories of personal information we collect and how we use them (this policy covers that)
• Right to request deletion of your personal information
• Right to opt out of the sale of personal information (we don't sell personal information, so this doesn't apply)
• Right to non-discrimination for exercising your rights

To exercise CCPA rights, email team@getcorecollect.com.

8. European Residents (GDPR)

If you're located in the European Economic Area, UK, or Switzerland, you have rights under the General Data Protection Regulation:

• Legal basis for processing: contract performance (running the Service you signed up for) and legitimate interests (fraud prevention, security)
• Right to lodge a complaint with your local data protection authority
• Data may be transferred to and stored in the United States; we rely on Standard Contractual Clauses and provider certifications where applicable

Data transfers to CoreCollect involve moving your data to servers in the United States. By using the Service, you consent to this transfer.

9. Security

We use industry-standard security practices to protect your data:

• All data encrypted in transit (HTTPS/TLS)
• All data encrypted at rest by our storage providers
• Access controls and audit logs on all administrative actions
• Multi-tenant data isolation (each brokerage's data is logically separated)
• Regular security reviews of our code and infrastructure

No system is 100% secure. If we discover a security incident that affects your data, we will notify you within 72 hours of discovery.

10. Children

CoreCollect is not intended for children under 18. We don't knowingly collect information from children. If you believe we've collected information from someone under 18, contact us and we'll delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email at least 30 days before the changes take effect. Continued use of the Service after the effective date means you accept the updated Policy.

12. Contact

Questions about this Privacy Policy or your data? Contact us:

CoreCollect LLC
Email: team@getcorecollect.com
For privacy requests, use the subject line: "Privacy Request"