Privacy Policy

Last updated: July 9, 2026

1. Who We Are and What This Policy Covers

This Privacy Policy is issued by ClosingStart ("ClosingStart," "we," "us") and covers personal information processed through closingstart.com and related services (the "Service"). It applies to consumers (home buyers and sellers), real estate agents, service providers, and visitors. It does not cover the practices of service providers you choose to engage, your real estate agent or brokerage, or other third parties — their own privacy policies apply to them.

A note on transaction documents: real estate purchase contracts inherently contain personal information about multiple people (buyer, seller, agents). When an agent or consumer uploads a contract, we receive information about people who may not have ClosingStart accounts. Section 4 explains how we protect those people, and Section 9 explains their rights.

2. Information We Collect

Information you (or your agent) provide

• Account information: name, email address, and — if you sign in with Google — the profile information Google shares with us (name, email, profile photo). We do not receive your Google password.
• Agent professional information: brokerage, Tennessee real estate license number, and verification status.
• Provider business information: company legal name, category, licensing and registration numbers (e.g., NMLS ID, state licenses), disclosure texts, pricing/quote data, affiliation attestations, and billing contact details.
• Transaction documents and data: uploaded purchase contracts and the data extracted from them — including property address, purchase price, closing date, earnest money, financing terms, contingency deadlines, and the names and details of transaction parties appearing in the contract.
• Quotes and selections: provider quotes on your transaction, your comparison activity within the Service, and your Reveal decisions (Section 4).
• Communications: messages you send us and notification preferences.

A note on credential data accuracy: licensing, registration, and brokerage information about agents and providers is self-reported by those parties. We apply reasonable screening steps (format checks, required attestations, admin review), but we do not independently verify it and do not guarantee its accuracy. Before engaging any party, verify their licensing directly with the issuing authority — for Tennessee, the Tennessee Real Estate Commission (real estate licensees) and the Tennessee Department of Commerce & Insurance (most provider categories), both searchable at verify.tn.gov. See Terms of Service Section 10 ("License and Credential Information").

Information collected automatically

• Usage data: pages viewed, features used, comparison views, and timestamps.
• Device and log data: IP address, browser type, operating system, and access logs.
• Cookies and similar technologies: see Section 10. We use essential cookies only — no third-party advertising trackers.

Information from third parties

• Google sign-in (if you use it), as described above.
• License verification sources, which we may consult to screen agent and provider licensing information.

We do not knowingly collect Social Security numbers, full bank account numbers, or credit reports, and users should not upload them. If a document containing such data is uploaded, we treat it as confidential transaction data under this policy.

3. How We Use Information

We use personal information to:

• Provide the Service: process contracts, generate ClosingStart Disclosures (estimated closing-cost documents), build side-by-side provider comparisons, and track transaction deadlines;
• Run the blind-quote system: give providers enough transaction detail to quote (see Section 4) without exposing your identity;
• Deliver communications: transactional email — quote notifications, deadline reminders, sign-in links (72-hour magic links), and service announcements;
• Operate provider billing and neutrality controls: meter provider presentations for flat-subscription billing, and maintain the audit records that prove payment never affects ranking (billing data is architecturally firewalled from presentation logic);
• Maintain required compliance records: provider disclosure attestations and affiliated-business attestations, which are retained as append-only records;
• Secure and improve the Service: detect fraud and abuse, debug, and analyze aggregate usage;
• Comply with law and enforce our Terms of Service.

We do not use your personal information for third-party advertising, profiling for marketing purposes, or automated decisions with legal effects. We do not use your transaction data to train third-party AI models.

4. The Privacy Moat: Blind Quotes and the Reveal

This is the core privacy design of the platform:

1. Providers quote blind. When your transaction enters a comparison, providers receive only the non-identifying details needed to price their service (for example: county, purchase price, loan amount and financing type, property type, closing timeline). They do not receive your name, street address, email, or phone number.
2. No contact without a Reveal. No provider may contact you, directly or indirectly, unless you affirmatively choose to reveal your contact information to that specific provider through the Service. Your Reveal decision is recorded (which provider, when, and for which transaction).
3. Reveals are narrow. A Reveal covers only the provider(s) you select and only the transaction at hand. Declining a provider shares nothing with them.
4. Enforcement. A provider that attempts to identify or contact a consumer without a Reveal materially breaches our Terms and is removed from the platform.

5. How We Share Information

We share personal information only as follows — and we never sell it:

• With providers, only per the moat. Blind, non-identifying transaction details for quoting (Section 4); your contact information only after your Reveal to that provider.
• Within your transaction. Your agent sees the transactions they submitted; buyers and sellers see their own transaction documents and comparisons via secure links. Providers see anonymized presentation records (date, county, transaction reference) for billing verification — never consumer contact details without a Reveal.
• Service vendors (processors) who host and operate the Service under contracts limiting them to processing on our instructions:
  • Railway — application and database hosting;
  • Postmark — transactional email delivery;
  • Cloudflare R2 — document/file storage (uploaded contracts, generated PDFs);
  • Google — sign-in authentication (if you choose it);
  • other vendors we engage to operate the Service (such as payment processing and document-extraction services), under equivalent contractual limits.
• Legal and safety: when required by law, subpoena, or court order; to enforce our Terms; or to protect the rights, property, or safety of ClosingStart, our users, or the public. Where lawful and practicable, we will notify you of legal demands for your data.
• Corporate events: in a merger, acquisition, financing, or sale of assets, personal information may transfer as part of the transaction, subject to this policy's commitments; we will notify you of any such transfer.

What we never do: sell or rent personal information; sell leads; share consumer contact information with any provider without a Reveal; give providers data to market to you outside your transaction; or let any payment influence what you see.

6. Data Security

We take security seriously and apply measures appropriate to settlement-transaction data, including:

• Encryption in transit (TLS) for all connections, and encryption at rest for stored data;
• Access controls: role-based access, tokenized transaction links, and single-use magic links that expire after 72 hours;
• Server-side authorization checks on every transaction and document request;
• Logging and monitoring of administrative and billing changes (immutable audit logs);
• Vendor due diligence and data-processing agreements with subprocessors.

No system is perfectly secure; we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law, including Tennessee's data-breach notification statute (Tenn. Code Ann. § 47-18-2107).

7. Data Retention

We keep personal information only as long as reasonably necessary for the purposes above:

• Account data: for the life of your account, then deleted or anonymized within a reasonable period after account closure, except as noted below.
• Transaction documents and ClosingStart Disclosures: retained for as long as reasonably necessary after the transaction closes or is abandoned, consistent with real-estate and settlement record-keeping norms (client share links expire 90 days after closing).
• Compliance and audit records (provider disclosure attestations, affiliation attestations, billing/neutrality audit logs, Reveal records): retained for as long as reasonably necessary because they are the platform's regulatory evidence trail; these are append-only and are retained even after the related account closes.
• Email and server logs: retained for as long as reasonably necessary for security and operations.
• Backups: deleted data ages out of encrypted backups in the ordinary course.

8. Your Choices

• Email: transactional emails (quotes, deadlines, sign-in links) are part of the Service; you can turn off the optional digest and any marketing email via the unsubscribe link. We do not send third-party marketing.
• Google sign-in: you may use magic-link email sign-in instead of Google at any time.
• Reveals: entirely optional, per provider, and never required to view comparisons.
• Account closure: request at any time via the contact in Section 13.

9. Your Privacy Rights (Including Deletion)

Everyone, regardless of state: you may request (a) access to the personal information we hold about you, (b) correction of inaccurate information, (c) deletion of your personal information, and (d) a portable copy of information you provided. Submit requests to [email protected]; we will verify your identity (and, for agent requests on behalf of clients, authority) before acting, and respond within 45 days.

Limits on deletion: we may retain information where the law requires or permits — notably the append-only compliance records in Section 7, records needed for disputes or fraud prevention, and transaction documents another party to your transaction is entitled to retain. Where we cannot delete, we will tell you why.

If your information appears in someone else's upload: if you are a buyer or seller whose information was uploaded by an agent and you have no account, you may still exercise the rights above — contact us with enough detail to locate the transaction.

Tennessee residents: the Tennessee Information Protection Act (TIPA) grants Tennessee consumers rights of access, correction, deletion, portability, and opt-out of sale, targeted advertising, and certain profiling, subject to applicability thresholds. This policy extends the substantive rights above to all users regardless of those thresholds. We do not sell personal information and do not engage in targeted advertising, so there is no sale or targeted advertising to opt out of.

Other states: if another state's privacy law applies to you, we will honor the rights it provides.

No discrimination: we will not deny you the Service or degrade it because you exercised a privacy right.

Appeals: if we decline a request, you may appeal by replying to our decision, and we will review and respond. If you remain unsatisfied, you may contact the Tennessee Attorney General's office.

10. Cookies and Tracking

We use essential cookies only: session/authentication cookies to keep you signed in and security cookies (e.g., CSRF protection). We do not use third-party advertising cookies, cross-site trackers, or social-media pixels. Because we use only essential cookies, there is no cookie-consent banner to click and no tracking to opt out of; blocking cookies in your browser may prevent sign-in. Sign-in magic links contain single-use tokens that expire after 72 hours; treat those emails like a password.

We do not respond to browser "Do Not Track" signals because we do not track users across third-party sites.

11. Children's Privacy

The Service is for adults involved in real estate transactions. It is not directed to anyone under 18, and we do not knowingly collect personal information from children under 18 (and in no event from children under 13, per COPPA). If you believe a child has provided us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this policy. For material changes we will notify you by email and/or prominent notice in the Service at least 30 days before the changes take effect, and we will not weaken the Section 4 privacy-moat commitments or begin selling personal information by mere policy update — changes of that kind would require your fresh, affirmative consent. The "Last updated" date at the top reflects the current version.

13. Contact Us

Privacy questions, rights requests, and complaints:

ClosingStart
Email: [email protected]