Privacy Policy

1. Introduction

RefBid LLC ("RefBid," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use the RefBid platform, website, and related services (collectively, the "Platform"). It applies to all registered agents, visitors, and anyone who interacts with our services.

By using the Platform, you consent to the data practices described in this Privacy Policy. If you do not agree, please do not use the Platform. This Policy should be read in conjunction with our Terms of Service.

2. Information We Collect

We collect information in the following categories:

a. Account & Professional Information

When you register for an account, we collect:

• Full legal name
• Email address and phone number
• Real estate license number and issuing state
• Brokerage name and office address
• Years of experience and license issue date
• Profile photo (optional)
• Documents you upload optionally (such as license copies, certifications, or other professional credentials)
• Password (stored in encrypted form — we never store plaintext passwords)

b. Identity Verification Information

To ensure that only licensed, legitimate real estate professionals access the Platform, we require identity verification during registration. This verification is performed through Stripe Identity, a third-party identity verification service operated by Stripe, Inc. During this process:

• You will be asked to photograph a government-issued identity document (such as a driver's license or passport).
• You will be asked to take a live selfie, which Stripe uses to verify that the document belongs to you.
• Stripe's systems analyze the document for authenticity and match it to your selfie using biometric technology.

Important: RefBid does not receive, store, or have direct access to your government ID image, selfie, or any biometric data extracted from them. These are transmitted directly to Stripe and processed and stored within Stripe's secure infrastructure. RefBid receives only:

• A verification status result (e.g., "verified," "pending," or "failed")
• A session reference ID (a non-personal alphanumeric identifier used solely to retrieve your verification result)
• The date and time the verification was completed

Authorized RefBid administrators may access your Stripe Identity verification session through the Stripe dashboard using the session reference ID. This allows administrators to review your verification result and the documents Stripe accepted, solely for the purpose of platform trust, compliance review, and fraud prevention. This access is limited to authorized personnel and is governed by Stripe's data security practices.

By proceeding through identity verification, you consent to the collection and processing of your biometric and document data by Stripe, Inc. under Stripe's Privacy Policy and their Consumer Terms. Stripe's practices regarding biometric data, including applicable state biometric privacy laws (such as the Illinois Biometric Information Privacy Act), are governed by Stripe's policies, not RefBid's. In states with biometric data laws, Stripe provides required notices and consent mechanisms as part of their Identity verification flow.

c. Listing & Transaction Data

When you use the Platform to post listings or place bids, we collect:

• Referral listing details (lead type, location, price range, timeline)
• Bid amounts and bid history
• Winner selection records
• Referral agreement documents and digital signatures
• Transaction status and completion records

d. Client Personal Information (PII)

RefBid does not collect, store, or transmit client personal information. Client PII — such as name, phone number, and email address — is never entered into the RefBid platform. After a referral is accepted and the referral agreement is signed by both agents, the two agents coordinate client introductions privately and directly, outside of the RefBid platform.

e. Payment Information

All payment processing is handled by Stripe, Inc., a PCI-DSS compliant third-party payment processor. RefBid does not collect, store, or have access to your full credit card number, CVV, or bank account details. We only receive:

• Payment confirmation status (success or failure)
• Last four digits of the card used (for display purposes)
• Billing zip code (for fraud prevention)
• Transaction IDs for our records

For more information on how Stripe handles your payment data, please review Stripe's Privacy Policy.

f. Usage & Technical Data

When you use the Platform, we automatically collect:

• IP address and general geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and features used
• Referring URL and search terms
• Session identifiers and login timestamps

3. How We Use Your Information

We use the information we collect to:

• Operate the Platform: Create and manage your account, process listings and bids, generate referral agreements, and facilitate agent-to-agent connections.
• Verify Identity and Professional Credentials: Confirm that you are who you say you are and that you hold a valid, current real estate license. Identity verification is performed through Stripe Identity; credential verification is performed through state licensing authority records.
• Process Payments: Charge listing fees and acceptance fees through Stripe, and maintain transaction records.
• Send Notifications: Deliver in-platform and email notifications about bid activity, winner selections, agreement updates, and account events.
• Improve the Platform: Analyze usage patterns, diagnose technical issues, and develop new features.
• Enforce Our Terms: Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Communicate with You: Respond to support inquiries, send important policy updates, and (with your consent) deliver promotional information.
• Legal Compliance: Meet our obligations under applicable law and respond to lawful government or legal requests.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

• Between Agents (Platform-Facilitated): Agent profile information (name, brokerage, license state, experience, reviews) is visible to other registered agents on the Platform. Client PII is never collected or shared by RefBid — agents coordinate client introductions privately after both parties sign the referral agreement.
• Stripe (Payments & Identity): We share information with Stripe, Inc. for payment processing and identity verification. For payments, Stripe receives your card and billing details. For identity verification, Stripe receives your government ID document and selfie. In both cases, Stripe acts as a data processor under its own privacy policy and applicable data protection agreements. RefBid does not receive your raw document images or biometric data from Stripe — only a verification outcome and session reference.
• Service Providers: We share data with trusted third-party vendors who help us operate the Platform, including our cloud hosting provider and email delivery services. These vendors are contractually prohibited from using your data for any purpose other than providing services to RefBid.
• Legal Requirements: We may disclose information if required by law, court order, subpoena, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of RefBid, our users, or the public.
• Professional Licensing Authorities: In cases of verified fraud, license misrepresentation, or serious professional misconduct, we may report relevant information to your state real estate licensing board.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of RefBid's assets, your information may be transferred to the acquiring entity, subject to equivalent privacy protections.

5. Cookies & Tracking Technologies

RefBid uses cookies and similar technologies to operate the Platform and improve your experience. Specifically:

• Session Cookies: Used to keep you logged in during your session. These are deleted when you close your browser.
• Authentication Tokens: Stored locally in your browser to maintain your login state across sessions.
• Analytics: We may use anonymized analytics tools to understand how the Platform is used. These tools do not identify you personally.

Most browsers allow you to control or disable cookies through their settings. Disabling cookies may limit your ability to use certain features of the Platform, including staying logged in.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Specifically:

• Account Data: Retained while your account is active. Upon account closure, we delete or anonymize account data within 90 days, except where retention is required by law.
• Identity Verification Records: We retain the verification status, session reference ID, and verification date for as long as your account is active, and for up to 7 years following account closure, for fraud prevention and legal compliance purposes. Deletion of your account with RefBid does not automatically delete your identity verification data held by Stripe — you must submit a separate request to Stripe pursuant to their privacy policy.
• Transaction Records: Listing, bid, and payment records are retained for a minimum of 7 years for financial and legal compliance purposes.
• Referral Agreements: Signed referral agreements are retained for a minimum of 7 years.
• Usage Logs: Retained for up to 12 months for security and diagnostic purposes.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit using TLS/HTTPS
• Encrypted storage of passwords using strong hashing algorithms
• Access controls limiting data access to authorized personnel only
• Regular security reviews and vulnerability monitoring
• PCI-DSS compliant payment processing through Stripe
• Government ID documents and biometric data processed and stored exclusively within Stripe's SOC 2 certified, GDPR-compliant infrastructure — not on RefBid's servers

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

8. Your Privacy Rights & Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information in your account.
• Deletion: Request deletion of your account and associated personal data, subject to our legal retention obligations. Note that identity verification data held by Stripe is subject to Stripe's own data deletion process.
• Opt-Out of Marketing: You may unsubscribe from promotional emails at any time using the unsubscribe link in the email. You will still receive transactional and service-related communications.
• Data Portability: Request an export of your account data in a machine-readable format where technically feasible.

To exercise any of these rights, please contact us at privacy@refbid.com. We will respond to all verifiable requests within 30 days.

9. California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights, including:

• The right to know what personal information we collect, use, disclose, and sell (we do not sell personal information).
• The right to request deletion of your personal information, subject to certain exceptions.
• The right to opt out of the sale of personal information (not applicable — we do not sell data).
• The right to non-discrimination for exercising your CCPA rights.

To submit a CCPA request, contact us at privacy@refbid.com or call us at the number listed on our Contact page.

10. Biometric Data — State-Specific Disclosures

Certain states have enacted laws specifically governing the collection and use of biometric data (such as facial geometry derived from selfies). Notably:

• Illinois (BIPA): The Illinois Biometric Information Privacy Act requires informed written consent before collecting biometric identifiers. If you are an Illinois resident, Stripe — as the entity that collects and processes your biometric data during identity verification — provides the required consent disclosures within their verification flow.
• Texas & Washington: Similar biometric privacy protections apply. Stripe's identity verification flow includes applicable disclosures for residents of these states.

Because RefBid does not itself collect, store, or process your biometric data — Stripe does — the primary obligations under these laws apply to Stripe as the data collector. RefBid only receives a non-biometric verification outcome. If you have questions about how Stripe handles your biometric data, please refer to Stripe's Privacy Policy and their state-specific biometric data disclosures.

11. Children's Privacy

The Platform is intended solely for licensed real estate professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected information from a minor, we will promptly delete it. If you believe a minor has provided information to us, please contact us immediately at privacy@refbid.com.

12. Third-Party Links

The Platform may contain links to third-party websites or services (such as Stripe's payment portal, Stripe's identity verification flow, or your state licensing board). RefBid is not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policies of any external sites you visit through links on our Platform.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Oklahoma. Any disputes relating to this Policy shall be subject to the jurisdiction and venue described in our Terms of Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or in-platform notification. Your continued use of the Platform after any changes constitutes your acceptance of the revised Policy. We encourage you to review this page periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact our Privacy team: