LedgrPRO

Privacy Policy

How LedgrPRO Collects, Uses, and Protects Your Information

Effective Date: March 20, 2026

1. Introduction and Scope

This Privacy Policy describes how LedgrPRO, Inc. ("we," "us," or "our") collects, uses, stores, shares, and protects information about users of the LedgrPRO platform and website (collectively, the "Service"). This Policy is incorporated into and forms part of our Terms of Service.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with this Policy, do not use the Service.

This Policy applies to information collected through the Service. It does not apply to third-party websites linked from our platform. We are not responsible for the privacy practices of third-party sites.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide when you register an account, subscribe to a plan, or interact with the Service, including:

Account information: name, email address, password (encrypted), and company name.
Billing information: payment card details and billing address (processed by Stripe; we do not store full card numbers).
Profile information: professional background, investment focus, and preferences you optionally provide.
User Data: property addresses, financial inputs, portfolio data, and other content you upload or enter into the platform.
Communications: messages, support requests, and feedback you send to us.

2.2 Information Collected Automatically

When you use the Service, we automatically collect certain technical information, including:

Log data: IP address, browser type, operating system, pages visited, timestamps, and referring URLs.
Usage data: features accessed, searches performed, reports generated, and interaction patterns within the platform.
Device information: device type, screen resolution, and hardware identifiers.
Cookies and similar tracking technologies: session cookies, preference cookies, and analytics identifiers. See Section 8 for more detail.

2.3 Information from Third-Party Services

When you connect third-party services to the platform (such as bank accounts via Plaid, which is available in later platform phases), we may receive information from those services as authorized by you and subject to those services' own privacy policies. We collect only the minimum data necessary to provide the connected feature.

2.4 Information We Do Not Collect

We do not collect Social Security numbers, government-issued identification numbers, or consumer credit information. The Service is not a consumer credit product and is not governed by the Fair Credit Reporting Act from a data collection standpoint. Any distressed property signals or public records data surfaced by the platform are not used by the Company for consumer credit, insurance, or employment eligibility purposes.

3. How We Use Your Information

We use information collected through the Service for the following purposes:

Service delivery: to create and manage your account, process payments, provide platform features, and send transactional communications.
Platform improvement: to analyze usage patterns, diagnose technical issues, improve data accuracy models, and develop new features.
Data flywheel: aggregated and anonymized portfolio performance data submitted by users may be used to improve the accuracy of the Rental Market Underwriting Engine's rent estimates. No individually identifiable data is used for this purpose.
Legal compliance: to respond to legal obligations, enforce our Terms of Service, and protect the rights and safety of the Company, its users, and the public.
Communications: to send product updates, security alerts, billing notices, and where consented, marketing communications. You may opt out of marketing communications at any time.
Fraud prevention and security: to detect, investigate, and prevent unauthorized access, fraudulent transactions, and other illegal activities.

4. How We Share Your Information

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating the Service, subject to confidentiality obligations. These include:

Stripe: payment processing. Stripe is PCI-DSS compliant and governed by Stripe's Privacy Policy.
Clerk: user authentication and identity management.
Resend: transactional email delivery.
Cloudflare: infrastructure, content delivery, and security services.
Supabase: database hosting and storage.
Plaid (Phase 3): bank account data aggregation, when you optionally connect a financial account. Governed by Plaid's Privacy Policy.
Data providers: ATTOM Data Solutions, RentRange, Rentometer, BatchLeads, and similar providers for property and market data.

4.2 Business Transfers

If the Company undergoes a merger, acquisition, reorganization, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify you by email and prominent notice on the Service at least 30 days before your information becomes subject to a materially different privacy policy, and you will have the opportunity to export or delete your data.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in the good-faith belief that such disclosure is reasonably necessary to comply with a legal obligation, protect the rights or property of the Company, prevent fraud or illegal activity, or protect the personal safety of users or the public.

4.4 What We Do Not Do

We do not sell, rent, or lease your personally identifiable information to third parties for their marketing purposes. We do not share your User Data with data brokers or advertising networks.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. We retain billing and transaction records for at least seven (7) years to comply with applicable tax and financial recordkeeping requirements. We retain anonymized and aggregated usage data indefinitely for platform improvement purposes.

Upon account deletion, we will delete or anonymize your personal information within 90 days, except where retention is required by law or for fraud prevention purposes.

6. Data Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest, access controls, and regular security assessments.

HOWEVER, NO METHOD OF TRANSMISSION OVER THE INTERNET OR ELECTRONIC STORAGE IS 100% SECURE. WE CANNOT GUARANTEE ABSOLUTE SECURITY. You are responsible for maintaining the security of your account credentials. In the event of a data breach that is reasonably likely to result in harm to you, we will notify you as required by applicable law.

7. Your Privacy Rights

7.1 General Rights

Depending on your jurisdiction, you may have rights including:

Access: request a copy of the personal data we hold about you.
Correction: request that we correct inaccurate or incomplete personal data.
Deletion: request that we delete your personal data, subject to legal retention requirements.
Portability: request your data in a machine-readable format.
Opt-out: opt out of marketing communications at any time via the unsubscribe link in any marketing email.

7.2 California Residents (CCPA/CPRA)

California residents may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. To exercise these rights, contact us at [email protected].

7.3 Virginia, Colorado, and Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, and other states with applicable consumer privacy laws may have rights similar to those described above. To exercise any rights under applicable state law, contact us at [email protected].

7.4 How to Exercise Your Rights

To submit a privacy rights request, contact us at [email protected] with the subject line "Privacy Rights Request." We will respond within the timeframes required by applicable law (generally 45 to 90 days). We may ask you to verify your identity before processing your request.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate the Service, remember your preferences, and analyze usage. You may configure your browser to refuse cookies, but doing so may affect your ability to use certain features of the Service.

We use the following types of cookies:

Strictly necessary cookies: required for authentication, security, and core platform functionality.
Analytics cookies: used to understand how users interact with the Service and to improve performance.
Preference cookies: used to remember your settings and preferences.

We do not use third-party advertising or behavioral tracking cookies. We do not participate in cross-site advertising networks.

9. Children's Privacy

The Service is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us at [email protected] immediately and we will take steps to delete the information.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. By using the Service, you consent to this transfer and processing.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy at www.ledgrpro.com/privacy and sending notice to the email address associated with your account at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

12. Contact Us

For questions, concerns, or requests related to this Privacy Policy:

LedgrPRO, Inc.

Email: [email protected]

Website: www.ledgrpro.com

[REGISTERED BUSINESS ADDRESS — TO BE COMPLETED BEFORE PUBLICATION]