Broad Table, Inc. Privacy Policy

Italicized summaries in this Privacy Policy are provided for convenience and readability only. They are not operative statements of our practices, and the full text of each section controls.

This Privacy Policy explains how Broad Table, Inc. (“Broad Table,” “we,” “us,” or “our”) collects, uses, discloses, stores, and otherwise processes personal information when you visit getclosivo.com, create or use an account, access or use any software product, application, module, website, API, interface, or related service marketed under the Closivo brand, connect integrations, communicate with us, or otherwise interact with Closivo-branded offerings (collectively, the “Closivo Platform” or the “Platform”). It also describes choices and rights that may be available to you. Broad Table is a Delaware corporation with a principal office at 790 Florida St, Ste 3, Mandeville, LA 70448, and can be contacted at legal@broadtable.co.

The Closivo brand is a family of software products and services. The first Closivo application currently offered is a real estate commission and brokerage financial workflow application. Broad Table may now or in the future offer additional Closivo applications, modules, features, or services under the Closivo name or under a separate product name, descriptor, or sub-brand. This Privacy Policy applies generally across the Closivo Platform unless we provide a separate privacy notice, in-product disclosure, or supplemental policy for a particular Closivo Service.

This Privacy Policy is not intended for use outside of the United States. However, if personal information is transferred from outside the United States, the “International data transfers” section below applies. If a separate privacy notice, data processing addendum, or written agreement applies to specific data or services, that separate notice or agreement will control to the extent of any conflict.

The Closivo platform

Closivo is a branded family of products, not just a single app. Closivo is a branded software platform under which Broad Table offers multiple current or future applications, features, modules, and services that combine direct user input, synchronization, and system data to support various financial and operational workflows.

Closivo is a branded software platform under which Broad Table may offer multiple current or future applications, features, modules, and services. These offerings may serve different industries, workflows, or operational use cases. The first Closivo application currently offered helps real estate brokerages manage Deal workflows, commission calculations, payout operations, accounting synchronization, and related automation. Additional Closivo applications may be developed and marketed under the same Closivo brand, including with separate product names, descriptors, or sub-branding.

Because Closivo may include multiple products, the categories of personal information we collect and the ways we use that information may vary depending on which Closivo Service you use, how your organization configures it, and which features, integrations, or workflows are enabled. To provide functions, we may receive information directly from users, from administrators, from connected systems, and from background platform activity.

The Closivo Platform and your personal information

We may process information at the brand level and at the individual product level. Depending on the context, we may process personal information for our own business purposes or on behalf of a customer.

Depending on the context, Broad Table may process personal information:

• to operate and administer the Closivo brand and shared platform infrastructure;
• to provide one or more specific Closivo applications or sub-branded services;
• to manage accounts, workspaces, subscriptions, support, authentication, analytics, billing, security, and compliance across multiple Closivo Services; and
• on behalf of a brokerage, business customer, or other organization using a specific Closivo Service.

We may use shared technical infrastructure, shared authentication, shared support systems, shared analytics, shared AI tooling, shared logging, and shared service administration across multiple Closivo Services.

In some circumstances, Broad Table acts as an independent business or controller for its own activities, such as account administration, billing, platform security, service communications, compliance, analytics, product improvement, and legal obligations. In other circumstances, we process personal information on behalf of a brokerage, business customer, or other account owner that uses the Platform. When we act on behalf of a customer, our processing may be governed by our agreements with that customer, and individuals may need to direct certain requests to that customer first.

Business account information

Organizations may control one or more Closivo Services under a single brand relationship. If you use Closivo through a brokerage or other business account, that organization may control your access and some information associated with your use.

If you are granted access to a Closivo workspace by a broker, brokerage, employer, or another business customer, that organization may control and administer your account, including by assigning permissions, approving workflows, determining what information is visible to you, requiring use of particular features, and deciding whether your access continues.

Your organization may determine which Closivo Services you can access, what information is visible to you, what permissions you have, and whether data may be shared or made interoperable across services within that organization’s environment.

If your access rights are changed or removed, you may lose access to information associated with that workspace. A business customer’s own policies may differ from this Privacy Policy, and Broad Table is not responsible for the privacy or security practices of other businesses.

Personal information we collect

The data collected depends on which Closivo application or service is being used. The personal information we collect depends on how you interact with the Platform, how your organization configures it, and what services you use.

We may collect different categories of personal information depending on the Closivo Service, module, feature, or sub-branded offering involved.

