Privacy Policy

ohACCESS, LLC ("ohACCESS," "we," "us," or "our"), a Texas limited liability company, operates ohaccess.com and provides a QR-code-based open house visitor verification platform. This Privacy Policy explains how we collect, use, share, and protect personal information from three distinct groups of people:

• Open House Visitors — individuals who register at an open house through an ohACCESS-powered form
• Subscribers — real estate agents, teams, and brokerages who hold an ohACCESS account
• Website Visitors – individuals using our website (ohaccess.com) that are not Open House Visitors or Subscribers.

Sections that apply specifically to one group are clearly labeled. Where a section is unlabeled, it applies to both Open House Visitors and Subscribers, except for Sections 5-13 that apply to all three groups. By using ohACCESS in either capacity, you agree to the practices described here.

For most data covered by this Policy, ohACCESS is the "controller" (or "business" under the CCPA) — meaning we determine why and how the data is processed. This includes data about Subscribers and Open House Visitors, themselves, and usage data and technical information about the Service.

For Visitor data collected through a Subscriber's open house registrations, ohACCESS acts as a "processor" (or "service provider") on behalf of the Subscriber, who is the controller of that data. The Subscriber is primarily responsible for honoring Visitor data subject requests; ohACCESS will reasonably assist as described in our Subscriber Terms of Service.

From Open House Visitors (collectively, “Visitor Data”):

• Full name
• Email address
• Phone number
• Purchasing timeline preference
• Date, time, and property address of the open house attended
• Device type and browser information (collected automatically)
• IP address (collected automatically)
• Automatically-collected usage data and technical information related to your session and usage data, date and time of access to the website, device type and operating system, internet service provider, browser type and version, and internet protocol address

From Subscribers (real estate agents, teams, and brokerages) (collectively “Subscriber Data”):

• Account identity: full name, email address, phone number, password (stored hashed)
• Profile information: brokerage name, license number, profile photo, business logo, branding colors, contact details displayed to Visitors
• Open house listing details (address, dates, hours, price, property attributes)
• Team/brokerage relationships (if applicable): brokerage you belong to, role within that brokerage, agents on your roster
• Billing and payment information: card last-4, billing address, subscription plan, payment history (full card numbers are handled exclusively by Stripe and never touch ohACCESS servers)
• Communications you send through the Service: SMS and email content generated for Visitors, plus delivery status from Twilio and Resend
• Usage data: pages viewed, features used, open houses created, visitors verified, login timestamps, IP address, device type, browser information
• Support correspondence: any messages you send to support@ohaccess.com or legal@ohaccess.com
• Automatically-collected usage data and technical information related to your session and usage data, date and time of access to the website, device type and operating system, internet service provider, browser type and version, and internet protocol address

From Website Visitors

• Automatically-collected usage data and technical information related to your session and usage data, date and time of access to the website, device type and operating system, internet service provider, browser type and version, and internet protocol address

For Open House Visitors, we use Visitor Data to:

• Deliver your access code via SMS and email
• Verify your identity at the open house entrance
• Provide the hosting Agent with your contact information and purchasing timeline for follow-up
• Share your information with authorized third-party business partners with your consent as described in Section 4
• Maintain records of open house attendance
• Improve the ohACCESS platform and user experience
• Comply with legal obligations

For Subscribers, we use Subscriber Data to:

• Provide, operate, and maintain the Service
• Authenticate you and secure your account
• Process subscription payments and send billing notices
• Generate Visitor-facing emails and SMS messages using your brand assets and contact info
• Send service notifications, security alerts, and product updates
• Provide customer support and respond to inquiries
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Subscriber Terms
• Generate aggregate, anonymized analytics about platform usage for marketing and improving user experience
• Comply with legal, tax, and regulatory obligations

For Website Visitors, we use your information to:

• Improve website performance
• Remember user preferences
• Improve user experience

If you are a Subscriber and you join (or are added to) a Team or Brokerage account, the brokerage administrator(s) of that account will have visibility into your activity within the Service, including: the open houses you create, the Visitors who register at your open houses, your branding assets (which may be overridden by brokerage-level branding), and your account status (active, invited, suspended).

Brokerage administrators do not have access to: your password or authentication credentials, your private support correspondence with ohACCESS, your personal billing details (if you have an individual Subscription that predates joining the brokerage), or activity outside the Service.

If your brokerage account is closed or you are removed from the brokerage, you will be notified by email, your individual account will be preserved, and you will be prompted to select a personal Subscription plan to continue using the Service.

ohACCESS shares Visitor Data with the following categories of third parties:

Hosting Agents and Brokerages: The real estate agent and their affiliated brokerage receive your full registration record including name, email, phone, purchasing timeline, and timestamp.

