REWEALTH REPORTS, LLC — PRIVACY POLICY

This Privacy Policy explains how REWealth Reports, LLC (“REWealth,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in connection with our web application and related services (the “Services”).

Who we serve: We provide the Services to financial professionals (e.g., RIAs/BDs/advisors/CPAs). We are not a consumer platform.

1) Scope and Roles (Controller vs. Service Provider)

For personal information we collect from our business customers and their users (e.g., advisor account and billing data), REWealth acts as a business/controller.

For personal information that customers upload or input about their own clients (e.g., property/tax documents, financial assumptions), REWealth acts as a service provider/processor (including as a GLBA service provider and under SEC Regulation S-P where applicable) and processes such data only to provide the Services and per our agreement with the customer. Customers are responsible for providing any required notices and obtaining authority/consents to share their clients’ information with us.

Our Services are intended for use in the United States.

2) Categories of Personal Information & Sources

Information you provide directly

• Account & professional info: name, business email, phone, company/firm, role, preferences.
• Content & uploads: documents, images, spreadsheets, and data you or your users upload/input (e.g., property details, rent rolls, tax schedules, closing disclosures).
• Support & communications: messages, tickets, feedback, and survey responses.

Information collected automatically

• Usage & device data: log files (timestamps, feature use, referrer), IP address, browser/OS, device identifiers.
• Cookies/SDKs: see Section 7.

Information from third parties

• Vendors/service providers (hosting, analytics, email delivery, error monitoring).
• Public or licensed sources (e.g., market, mapping, and economic data used in analyses).

We may create aggregated, de-identified, or anonymized data for analytics, security, and product improvement. We do not attempt to re-identify such data.

3) How We Use Personal Information

We use personal information to:

• Provide and operate the Services (account creation, authentication, processing your inputs, generating outputs).
• Maintain, secure, and improve the Services (troubleshooting, analytics, testing, research).
• Communicate with you (service notices, updates, security alerts, support, billing).
• Personalize your experience (settings, saved preferences).
• Comply with law and enforce our agreements and policies.
• Market our Services to business contacts (opt-out anytime).

When acting as a service provider/processor, we process personal information only on your documented instructions and not for our own independent purposes.

4) U.S. Focus & International Visitors

Our Services are intended for the United States. If you access from outside the U.S., you understand your information will be transferred to, stored, and processed in the U.S., where laws may differ from those of your country.

5) Ephemeral Document Uploads (Tax Returns, Closing Disclosures)

Users may upload sensitive financial or tax documents, such as tax returns and closing disclosures. We use those files to extract structured information needed to provide the Services. Original source files are stored subject to automated lifecycle controls configured to expire them shortly after upload. Actual deletion timing may vary because cloud-provider expiration and deletion processes are asynchronous, or because retention is required for legal, security, fraud-prevention, or recovery purposes. We may retain derived structured data, such as parsed figures and fields, as described in Section 8.

6) How We Share Personal Information

We do not sell personal information and we do not “share” personal information for cross-context behavioral advertising.

We share personal information as follows:

• Service providers/subprocessors: Vendors that host, support, analyze, or secure the Services (e.g., cloud hosting, email delivery, analytics, support). They may access personal information only to perform services for us and must protect it and not use it for their own purposes.
• Business transfers: In a merger, acquisition, financing, or sale of assets, personal information may be transferred subject to confidentiality.
• Legal & safety: To comply with law, legal process, or valid government requests; to enforce our agreements; or to protect rights, safety, and security of REWealth, our users, or others.
• At your direction: If you request or authorize sharing (e.g., exporting a report).

We may publish aggregated or de-identified analytics that do not identify individuals.

6A) Connections to ChatGPT, Claude and Other AI Providers

When you connect REWealth to an external AI provider through our Model Context Protocol (MCP) connector, you authorize sharing within the permissions shown during OAuth consent. Requested tool results and interactive dashboards may include household and property names, property details, saved financial projections, plans, sales, Scenarios, rental comparisons and related analysis. Structured household tax information is shared only when the required tax access is authorized. The connector does not provide raw uploaded tax-return files or authentication secrets in tool results.

If identity permission is requested and approved, we share your signed-in account identifier with the provider. If email permission is also approved, we share your current account email and verification status through an authenticated identity endpoint to support organizational access controls. These permissions do not grant access to another firm's records. Account membership and connection permissions remain subject to access checks.

