Rebate Realty Privacy Policy

Effective September 30, 2026. Version: 2026-09-30-1.

1 Who we are and how to contact us

Rebate Realty, Inc. ("Rebate Realty," "we," "us," or "our") operates the Rebate Realty website at rebaterealty.com, its client, agent and administrator workspaces, and the Rebate Realty mobile services that link to this policy. This policy explains how we collect, use, disclose, protect and retain information when you research a property, create an account, prepare an offer or work with our team.

For privacy questions, access or correction requests, or requests to delete an account or personal information, email support@rebaterealty.com. Put "Privacy request" or "Delete my account" in the subject. You can also use our account and data deletion instructions, including if you no longer have the app or cannot sign in.

This policy describes our handling of information; it is not a purchase agreement, representation agreement, C.A.R. form or authorization to sign transaction documents. It does not waive your privacy rights or supply consent for unrelated advertising. Separate notices and permissions apply when required. Independent brokerages, lenders, escrow and title companies, signing services, listing websites and app stores have their own responsibilities and policies for information they receive directly.

2 The most important points

• AI assists with property-address matching, comparable-sales research, market reports and suggested prices. It does not replace your licensed real estate professional or decide whether you qualify for financing or representation.
• We do not include your account name, email, telephone number, passwords, uploaded client documents, private offer instructions or transaction notes in our AI research requests. Our research integration selects property facts separately from your account and transaction records.
• The property address you research is sent to property-data and, when needed, AI/search providers. An address, property photograph or public listing can relate to an identifiable person. We therefore do not describe research as anonymous or claim that no personal information can ever reach a research provider.
• Your workspace is access-controlled. Creating a public report link makes the report accessible to anyone who obtains that link. Private uploaded transaction documents are not included in that public report.
• We do not sell account information or use it for cross-context behavioral advertising. Essential account storage, third-party maps and other external services are described below.

3 Information we collect and its sources

Account and contact information. You provide your name, email address, telephone number, password, account preferences and communications with us. We store a protected password hash rather than a readable account password. Staff accounts may also include a role, license number and assignment information. An authorized administrator may create or update an account and issue a setup link.

Property research and search history. We receive the address or partial address you type, selected address matches, requested properties, search times and research results. We obtain property addresses, geographic coordinates, photographs, listing history, property characteristics, recorded sales, comparable sales and market information from property-data providers and publicly accessible sources. When you are signed in or save a report, we can associate the property and report with your account. An unregistered search still sends the property query and ordinary connection information to our service.

Offers and transaction information. You and authorized staff may provide proposed prices, financing and down-payment information, earnest money, contingencies, dates, co-buyer details, existing-agent disclosures, representation requests, agent notes, offer status, escrow and title contacts and other information needed for your requested transaction. These records can contain financial and commercial information even though the website does not process a purchase payment or make a credit decision.

Documents and approvals. We receive files you choose to upload and information such as their names, types, sizes, upload times, uploader and related property or transaction. Files may contain financial statements, preapproval letters, identity details, signatures or other sensitive information you choose to provide. We also retain document requests, external signing links, version history and approval records. A portal approval or a click on a signing link is not itself a signature on a C.A.R. or purchase document.

Activity, security and technical information. Our systems process IP addresses, request details, browser or device information presented with a connection, session identifiers, device labels, request and error information, login times, last actions, account setup or recovery activity and access-control events. Account and transaction history can record who performed an action, when it occurred and what was approved or changed. Accepted Terms of Service records include the version, document fingerprint and acceptance time. Service providers also receive the technical information needed to deliver their services.

Information from other people. Assigned agents, administrators, co-buyers and transaction professionals may supply information needed to assist you. Provide another person's information only when you have authority to do so, and make this policy available to them. Please do not place Social Security numbers, passwords, bank account numbers, access codes or unrelated personal details in an address field or report request. Redact unnecessary sensitive information from documents before uploading them.

4 Why we use information

We use information to match property addresses; obtain and explain comparable sales; generate, save, display and share reports at your direction; provide accounts and account recovery; prepare and route offer drafts for professional review; coordinate documents, approvals, assignments and transaction updates; respond to requests; and deliver the real estate services you ask for.

We also use necessary information to keep the service reliable, prevent misuse, investigate security incidents, maintain transaction and acceptance evidence, comply with legal and professional duties and resolve disputes. Authorized staff can see relevant login and transaction activity to manage client service. We do not use private client files to build or train a general-purpose AI model, make advertising profiles or determine a person's creditworthiness.

