PRIVACY POLICY

Last updated: August 27, 2026

ReliaHouse develops technology designed to help businesses and professionals manage real estate operations.

This Privacy Policy explains how personal information may be collected, used, processed, stored, and shared when an individual interacts with our websites, applications, products, features, or services.

This Policy should be read together with any specific privacy notice presented when information is collected.

1. Scope

This Policy may apply to information processed through:

• reliahouse.com;
• ReliaHouse applications;
• user accounts;
• forms;
• application links;
• screening tools;
• documentation tools;
• artificial intelligence features;
• communications with ReliaHouse;
• authorized integrations; and
• other features related to the Service.

ReliaHouse may make its services available to users in different jurisdictions.

Where local law imposes additional mandatory requirements, those requirements apply to the relevant processing activity.

2. Our Data Roles

ReliaHouse’s legal role depends on the context.

When ReliaHouse determines the purposes

ReliaHouse may act as a Controller, Responsible Party, or equivalent role when it determines why and how particular personal information is used.

This may include information relating to:

• ReliaHouse user accounts;
• Service administration;
• security;
• support;
• our own communications;
• billing;
• our own analytics; and
• direct commercial relationships.

When a customer uses ReliaHouse

A real estate company, agency, business, platform, or professional may use ReliaHouse to process information concerning its own prospects, customers, owners, tenants, or other individuals.

In these circumstances, the customer generally determines the purpose of the processing and may act as the Controller or equivalent role.

ReliaHouse may act as a Processor, Service Provider, Data Processor, or equivalent role and process information according to the customer’s lawful instructions.

If an individual is unsure who controls their information in a specific transaction, they may review the notice presented when their information was collected or contact the customer that initiated the process.

3. Information We May Collect

Depending on how the Service is used, we may process the following categories.

3.1 Account Information

This may include:

• first name;
• last name;
• email;
• phone number;
• organization;
• job title;
• country;
• authentication information; and
• account preferences.

3.2 Identity Information

Where required by a feature:

• full name;
• document type;
• document number;
• date of birth;
• document images;
• information contained in identity documents; and
• information necessary to support identity verification.

3.3 Prospect and Transaction Participant Information

This may include information supplied by or relating to:

• prospects;
• tenants;
• property owners;
• buyers;
• sellers;
• representatives;
• guarantors;
• co-debtors; and
• other participants in a transaction.

3.4 Financial and Economic Information

Where required by a feature and supported by an appropriate lawful basis, we may process:

• income information;
• employment or business activity;
• financial documents provided by the individual;
• statements or supporting documents voluntarily submitted;
• declared obligations; and
• other information necessary for the disclosed purpose.

ReliaHouse does not interpret this functionality as authorization to unlawfully access confidential financial information.

3.5 Property Information

This may include:

• property addresses;
• registry identifiers;
• photographs;
• characteristics;
• documents;
• ownership information;
• annotations;
• registry information; and
• other property-related data.

Property documents may contain personal information relating to owners or other individuals.

3.6 Agreements and Documents

We may process information contained in:

• agreements;
• forms;
• annexes;
• supporting records;
• uploaded documents;
• generated documents; and
• transaction-related records.

3.7 Technical Information

This may include:

• IP address;
• browser;
• operating system;
• device type;
• technical identifiers;
• session information;
• security events;
• activity logs;
• errors; and
• information required to operate and secure the Service.

3.8 Communications

We may process information provided through:

• support;
• forms;
• email;
• WhatsApp;
• demos;
• sales inquiries; and
• other enabled communication channels.

3.9 Integrations

When a user voluntarily connects an external service, we may process information necessary to operate the integration within the permissions granted.

4. Sources of Information

We may receive information:

• directly from the individual;
• from a customer using ReliaHouse;
• from the organization for which a user works;
• from submitted documents;
• from authorized integrations;
• from contracted providers;
• from public or lawfully accessible sources; and
• from technical systems used to operate the Service.

The fact that information is publicly accessible does not automatically mean that every subsequent use is lawful. Processing remains subject to applicable law.

5. Sensitive Information

Some features may involve information considered sensitive under applicable law.

ReliaHouse seeks to limit sensitive data processing to information reasonably necessary for a legitimate purpose.

Where law requires explicit consent or other special conditions, the applicable Controller must satisfy those requirements before processing.

Users should not submit sensitive information that is unnecessary for the purpose of a transaction.

6. Children

ReliaHouse is not designed for minors to create business accounts.

We do not seek to intentionally collect information concerning children unless it is necessary for a legitimate purpose and permitted by applicable law.

Where children’s information is processed, the applicable Controller must apply any special protections required by law.

7. How We Use Information

Depending on the context, information may be used to:

• create and administer accounts;
• authenticate users;
• provide the Service;
• receive and organize applications;
• verify documentation;
• support identity verification;
• support property screening;
• support prospect analysis;
• generate documents;
• manage agreements;
• maintain traceability;
• track statuses and deadlines;
• send transactional communications;
• provide support;
• prevent fraud;
• maintain security;
• diagnose errors;
• technically improve the Service;
• manage business relationships;
• process billing;
• generate statistics;
• comply with legal obligations;
• respond to valid governmental requests;
• exercise or defend legal rights; and
• carry out other purposes disclosed before processing occurs.