The recipient is the AI provider you choose, such as OpenAI for ChatGPT or Anthropic for Claude. Its terms, privacy practices and your organization's settings govern the information it receives and retains. You are responsible for having authority to share client information with that provider. Displaying images or maps may also send network requests, including IP addresses and request metadata such as the map area, to the relevant image or mapping service. Dashboard resources currently include REWealth-hosted images, Zillow or Redfin image hosts and OpenStreetMap tiles.

REWealth processes connection requests, permission grants and security records to operate and protect the connection, subject to the retention practices in Section 8. Revoking a connection prevents future authorized access; it does not remove information already shared into provider conversations or other retained results. Use the provider's controls for its retained information and contact REWealth for help with connection access. See our connector setup and usage guide.

7) Cookies & Tracking Technologies

We use:

• Essential cookies for login, security, and core functionality.
• Analytics/performance cookies to understand usage and improve the product.

Your choices:

• Manage cookies in your browser settings and (where offered) our cookie banner/preferences.
• We honor applicable Global Privacy Control (GPC) signals for CPRA opt-outs (if/when relevant).
• You can opt out of marketing emails via unsubscribe links.

We do not currently use advertising cookies for cross-context behavioral advertising.

8) Data Retention

We retain personal information for as long as reasonably necessary to provide, operate, secure, support, and administer the Services; maintain appropriate business and financial records; comply with legal, tax, accounting, and regulatory obligations; prevent fraud and misuse; resolve disputes; and enforce our agreements. Retention periods vary depending on the type of information, the system in which it is stored, and applicable business, security, and legal requirements.

When information is no longer reasonably needed, we take reasonable steps to delete, aggregate, or de-identify it, subject to technical limitations and applicable legal and operational requirements. Information removed from active systems may remain for longer periods in backups, logs, archives, snapshots, and recovery copies. We may retain information longer when required or permitted by law, subject to a legal hold, needed for security or fraud prevention, or necessary to establish, exercise, or defend legal claims. We may retain aggregated or de-identified information that does not reasonably identify an individual.

9) Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect personal information (including encryption in transit, role-based access, and audit logging). However, no method of transmission or storage is 100% secure.

If we become aware of a data breach affecting your data, we will notify customers without undue delay and cooperate consistent with our agreements and applicable law.

10) Your Privacy Rights & Choices (U.S. State Laws)

Depending on your state, you may have rights to access, correct, delete, and obtain a portable copy of certain personal information, and to opt out of:

• “Sale” or “Share” of personal information (as defined by CPRA).
• Targeted advertising / cross-context behavioral advertising.
• Profiling for decisions that produce legal or similarly significant effects (not applicable to our Services).

How to exercise: Email legal@rewealth.io or use our web form. We will verify your request and respond within applicable timelines. You may designate an authorized agent (with proof). We will not discriminate against you for exercising rights. If we deny a request, you may appeal by replying to our decision; we will explain our reasoning.

California (CPRA) disclosures:

• We do not sell personal information.
• We do not “share” personal information for cross-context behavioral advertising.
• We do not use or disclose sensitive personal information for purposes requiring a “Limit the Use” link under CPRA.
• For advisor-provided client data, we act as a service provider and do not sell or share such data or use it beyond providing the Services.

GLBA note: Certain financial information processed for regulated customers may be subject to the Gramm-Leach-Bliley Act (GLBA); to the extent information is subject to GLBA, certain state privacy rights may not apply to that data.

11) Service Provider / Processor Commitments

• We process personal information only to provide the Services and per the customer’s instructions and agreement.
• We require equivalent privacy and security protections from our subprocessors.
• We will assist the customer, where feasible, with reasonable privacy or security requests (e.g., deletion) that the customer is obligated to fulfill for its end clients.
• Upon termination, we will delete or return personal information per our agreement and the retention policy in Section 8.

12) Subprocessors

We use reputable vendors to host and support the Services. We impose contractual obligations requiring them to protect personal information and to use it only to provide services to us. A current list of material subprocessors is available upon request at legal@rewealth.io.

13) Third-Party Websites and Services

The Services may link to third-party websites or services we do not control. Their privacy practices govern their sites; we are not responsible for them.

14) Changes to this Policy

We may update this Policy from time to time. If changes are material, we will notify you by reasonable means (e.g., in-app notice or email). The “Last Updated” date shows the latest revision.

15) Contact Us

REWealth Reports, LLC
Privacy: legal@rewealth.io