Privacy Policy - Back On Market Docs

Back On Market Docs (BOMDocs; "we", "us", "our") operates a marketplace where eligible rights holders can list professional property-related documents (such as inspections, appraisals, and similar reports) and buyers can purchase a limited license to access those documents. This Privacy Policy explains what personal information we collect, why we process it, how we share it with service providers, and what choices you may have.

This policy applies to visitors and account holders who use our website, APIs, and related services (the "Service"), including buyers (User), uploaders, realtors, mortgage lenders, developers, and administrators. By using the Service, you acknowledge the practices described here. Our Terms & Conditions govern your contractual relationship with us; this Privacy Policy focuses on personal information.

United States launch. We primarily serve users in the United States. EU/EEA/UK and other regions are not a launch market; expansion is backlog. If you access the Service from abroad, U.S. processing may still occur. Depending on where you live, U.S. state privacy laws (for example California CCPA/CPRA-style rights, or Utah UCPA-style rights where applicable) may give you rights to confirm processing, access, delete, or obtain a copy of certain personal data, subject to legal exceptions. Contact us to make a request.

1. Information We Collect

Account and Profile Information

When you create or manage an account, we may collect:

• Name: Full name or display name
• Email Address: Authentication, notifications, and account recovery
• Password: Stored as a cryptographic hash (we do not store or view your plain-text password)
• Phone Number: Optional, if you provide it in your account profile
• Role: Account type such as User (buyer), Uploader, Realtor, Mortgage Lender (Lender), Developer, or Admin, used to customize features and permissions
• Account Status: Email confirmation, Developer approval status, subscription status (where offered), two-factor authentication (2FA) status, and preferences
• Payout Onboarding Identifiers: References needed to connect payout accounts (for example Stripe Connect account identifiers), not full bank card numbers

Report and Transaction Information

When you upload, purchase, preview, or otherwise interact with reports:

• Report Metadata: Property address, city, state or region, property type, report type, contractor/inspector/appraiser name and license number (when provided), title, price, and related listing fields
• Report Files: Document files (commonly PDF; other supported types may apply) stored in cloud object storage, including watermarked preview and licensed-download derivatives stamped with an account identifier
• Purchase and License Records: Transaction history, amounts, commission calculations, license tokens or identifiers, download/view counts within license limits
• Referral and Discount Data: Referral codes used at purchase, discount codes, and related attribution
• Reviews and Flags: Reviews you submit and report flags you file for moderation

Payment and Financial Information

When you make purchases, subscribe (where offered), or receive payouts:

• Payment Method Details: Processed by Stripe; we do not store full payment card numbers
• Transaction Records: Amounts, dates, payment status, refunds, chargebacks, and related identifiers
• Commission and Payout Records: Earnings, referral commissions, payout requests, approvals/denials, and financial summaries needed to operate the marketplace
• Subscription Status: Whether an applicable plan is active, which may affect commission rates for uploaders and referrers

Usage, Security, and Developer Data

• Usage Analytics: Views, downloads, purchases, and search or browse activity used to operate and improve the Service
• Device and Browser Information: IP address (security, fraud prevention, and license validation), browser type, device type, and operating system
• Access and Security Logs: Login events, 2FA challenges, account activity, and security-relevant events
• API Usage (Developer Accounts): API key identifiers (keys stored hashed), endpoint calls, usage metrics, and related billing records

Communications

• Contact and Support Tickets: Messages submitted through our contact form, stored for admin follow-up in our Contact Inbox
• Transactional Email: Purchase confirmations, password resets, email confirmation, security notices, and similar operational messages
• Optional Notices: Policy updates or service announcements where we determine notice is appropriate

Automated Document Overviews (When Enabled)

When the optional AI document overview feature is enabled, we may process extractable text from stored report files to generate short, on-site overviews. Processing may use self-hosted or configured machine-learning services (for example a local or privately hosted model endpoint). Outputs are informational only and are not a substitute for the full report. Cached overview results may be retained for operational performance until invalidated or deleted under our retention practices.

2. How We Use Your Information

We use personal information for purposes that support operating a licensed-document marketplace and related services, including:

Service Operation

• Authenticate users, manage accounts, and support optional 2FA
• Host listings, serve watermarked previews, and deliver licensed downloads (buyer downloads are watermarked with an account identifier such as "Licensed to {accountId}"; see Terms)
• Process purchases, refunds, subscriptions, commissions, and payouts (Stripe Connect; no Venmo)
• Validate licenses and enforce download/view limits
• Operate developer API access, usage metering, and related billing
• Send transactional email and respond to contact tickets
• Generate optional AI overviews when that feature is enabled

Service Improvement

• Analyze usage to improve search, browsing, reliability, and product features
• Monitor API performance and detect abuse
• Support quality and moderation (flags, approvals, and related admin tools)

Security and Legal Compliance

• Detect and prevent fraud, abuse, and unauthorized access
• Enforce our Terms & Conditions and protect users and the platform
• Comply with applicable law, tax recordkeeping, and lawful requests from authorities

We describe our marketplace purpose in plain language on About. Marketing language (for example transparency or reusing documents you already paid for) is informational positioning; it is not a separate promise about how long we keep data or how commissions are calculated. Those topics are governed by this policy, the Terms, and applicable dashboard displays.

3. Data Sharing and Third-Party Services

We do not sell personal information for advertising in the everyday sense of selling a customer list. We share information with service providers and partners as needed to run the Service. Definitions of "sell" or "share" under specific state privacy laws are legal terms; counsel should confirm final wording for your jurisdiction.