8. Lawful Basis

The lawful basis for processing depends on the jurisdiction and context.

We may process information where, as applicable:

• valid consent or authorization exists;
• processing is necessary to provide a requested service;
• a contractual relationship exists;
• processing is necessary to comply with law;
• a legitimate interest recognized by applicable law exists;
• the nature of the information permits the relevant processing; or
• another lawful basis is available.

Where prior authorization is required, mechanisms may be used to preserve evidence of that authorization where legally required.

This Policy does not replace specific consent or authorization where one is legally required.

9. Information Processed for Customers

Where a business customer uses ReliaHouse to collect or manage third-party information, that customer is responsible for:

• determining a legitimate purpose;
• providing required notices;
• obtaining required authorization;
• honoring individual rights;
• issuing lawful instructions; and
• using information in compliance with applicable law.

Where ReliaHouse acts as a Processor or equivalent service provider, we will process information in accordance with the customer’s lawful instructions and applicable agreements.

We do not intend to use such information for our own incompatible purposes.

10. Artificial Intelligence

ReliaHouse may use artificial intelligence, language models, machine learning, automated extraction, or similar technologies to:

• extract information from documents;
• organize data;
• identify inconsistencies;
• generate summaries;
• generate explanations;
• create documents;
• support screening;
• generate alerts; and
• facilitate other Service functions.

AI systems may produce errors.

Where output may materially affect an individual, users should perform reasonable human review before making a decision.

ReliaHouse may use third-party AI providers to process information required for a feature.

We seek to limit information transmitted to what is reasonably necessary to provide the Service.

Unless expressly disclosed otherwise and supported by an appropriate lawful basis, ReliaHouse does not intend to use Customer Data to train general-purpose models for purposes unrelated to providing the Service.

11. Decisions Concerning Prospects

ReliaHouse provides decision-support tools and does not intend to independently replace the final judgment of the real estate company, agency, business, or professional responsible for an operation.

Final decisions concerning whether to:

• approve;
• reject;
• engage;
• rent;
• sell;
• purchase;
• proceed with an operation; or
• impose particular terms

remain with the user responsible for the operation.

Users must review results and comply with applicable rules concerning discrimination, privacy, and automated decision-making.

12. How We May Share Information

We may share information only where reasonably necessary for the purposes described in this Policy.

This may include:

Technology Providers

We may use providers supporting:

• infrastructure;
• hosting;
• databases;
• storage;
• authentication;
• email;
• messaging;
• analytics;
• support;
• document processing;
• artificial intelligence;
• identity verification;
• security; and
• integrations.

Customer Responsible for the Transaction

Where an individual provides information through a process initiated by a real estate company, business, or professional, that information may be made available to that customer.

Authorized Integrations

When a user enables an integration, we may transmit information required to operate that integration.

Authorities

We may disclose information where legally required by a competent authority, court order, or valid legal process.

Corporate Transactions

If ReliaHouse is involved in a future reorganization, financing, investment, acquisition, merger, or asset transfer, certain information may be shared subject to appropriate confidentiality and data protection obligations where permitted by law.

13. We Do Not Sell Personal Databases

ReliaHouse does not operate a business model based on selling databases containing personal information about prospects, customers, or users.

Using technology vendors to provide the Service does not by itself constitute a sale of information.

14. International Processing

ReliaHouse uses digital infrastructure and may engage providers located in different countries.

Information may therefore be stored or processed outside the country where the individual is located.

Where applicable law imposes requirements relating to international transfers, transmissions, or other cross-border data flows, we will apply or require the appropriate legal mechanisms.

15. Cookies and Similar Technologies

Our websites may use:

• essential cookies;
• local storage;
• technical identifiers; and
• analytics or measurement tools.

These technologies may be used to:

• maintain sessions;
• remember preferences;
• secure the Service;
• diagnose errors;
• understand website performance; and
• improve the experience.

Non-essential technologies will be subject to notice or consent mechanisms where legally required.

The analytics tools used by ReliaHouse may change over time. Use of a specific tool does not grant its provider unlimited rights to our data.

16. Marketing Communications

We may send information concerning products, features, or updates where an appropriate lawful basis exists.

Individuals may opt out of promotional communications through available mechanisms.

Communications necessary for:

• security;
• account operation;
• support;
• transactions;
• contractual obligations; or
• material Service changes

may continue where necessary.

17. Security

ReliaHouse applies reasonable technical, administrative, and organizational measures taking into consideration:

• the nature of the information;
• the context of processing;
• risk;
• the state of technology; and
• reasonably available resources.

No method of electronic transmission or storage can guarantee absolute security.

Nothing in this Policy represents that ReliaHouse holds particular certifications, independent audits, security standards, or specific controls unless they have actually been implemented and can be substantiated.

18. Security Incidents

If we identify an incident affecting personal information, we may:

• investigate the incident;
• restrict access;
• take containment measures;
• remediate vulnerabilities;
• cooperate with affected customers; and
• provide notices required by applicable law.