Registering expresses interest in the requested report or real estate assistance and lets our team contact you about that request. Providing a phone number or accepting website terms is not consent to automated promotional calls, texts or unrelated marketing. We obtain separate permission where required and honor applicable communication preferences.

5 How property AI and web research work

Our service first requests property information from PropertyReach. Where additional research is needed, our server uses OpenRouter to reach the configured AI model provider and Exa web-search tools to locate relevant public sources. The configured model is currently OpenAI GPT-6 Astra; OpenRouter lists OpenAI, Microsoft Azure and Amazon Bedrock as hosting providers for that model, and routing is subject to the privacy restriction described below. The providers receive the researched address and selected property and market facts, such as size, age, bedrooms, bathrooms, listing or sold prices, listing dates and comparable-sale information. Address-matching requests can include a partial address. This happens on our server; your browser does not receive our provider credentials.

The AI input is restricted to selected property fields. We do not attach your account profile, contact details, uploaded documents, private deal records, approval history or authentication information. We convert supplied listing descriptions into a limited set of property and negotiation signals before including those signals in AI requests, instead of forwarding the entire supplied description. Known contact-number and email patterns in a property query are rejected. These safeguards reduce unnecessary disclosure; they cannot guarantee that every address or public source is free of information relating to a person.

The AI may retrieve public listing descriptions, photographs, sales records and market pages during web research. Those pages can include other people's names or contact details. Our instructions limit the research to property valuation and market context and prohibit investigating a buyer's or owner's personal circumstances or using protected personal characteristics to price a home. Do not use the research feature to submit confidential instructions or documents.

We request OpenRouter's provider data-collection restriction for our model calls. This is a routing control, not a promise that every service in the research chain has zero retention. OpenRouter, the selected model-hosting provider, search tools and source websites can have separate processing, security, metadata and retention practices. We do not promise that all vendors delete data when our cache expires or that every external service operates exclusively in California. See OpenRouter's data practices and Exa's privacy policy; business-service terms can also govern their processing.

AI results are estimates that may be incomplete or incorrect. Reports and price suggestions do not constitute an appraisal, approval of a purchase, a lending decision or a binding offer. You choose your price and terms, and a licensed real estate professional reviews an offer draft before presentation. If you do not want a property address processed through AI research, do not request AI research; contact support about working directly with a professional. Withdrawing a future research request does not undo processing that already occurred.

6 Who can receive information

Our team and service operators. Clients can access their own workspace records; agents are limited to assigned deals; administrators can manage records across the service. Authorized technical operators may access information as needed to maintain, secure or support the service. Access is limited according to role and purpose, rather than made available to every agent.

Technical and research providers. Hosting, database, storage, backup and security services process information needed to operate the service. Property-data, AI and search providers receive the research information described above. If transactional email delivery is enabled, the configured mail provider receives the recipient and message content needed to deliver it. We do not send client documents to an AI provider as part of document upload, download or broker review. Providers engaged to process information on our behalf must be subject to appropriate confidentiality, security and permitted-use obligations. Independent external services may act under their own policies.

Transaction participants. At your request or as needed for an authorized transaction, relevant information may be provided to your licensed brokerage and assigned professionals, the seller or listing side, lenders, escrow and title companies, inspectors and electronic-signature providers. We do not give all of those participants general access to your account. An unsigned draft sent for broker review is not automatically delivered to a seller or signed with an external service.

Your chosen recipients. We disclose reports when you create or distribute a public share link, download a report or direct us to send information to someone. See Section 7 before sharing.

Legal and business circumstances. We may disclose information as reasonably necessary to comply with law, a valid legal process or regulatory examination; protect people, systems and legal rights; investigate fraud; or obtain professional legal, insurance or accounting advice. Information may be transferred during a genuine merger, acquisition, financing, reorganization or sale of the business, subject to applicable confidentiality, notice and legal requirements. This does not authorize an unrelated sale of customer lists.

7 Public report links, downloads and social previews

A public report link is accessible without signing in to anyone who possesses it. Its report, downloadable PDF and social preview may include the subject property's address, image, location, property details, comparable addresses and sold prices, market findings and suggested offer price. These are research outputs, not your privately entered offer terms. The public report does not include your client profile, uploaded transaction documents or private agent notes.