Service Providers (Subprocessors)

• Microsoft Azure (Blob Storage and Hosting-Related Services): Stores report files, metadata, and related application data. Data is typically stored and processed in the United States as configured by us.
• Stripe: Payment processing, subscription events (where used), and payout/Connect flows. Stripe handles card data under its own terms and security program; we do not store full card numbers.
• Mailgun (or Equivalent Email Provider): Transactional and operational email delivery (not marketing lists by default).
• Address Standardization: Property addresses may be sent to Azure Maps (default freemium direction) or, if configured, the USPS Addresses API, to standardize listing addresses. Soft-fail on timeout so upload is not hard-blocked.
• Optional AI Inference: When AI overview is enabled, extractable report text may be sent to the configured model endpoint (typically local/self-hosted Ollama) for overview generation.
• Optional Google Analytics 4 (GA4): If configured with a measurement ID (Analytics:Ga4MeasurementId), page analytics may load; an empty measurement ID means no GA4 script.

A current subprocessors list may be provided on request. Providers change their own policies; we select and configure them for operational needs.

Legal Requirements and Safety

We may disclose information if required by law or if we believe in good faith that disclosure is reasonably necessary to:

• Respond to lawful process (subpoenas, warrants, court orders)
• Investigate suspected violations of our Terms
• Protect the rights, property, or safety of BOMDocs, our users, or others

Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will take steps we consider reasonable to notify affected users of a change in control of personal information where appropriate.

4. Data Security

We implement administrative, technical, and organizational measures appropriate to our Service, including:

• Transport Encryption: HTTPS/TLS for browser and API traffic
• Password Hashing: Passwords stored using modern cryptographic hashing (not plain text)
• Storage Controls: Report files and metadata in Azure Blob Storage with access controls and encryption at rest as configured
• Role-Based Access: Permissions limited by account role
• API Key Handling: API keys hashed and validated on request
• Optional 2FA: Users may enable two-factor authentication on their accounts
• Monitoring: Logging and review of suspicious or unauthorized activity

No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for safeguarding your credentials, enabling 2FA where available, and logging out of shared devices.

5. Cookies and Tracking Technologies

Essential Cookies

• Authentication and Session: Keep you signed in and maintain session state
• Security: Help mitigate cross-site request forgery (CSRF) and related risks

Analytics (If Used)

We may use first-party analytics and, when configured, Google Analytics 4 (GA4) to understand how the Service is used. GA4 is config-gated: if no measurement ID is set, the GA4 script is not loaded. You can limit cookies through browser settings; essential cookies may be required for login and core features.

We do not use third-party advertising cookies or sell browsing history to advertisers as part of our current product design. Counsel should confirm any consent banner requirements if non-essential analytics cookies are enabled in production.

6. Your Privacy Rights and Choices

Depending on applicable law and your location, you may have rights to:

• Access and Portability: View account information and request a copy of personal data we hold about you
• Correction: Update profile fields (name, email, phone, display name) and passwords through your account where available
• Deletion: Request account closure and deletion of personal data, subject to retention required for transactions, tax, fraud prevention, dispute resolution, or law
• Opt-Out of Non-Essential Email: Transactional and security messages will still be sent when needed to operate your account and purchases
• Cookie Controls: Manage non-essential cookies via your browser

Additional Rights (EEA/UK and Certain U.S. States)

If GDPR, UK GDPR, CCPA/CPRA, UCPA, or similar laws apply to you, you may have additional rights (access, rectification, erasure, restriction, portability, objection, appeal, or rights related to automated decision-making). We do not use AI overviews to make solely automated decisions that produce legal or similarly significant effects about you; overview text is an informational product feature.

To exercise rights, use Contact or email [email protected]. We will respond within the time required by applicable law (often within 30 days where that standard applies).

7. Data Retention

We retain information only as long as reasonably necessary for the purposes described in this policy, including:

• Account Data: While the account is active; after closure, limited records may be retained for legal, tax, security, or dispute purposes
• Report Files and Listings: While listed or otherwise needed to fulfill licenses, resolve disputes, or meet legal obligations; archived or deleted listings may persist for a limited operational period
• Transaction, Commission, and Tax Records: Commonly retained for multiple years (often up to about seven years) where financial recordkeeping requires it
• API Usage Logs: Typically up to about one year for billing, abuse detection, and troubleshooting
• Security Logs: Typically up to about 90 days unless a longer period is needed for an investigation
• AI Overview Cache: Until invalidated (for example by configuration version bump) or removed under operational retention
• Support Tickets: For as long as needed to resolve the request and for reasonable follow-up or compliance

Exact periods may vary; counsel should confirm final retention schedules for launch.

8. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

9. International Data Transfers

BOMDocs is operated with primary processing and storage in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, which may have different data-protection rules than your country.

Where required by law, we will use appropriate transfer mechanisms as advised by counsel. Using the Service from abroad means you understand U.S. processing may occur.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect product, legal, or operational changes. For material changes we may:

• Post the updated policy with a new "Last updated" date
• Notify registered users by email when changes are significant
• Display a notice on the Service

Continued use after the effective date constitutes acceptance of the updated policy where permitted by law. If you do not agree, stop using the Service and request account closure.

11. Contact Us

Questions or privacy requests:

Back On Market Docs ({{legal_entity_name}})
Email: [email protected] (prefer the Contact form so we can track your ticket)
Website: www.bomdocs.com
Privacy contact / registered agent: {{privacy_contact_address}}

See also our Terms & Conditions. For jurisdiction-specific complaints, you may also contact your local data-protection or consumer-protection authority where applicable.