19. Retention

We retain information only for as long as reasonably necessary to:

• provide the Service;
• maintain an account;
• fulfill the disclosed purpose;
• perform contracts;
• comply with legal obligations;
• resolve disputes;
• prevent fraud; or
• protect legitimate rights.

When information is no longer required, it may be deleted or anonymized.

Backup copies may remain temporarily according to reasonable technical cycles and will remain subject to access restrictions until deletion or overwrite.

20. Account Deletion

Where available, a user may request to close an account.

Closing an account does not necessarily result in immediate deletion of all information.

Certain information may be retained for:

• legal;
• contractual;
• security;
• fraud prevention;
• backup; or
• legal defense purposes.

Where ReliaHouse acts solely as a Processor, certain requests may need to be directed to the customer acting as Controller.

21. Privacy Rights

Depending on applicable law, an individual may have rights relating to:

• access;
• knowledge;
• correction;
• updating;
• deletion;
• objection;
• restriction;
• portability;
• withdrawal of consent; or
• information concerning processing.

The availability and scope of each right depend on the relevant jurisdiction.

Requests may be submitted through the channel identified at the end of this Policy.

We may request information reasonably necessary to verify the identity of the requester.

22. Requests Concerning a ReliaHouse Customer

Where a real estate company, business, or professional collected the information and ReliaHouse acts solely as Processor, we may:

• forward the request to the responsible customer;
• inform the individual who should address the request; or
• assist the customer with the request.

23. Changes to This Policy

We may update this Policy due to changes in:

• law or regulation;
• technology;
• operations;
• products; or
• our business.

Where a change is material, we will use reasonable means to provide notice where required by law.

The updated date will appear at the beginning.

COLOMBIA-SPECIFIC PRIVACY TERMS

The following terms apply where personal data processing is subject to the laws of the Republic of Colombia.

24. Colombian Framework

Processing will be carried out in accordance with mandatory Colombian privacy law, including Law 1581 of 2012, its implementing regulations, and applicable instructions issued by the Superintendence of Industry and Commerce.

Where artificial intelligence systems process personal data, ReliaHouse and the applicable Controllers must take into account the legal obligations and regulatory guidance applicable to such processing.

25. Principles

Where Colombian law applies, personal data should be processed in accordance with applicable principles, including:

• legality;
• purpose limitation;
• freedom;
• truthfulness or quality;
• transparency;
• restricted access and circulation;
• security; and
• confidentiality.

26. Authorization

Where Colombian law requires authorization, the applicable Controller must obtain prior and informed authorization and preserve evidence of it.

When authorization is requested, the individual should be informed, as applicable, of:

• the data to be processed;
• the purposes;
• the rights of the Data Subject;
• the identity and contact channels of the Controller; and
• the voluntary nature of answering questions involving sensitive data or children’s data where applicable.

27. Sensitive Data in Colombia

Where information qualifies as sensitive data under Colombian law:

• the sensitive nature of the data will be disclosed;
• the Data Subject will be informed that authorization is voluntary where applicable;
• the purpose will be explained; and
• explicit authorization will be obtained where legally required.

28. Data Subject Rights in Colombia

Subject to applicable law, Data Subjects may:

• know, update, and rectify their personal information;
• request evidence of authorization where applicable;
• request information concerning how their data has been used;
• submit inquiries and claims;
• obtain free access to personal data in circumstances provided by law;
• request deletion where legally available;
• withdraw authorization where legally available; and
• file a complaint with the Superintendence of Industry and Commerce after satisfying applicable procedural requirements.

29. Inquiries

Inquiries relating to personal information subject to Colombian law will be answered within the legally required period.

At present, Law 1581 provides a maximum period of ten (10) business days from receipt.

Where an inquiry cannot be answered within that period, the reason for the delay and the expected response date will be communicated, subject to the additional period permitted by law.

30. Claims

Requests for correction, updating, deletion, or claims concerning an alleged violation will be handled in accordance with the procedure established by applicable law.

At present, Law 1581 provides a maximum period of fifteen (15) business days from the day following receipt of a complete claim, subject to the legally permitted extension where required.

31. Controller and Processor Roles

Where a Colombian business uses ReliaHouse to process information concerning its own prospects or customers, that business may act as Controller and ReliaHouse as Processor.

The applicable roles depend on which party determines the relevant purposes and means of processing.

Where ReliaHouse determines an independent purpose, it may act as Controller for that particular processing activity.

32. International Transfers and Transmissions

Where personal data subject to Colombian law is transferred or transmitted internationally, applicable mandatory rules will apply.

Where ReliaHouse acts as Processor for a customer, additional obligations may be established through a Data Processing Agreement.

33. Supervisory Authority

The Colombian authority responsible for personal data protection is the:

Superintendencia de Industria y Comercio — SIC

Complaints before the authority remain subject to any procedural prerequisites required under Colombian law.

34. Privacy Function

ReliaHouse will designate a person or function responsible for receiving privacy-related requests and coordinating with applicable Controllers.

Email: contacto@reliahouse.com Website: reliahouse.com