Authorized Business Partners: With your express written consent provided when you select the box to share your information with our third-party business partners, ohACCESS may share your contact information and purchasing intent data with authorized third-party business partners including mortgage lenders, title companies, real estate attorneys, home inspectors, moving companies, home warranty providers, homeowner's insurance providers, and other real estate transaction service providers. These partners may contact you independently regarding their products and services. We do not control the means and methods in which third parties contact you. While ohACCESS will process your opt-out requests for future sharing with third parties pursuant to Section 5 of the Visitor Terms, you should notify any third party directly if you wish to no longer be contacted by them.

Service Providers (Sub-processors): ohACCESS uses the following service providers who process data on our behalf. Each is bound by data protection terms substantially similar to those in this Policy:

• Supabase, Inc. — Secure database storage and authentication
• Twilio Inc. — SMS delivery
• Resend, Inc. — Email delivery
• Stripe, Inc. — Payment processing (Stripe is responsible for the security of full payment card data)
• Vercel, Inc. — Platform hosting
• Google LLC (Maps Platform) — Address autocomplete and geocoding for Subscriber listing entry

We will provide notice of any new sub-processor that materially processes personal data.

Legal Requirements: We may disclose your information if required by law, court order, or governmental authority.

We do not sell your personal information to data brokers or unaffiliated third parties for their independent marketing purposes. All third-party sharing is limited to authorized business partners in the real estate transaction ecosystem as described above and consented to through the registration form.

We retain visitor registration data for up to 3 years from the date of collection, or until the hosting Agent deletes their ohACCESS account, whichever comes first. After this period, data is permanently deleted from our systems.

Agent account data is retained for the duration of the account and for up to 2 years following account closure for legal and compliance purposes. If any subscriber wishes to retain a copy of their data, they should request a copy prior to such deletion timeline either through your account dashboard or by emailing privacy@ohaccess.com.

You may request deletion of your data at any time by contacting privacy@ohaccess.com. We will process deletion requests within 30 days, subject to any legal obligations to retain certain records.

Depending on your state of residence, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request an export of your data in a structured, machine-readable format
• Opt-out of third-party sharing: Email privacy@ohaccess.com with subject "Opt Out of Third-Party Sharing"
• Opt-out of marketing communications: See opt-out instructions in the Visitor Terms of Service
• Limit the use of your information: Request we only use your data as necessary to provide our service
• Complaint: Lodge a complaint with your state's consumer protection authority

To exercise any of these rights, contact us at privacy@ohaccess.com. We will respond within 30 days.

Subscribers can additionally exercise most of these rights directly through their account dashboard (data export via CSV, profile updates, account closure). For Visitor data held in your Subscriber account, you are the controller and must process Visitor requests directly; ohACCESS will assist upon written request.

7.1 California (CCPA / CPRA). If you are a California resident, you have the right to know what personal information we collect, use, disclose, and "sell" or "share" (as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act); to delete your personal information; to correct inaccurate information; to limit the use of sensitive personal information; and to opt out of the sale or sharing of your personal information. ohACCESS does not sell personal information to data brokers; however, our forward-looking authorization in Section 5 of the Visitor Terms to share data with authorized business partners may, if activated, constitute a "sale" or "share" under California law. To opt out, email privacy@ohaccess.com with subject "California Opt Out" and we will respond within fifteen (15) days unless a longer period is permitted by law.

7.2 Texas (TDPSA). If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (effective July 1, 2024), including the rights to confirm processing, access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling. To exercise these rights, email privacy@ohaccess.com with subject "Texas Privacy Request."

7.3 Other US States. Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), Iowa (ICDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Tennessee (TIPA), Indiana (ICDPA), Minnesota (MCDPA), Maryland (MODPA), Nebraska (NDPA), Kentucky (KCDPA), Rhode Island (RIDTPPA), and other states with comprehensive privacy laws may have substantially similar rights. To exercise rights under your state's law, email privacy@ohaccess.com with the subject line "[State] Privacy Request." We respond within thirty (30) days (or up to forty-five (45) days where additional time is permitted by the applicable law).

7.4 Non-Discrimination. We will not discriminate against you for exercising any privacy right.

7.5 Authorized Agents. You may designate an authorized agent to submit a request on your behalf. We may require verification of your identity and the agent's authority.

7.6 Appeals. If we decline a privacy request, depending on your jurisdiction, you may have a right to appeal to our decision by replying to our response with the subject line "Appeal." We will review and respond within forty-five (45) to sixty (60) days, depending on your state of residence. If your appeal is denied, you may contact your state attorney general.

For any privacy-related questions, opt-out requests, data deletion requests, or to exercise your privacy rights: