Privacy.

The operator named for this product is [LEGAL ENTITY NAME — TBD]. That name is still a placeholder. Contact hello@homeoffersplus.com with a question about your information. Phone and mailing address, once they exist, are on the contact page.

Account records:

• Name, email, and a bcrypt hash of the password. The password itself is not stored.
• Role: homeowner, agent, investor, or administrator.
• For agents: plan (Basic or Pro), license number, two-letter market, and a verification flag with an optional note and time.
• For investors: an optional company name, stored in the same field agents use for a license number.
• For an agent microsite, if they fill it in: public page slug, headline, bio, brokerage name, phone, and photo.
• If a homeowner arrived from an agent's page: that agent's account id.

Property and deal records:

• Address, city, state, ZIP, property type, beds, baths, square feet, asking price, notes, and photos.
• Offers: amount, closing window, terms, status, and any counter amount or note.
• Messages on a listing, with the sender and the time.
• Investor buy-boxes: name, markets, cities, property types, price band, minimum size, and the percent, cap, closing window, and terms used to build an indicative estimate.
• Valuation results when a request is made: provider, value range, confidence, and time.
• When an agent emails an offer report: the client name, client email, note, and later the open count and first and latest open times.

Billing records, for agents and investors who start checkout:

• Stripe customer id, subscription id, status, price key, period end, and trial end.
• Whether the agent subscription is flagged as founding pricing.
• For investors, the time of the first buy-box match, because that is when billing is set to begin.

Card numbers are entered on Stripe's pages. They are not written into this application's database.

Listing photos and profile photos are limited to JPEG, PNG, or WebP, up to 3 MB each. When Vercel Blob is configured, the file is uploaded there with public access and the product stores the returned URL. Those URLs can be requested by anyone who has them. When Blob is not configured, production refuses the upload. Local development can write the file to the server's public uploads folder instead.

The product uses the records above to:

• Create and secure accounts, and keep a signed-in session.
• Show listings, offers, estimates, and messages to the people on that listing.
• Match listings to investor buy-boxes and build indicative estimates.
• Bill agent and investor subscriptions through Stripe, including the rule that an investor is not charged until a match.
• Send operational email, such as a report link or a notice that a report was opened.
• Let an administrator support an account, including the view-as session described below.

Home Offers Plus does not sell a list of accounts. It does not take a commission or a referral fee in exchange for a lead.

If a homeowner opts in to hear about a traditional listing, the product stores the consent wording, a version id, and the time, and creates a lead record tied to that listing. It emails a designated contact. The message includes the property address and asking price, and it is worded differently when the property's state matches a configured state and when it does not. The homeowner's name and email are emailed to the person they accept, after they accept. An open request can be withdrawn, which deletes that lead record.

Stripe.When an agent or investor starts checkout, Stripe receives their name, email, and the account id in metadata, and handles the card and the subscription. Stripe's own terms apply to that payment data.

Vercel Blob. Photo uploads, when configured, are stored there on a public URL. The application is hosted on Vercel, which may keep ordinary request logs such as IP address and path. This application code does not add a separate analytics product on top of that.

Email. Outbound mail is sent through Resend when an API key is configured. The default from-address in code is notifications@homeoffersplus.com unless another from-address is set. Every outbound message is also stored in the application database: recipient, subject, body, and whether it was logged, sent, or failed.

Valuation. A market-estimate request sends the street address, city, state, and ZIP to ATTOM when that API key is configured. The result is stored on the listing.

Offer partners.A request is sent only when someone on the listing asks and the integration is configured. HomeLight's form collects name, email, phone, address, property type, timeline, condition, and a reason for selling. Homeward can receive the customer's name and email, an optional phone, the address and property facts, and the agent's name, email, and phone when an agent is on the listing. Other partner programs are emailed the property summary, the seller name and email, notes, and the agent's name, email, phone, and brokerage name if the agent entered one.

Signing in sets one cookie, named session. It is httpOnly, SameSite=Lax, limited to the site path, and kept for 30 days. The value is signed with HMAC-SHA256. It carries the account id and an expiry time. If an administrator is viewing as that account, it also carries the administrator's account id. In production the cookie is marked Secure, so the browser sends it only over HTTPS. Local development and tests leave Secure off so a session still works over plain http. Signing out clears that cookie with the same flags. Theme choice is stored in the browser's local storage under the key theme, not in a cookie.

Starting or stopping view-as writes a warning to the server log that includes both email addresses. That log is not a database audit table.

This codebase does not include a third-party analytics script, pixel, or analytics SDK. Separately, when a recipient opens a shareable offer report, the product records a view count and the first and latest open times, and emails the sending agent the first time it is opened. That counter is first-party and is part of the Pro agent subscription.

Records stay in the application database until someone with database access removes them. The product does not offer a self-serve download or delete control. Withdrawing an open traditional-listing request deletes that lead record. Canceling a subscription in Stripe stops renewal. It does not, by itself, delete the account, the listings, or the messages.

To ask about your information, email hello@homeoffersplus.com. This draft does not promise a particular response time or a particular outcome.

The product is for adults dealing with real estate. Signup does not ask for a date of birth. It is not meant for children, and the code has no children's account. This sentence is a description of the product, not a claim about any statute.

A finished notice should say when it was updated. This copy is a draft dated October 30, 2026 and is not in effect. The terms and disclaimer are drafts as well.