Sharing through messaging or social platforms may cause those platforms to fetch and cache the address, image and report preview. Recipients can forward the link, take screenshots or keep downloaded copies. Authorized users can revoke a report's public link in the report workspace; revocation stops future access through that link on our service but cannot recall copies or previews already retained by others. Please do not share a report if you are uncomfortable with its property information becoming public.

8 Cookies, browser storage, maps and external services

We use an essential session cookie to maintain a signed-in browser session. Client sessions normally last up to seven days and staff sessions up to eight hours, unless ended or revoked earlier. Browser storage can retain your light/dark preference and temporary offer-draft progress. An unsigned public offer draft may remain in the current browser session before you sign in; clearing browser storage can remove unsaved work. Stored session and recovery credentials are not sent to AI research providers.

The current website does not integrate advertising pixels, behavioral advertising tools or a third-party analytics SDK. It does load external services in some places: Google Maps satellite embeds, Google-hosted fonts, listing or sample property images and links to listing and signing websites. When loaded, those services can receive the requested property or resource, your IP address, browser information and cookies or identifiers available to that service. They may recognize a signed-in user or activity across other sites according to their policies. Google's practices are explained in the Google Privacy Policy. External listing and signing websites govern information you provide after opening them.

We do not use cross-site behavioral tracking ourselves. The site does not change its essential operation in response to the older Do Not Track browser signal. Global Privacy Control is a different opt-out signal: we honor applicable sale/sharing opt-out requirements, and do not currently conduct a sale or cross-context behavioral advertising activity to opt you out of. These statements do not override your browser controls or the independent practices of third-party services. You can restrict third-party cookies in your browser; blocking essential storage can prevent sign-in or draft persistence.

9 Mobile access and device permissions

This policy also applies to Rebate Realty mobile services that link to it. Account, research and transaction information transmitted through the client mobile API is handled as described above. Availability of a mobile API does not mean every feature or a native app has been released.

Our current service uses the property address you enter, not your device's GPS location. It does not request access to your contacts, microphone, health information or advertising identifier. Uploading a file sends the file you choose, not your entire photo or document library. Any future native camera, photo, location or push-notification capability must be explained when used, limited to its stated purpose and subject to required device permissions and consent. You may manage permissions in your device settings. Denying an optional permission does not authorize us to bypass it.

In-app notices, Apple App Privacy information and Google Play Data safety disclosures must reflect the actual released app and its SDKs. A new feature or third-party integration requiring additional disclosure or permission will not be authorized solely by this general policy. Necessary AI-sharing permission is separate from accepting website terms.

10 Notifications and communications

The workspace currently provides bell notifications for account and transaction events, such as an assigned deal, a document request or a pending approval. Our team may contact you using the details you supplied to respond to your inquiry or assist with your transaction. Email password recovery, sign-in codes and automated email notices depend on a configured delivery service; the availability message in the account screen identifies whether they are enabled. We do not claim to deliver an email or text when that channel is unavailable.

Security and transaction messages are distinct from optional marketing. You may ask us to stop optional promotional communications without giving up privacy rights. Important account, legal or requested transaction communications may still be necessary. Public report sharing and external signing are initiated separately; granting notification permission does not sign a document.

11 Retention and deletion

We keep personal information for the period reasonably needed to provide requested services, maintain the account and transaction record, meet professional or legal obligations, prevent fraud and resolve documented disputes. The relevant purpose, account activity, transaction stage, required record period and any legal hold determine retention; not every record has the same deadline.

• Accounts, reports and search history: retained while needed for your account or requested services, subject to a deletion request and applicable exceptions. Removing an item from a visible list or deactivating an account does not necessarily erase its underlying record.
• Offers, documents, approvals and audit evidence: retained where needed to document a transaction, authorization, compliance obligation or dispute. California Business and Professions Code Section 10148 generally requires a licensed broker to keep specified transaction records for at least three years, measured from closing or from the listing date if the transaction is not consummated. A different applicable duty or legal hold can require longer retention. This is not a reason to keep unrelated account data indefinitely.
• Research caches: results are normally eligible for reuse for six hours. That is a freshness interval, not a promise of physical deletion after six hours. Saved reports, expired cache files, exported reports and backups can remain separately until removed through retention or deletion procedures.
• Security records and recovery credentials: retained as needed to protect accounts and demonstrate relevant actions. Session, setup, reset and sign-in-code validity periods limit use; expiration alone does not mean every associated audit or database record has been erased.
• Backups: protected rolling backups can retain a prior copy after a change to live records. They are used for recovery, are not a substitute for the active service and age out under the backup cycle unless a specific preservation requirement applies. If a backup is restored, approved deletion restrictions must be reapplied.

To request deletion, follow Section 12 or our deletion instructions. We review which information can be erased and which must be retained, explain any material exception and restrict retained information to the permitted purpose. Deleting an account does not cancel an executed purchase contract, representation agreement or another party's independent legal record. It also cannot remove public records maintained by a government or independent listing provider.

12 Your choices and privacy requests

Contact support@rebaterealty.com to request access to information, a copy of your data, correction, deletion of specific information or deletion of your entire account and associated personal data. You can make a request even if you cannot sign in or no longer use the app. Identify the account email, the request and, if relevant, the affected transaction. Do not include a password, Social Security number or an unredacted identity document in the initial email.

We may verify control of the account or request proportionate information to protect you from unauthorized disclosure or deletion. An authorized agent may submit a request with appropriate authorization and any verification the law permits. We use verification information for that purpose, rather than as a reason to collect unrelated information. If you cannot use the account email, explain that to support so we can discuss an appropriate alternative.

We aim to acknowledge a request within 10 business days and respond within 45 calendar days, or within another period required by applicable law. If a permitted extension or legal exception applies, we explain the reason and applicable timing. We do not require an app download or a purchase to contact us about privacy. We do not charge for ordinary requests or discriminate against you for exercising a protected right. When a request cannot be fulfilled in full, we explain the applicable basis and available next steps.

You can ask us to stop future optional processing that relies on your consent. Withdrawal applies prospectively and does not invalidate earlier lawful processing or prevent retention required by law. We will explain if fulfilling a request means an account or particular feature can no longer operate. You may still contact a professional directly about available alternatives.

13 California privacy information

We serve California consumers and provide the request channel above whether or not a particular privacy statute applies to our business. Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, eligible consumers have rights to know and access personal information; request deletion and correction; opt out of a sale or sharing for cross-context behavioral advertising; limit certain uses or disclosures of sensitive personal information where that right applies; and exercise their rights without unlawful discrimination. You may use an authorized agent, subject to permitted verification.

The categories our current service collects or may receive are identifiers and contact details; customer and financial information in offers or documents; commercial and transaction records; internet or service activity; user-provided files and communications; property addresses and coordinates; professional information for staff and transaction contacts; and property-related inferences such as price estimates. Sensitive personal information may be present in credentials or documents you provide. We use it for the requested account, security and transaction functions and applicable legal duties, rather than to infer protected personal characteristics. We do not seek government ID numbers, full financial account credentials or unrelated sensitive data through research fields.

Sections 3-6 describe the sources, purposes and recipient categories, and Section 11 explains retention. We do not sell personal information for money or other valuable consideration or share it for cross-context behavioral advertising in the current service; we have no actual knowledge of such sale or sharing involving anyone under 16. We do not disclose personal information to third parties for their own direct marketing. Contact support to ask about a particular disclosure, an applicable opt-out or limitation right, or California's direct-marketing disclosure rights. Third-party map and website practices remain relevant as described in Section 8.

14 Security and processing locations

We use safeguards appropriate to the service, including HTTPS, protected password and session credentials, server-side role and record permissions, private document storage and controlled backups. Transaction access is checked on the server. External signing providers maintain their own signature systems. These safeguards reduce risk but no network, device or storage system can be guaranteed completely secure. Contact support promptly about suspected unauthorized access; do not send us a password or recovery code.

Our service is operated from the United States. Technical and research providers may process information in the United States or other countries where they operate, subject to applicable requirements. We do not promise California-only processing or treat use of the website as a waiver of rights that apply to an international transfer.

15 Children and other people's information

The service is intended for adults aged 18 or older and is not directed to children. We do not knowingly solicit personal information from children under 13. If you believe a child supplied information, contact support so we can investigate and take appropriate steps. Do not upload children's information or third-party sensitive information unless it is necessary for an authorized transaction and you are entitled to provide it.

16 Changes to this policy

We will post changes here and update the effective date and version. For a material change, we will provide a prominent website or in-product notice and, where appropriate, contact affected account holders. When a new use requires consent, we will obtain it before that use begins. A change to this policy does not retroactively authorize a materially different use of information without the notice or permission required by law.

Questions or concerns: support@rebaterealty.com. You may also raise a concern with the California Privacy Protection Agency or another relevant regulator. Nothing in this policy limits rights or remedies that cannot lawfully be waived.