Privacy Policy

1. Data Controller and Contact Information

FSBOHub is the data controller responsible for the personal data processed through the Platform. Our contact details are:

• Company: FSBOHub
• Address: [Insert registered address once entity is formed]
• Email: [email protected]
• Website: fsbohub.co/privacy

2. Categories of Personal Data Collected

We collect different categories of data depending on your user type. The table below summarizes what we collect and how you provide it.

3. How We Use Your Personal Data and Legal Bases for Processing

We use your data only for the purposes described below. Our legal bases under U.S. privacy laws are:

• Contractual Necessity – To provide the Platform services you requested (e.g., matching sellers with consented vendors, processing subscriptions).
• Consent – For sharing contact information through the consent-gated lead system and for non-essential communications.
• Legitimate Interests – To operate, improve, and secure the Platform; to calculate and display verified ratings; to prevent fraud; and to maintain the referral program.
• Legal Obligation – To comply with laws (e.g., tax, anti-money-laundering, TCPA record-keeping).

Specific uses include:

• Operating the consent-gated lead system and notifying vendors/lenders/agents of consented leads.
• Verifying licenses/insurance and maintaining verified seller review eligibility.
• Processing payments and subscriptions via Stripe.
• Storing and linking referral codes for the vendor referral program.
• Generating aggregated performance metrics and ratings (using only verified seller data).
• Responding to your support requests and improving the Platform.
• Complying with legal and regulatory requirements.

4. The Consent-Gated Lead Flow

Vendor contact information is never visible to sellers until explicit consent is given. When a seller searches for vendors:

1. The seller reads a clear disclosure explaining that clicking "I Consent" means they agree to be contacted by the selected vendor.
2. The seller actively clicks "I Consent."
3. Only then do we reveal the vendor's contact details to the seller and notify the vendor of the lead (with seller's user ID and consent timestamp).

Every consent event is logged with timestamp, user ID, IP address, and disclosure version. Vendors are contractually prohibited (via our Terms of Service) from contacting any seller who has not gone through this exact process. Violations result in suspension. This design ensures compliance with the Telephone Consumer Protection Act (TCPA), CAN-SPAM, and state do-not-call rules.

5. Data Sharing and Sub-Processors

We do not sell personal data. We share data only as necessary with the following sub-processors (all under written data processing agreements that require equivalent protection):

Platform administrators may access uploaded documents solely for verification purposes; access is logged in an audit trail. No documents are shared with sellers or any third party. We do not use advertising networks, tracking pixels, or behavioral advertising.

6. Referral Program and Verified Seller Reviews

Referral Program: When a seller uses a vendor's unique referral code during registration, we store the referring vendor's ID alongside the seller's record solely to award subscription discounts (10–50% tiers based on referral volume). This linkage is internal only and is never sold or shared externally.

Verified Seller Reviews: Only sellers who have (1) completed the initial FSBO intake form and (2) completed the "Plan Your Move" intake form may submit ratings. We use the seller's verified status (derived from these two data points) to validate reviews and calculate public agent ratings. Fraudulent reviews are removed. The minimum acceptable average rating for an agent to remain listed is 4.8 stars.

7. Data Retention

We retain personal data only as long as necessary for the purposes listed above, to comply with legal obligations, resolve disputes, and enforce agreements. Specific periods include:

• Seller data (including property address and move-destination data): For the duration of the active account/listing + up to 3 years after account closure or deletion request. Move-destination data is minimized and deleted earlier upon request.
• Vendor/lender/agent uploaded license and insurance documents: While the account is active + 1 year after deactivation.
• Consent logs and records: 5 years after the consent event (to demonstrate TCPA compliance).
• Payment metadata (Stripe IDs and subscription status): 7 years (standard tax and financial record-keeping requirements).
• Technical / session data: Up to 30 days, or longer if needed for security investigations.
• Derived ratings and performance metrics: Indefinitely while the account is active; deleted upon account closure where feasible.

You may request earlier deletion (subject to legal exceptions) via the rights process below.

8. Data Security Measures

We implement reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit (TLS) and at rest (AWS S3 server-side encryption).
• Role-based access controls and audit logging of all admin access to documents.
• Rate limiting on sensitive endpoints.
• Randomized, non-enumerable keys for S3 document storage.
• Regular security reviews and JWT session management (no passwords stored directly by us).

9. Your Privacy Rights

You have the following rights regarding your personal data:

• Access / Know: Request what data we hold about you.
• Correction: Request inaccurate data be corrected.
• Deletion: Request deletion (subject to legal exceptions, e.g., ongoing transactions or legal holds).
• Portability: Receive your data in a structured, machine-readable format.
• Objection / Opt-Out: Object to processing based on legitimate interest or opt out of any "sale" of data (we do not sell data, so no opt-out sale right applies).
• Non-Discrimination: We will not discriminate against you for exercising these rights.

10. Cookies and Similar Technologies

We use only essential session cookies (JWT) to maintain your authenticated session. These are strictly necessary for the Platform to function and are deleted when you close your browser. We do not use advertising cookies, analytics cookies, or any tracking technologies that would require additional consent.

11. Children's Privacy

The Platform is not directed to children under 18 and we do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 18, we will delete it promptly.

12. Real Estate Disclaimer

FSBOHub is a technology platform and marketplace/directory only. We are not a licensed real estate broker, do not provide real estate, legal, or financial advice, and do not facilitate brokerage activities or referral fee arrangements. Sellers should consult licensed professionals for contracts, disclosures, and closing matters. Displaying agents or sharing consented vendor contact information does not constitute brokerage activity.

13. Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices or applicable law. Material changes will be notified by posting the updated Policy on the Platform with a new "Last Updated" date and, where required by law, by email or in-app notice. Your continued use after changes constitutes acceptance.

14. Governing Law and Additional State Considerations

This Policy is governed by U.S. federal law and the laws of the State of [Oklahoma or Delaware, once entity formed]. The Platform operates nationwide. We have structured this single Policy to satisfy the strictest applicable state privacy laws (CCPA/CPRA as the baseline), including those of California, Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Texas (TDPSA). If you reside in one of these states and believe additional rights apply, please contact us.