Information you provide to us

You or your organization may provide personal information such as:

• names, email addresses, phone numbers, usernames, account credentials, roles, titles, and business affiliations;
• billing and subscription information;
• information submitted in connection with a particular Closivo application, such as Deal records, workflow records, contact records, transaction records, configuration rules, mapping rules, prompts, notes, or operational data;
• documents relating to a real estate transaction, submitted by upload or by email to a workspace address, such as listing agreements, purchase contracts, inspection reports, disclosures, closing disclosures, and settlement statements, together with any information those documents contain;
• identity information, including SSNs and EINs, where specific products or tiers permit use of 1099 or related identity-based workflows;
• communications with us, including support tickets, feedback, and requests.

Information we receive from connected apps, customers, and third parties

We may receive information from connected systems, integrations, APIs, webhooks, customers, administrators, or other authorized sources, including information from accounting systems such as Xero and from other connected software used with a particular Closivo Service. Where a customer's workspace has document intake features enabled, we may also receive documents and related information sent to that workspace by third parties, such as title companies, settlement agents, and cooperating agents. Those items may include information about the sender and about individuals named in the documents, are held for the customer's review, and are processed on the customer's behalf. We also receive documents that a customer's approved senders, such as its agents and personnel, submit to a workspace by email. A customer determines who is approved to submit documents to its workspace and may configure its workspace to accept documents from other senders.

Information we collect automatically

We may automatically collect technical and usage data across the Closivo Platform, including across different Closivo applications, websites, support systems, authentication systems, and shared infrastructure.

When you access or use the Platform, we may collect technical and usage information automatically, such as:

• IP address;
• browser type, device information, operating system, and session identifiers;
• page views, feature engagement, clicks, referral URLs, timestamps, and other usage analytics;
• log data relating to authentication, security events, integration performance, queue processing, webhook delivery, errors, and diagnostics.

Sensitive personal information

In limited cases, we may collect information that may be considered sensitive under some laws, such as SSNs, EINs, and account credentials. Information of this kind may also be contained within a document that a customer or its approved senders submit to a workspace. We do not require or request sensitive information within submitted documents. Automated document processing, including optical character recognition, text extraction, parsing, and AI-assisted processing, may process some or all of the content of a submitted document. We do not intentionally identify, index as a dedicated field, use, or display sensitive information appearing incidentally within a document, except as reasonably necessary for a supported feature, security, troubleshooting, legal compliance, or support you authorize. We collect and use sensitive information only as reasonably necessary to provide requested services, administer identity- or tax-related workflows, protect security, comply with law, and operate the Platform.

Notice at collection and retention summary

This summary is intended to help users understand the categories of information we collect, why we collect it, whether it may be sold or shared, and how long we retain it.

The following summary supplements the sections below. Actual collection and retention depend on the Closivo Service used, customer configuration, enabled integrations, legal requirements, and business needs.

We do not knowingly sell or share personal information of children or users under sixteen (16). We do not use sensitive personal information to infer characteristics about a person except as permitted by law. We do not currently offer a financial incentive or price or service difference in exchange for personal information. If that changes, we will provide any required notice.

Cookies and other tracking technologies

Cookies and similar technologies may operate across the overall Closivo brand experience. We use cookies and similar technologies for session management, preferences, analytics, product improvement, service administration, and security.

We use cookies, local storage, pixels, SDKs, and similar technologies on the Closivo Platform for essential operations, preferences, analytics, product improvement, service administration, fraud prevention, and security. These technologies may operate across the Closivo website, account systems, dashboards, and one or more Closivo applications or sub-branded offerings. We use the following categories of cookies and similar technologies:

• Essential cookies to keep users signed in, maintain sessions, provide security controls, prevent fraud, and support core Platform functionality;
• Preference cookies to remember settings such as dashboard layouts and user preferences; and
• Analytics cookies and tools to measure performance, understand feature usage, improve the Platform, and troubleshoot issues. These tools may include first-party and third-party analytics and product-experience providers; and
• Advertising and retargeting technologies on our public-facing websites, as described in the next section.

You may be able to control cookies through your browser or device settings. If you disable certain cookies or technologies, some parts of the Platform may not function properly. Where required by applicable law, we will provide additional cookie choices, recognize applicable universal opt-out mechanisms such as Global Privacy Control, and provide a “Do Not Sell or Share My Personal Information,” “Your Privacy Choices,” or similar mechanism if our use of cookies or similar technologies constitutes a sale, sharing, targeted advertising, or cross-context behavioral advertising under applicable law.

Advertising and retargeting technologies

On our public-facing websites, we use advertising and measurement technologies provided by Meta and Google, including pixels, cookies, tags, and similar identifiers, to measure advertising performance, build advertising audiences, and show advertising to people who have previously visited our websites on other websites and applications. Depending on the technology, these providers may receive online identifiers, IP address, device and browser information, referral information, pages viewed, and interactions with our public websites.

We do not use authenticated Closivo workspace data for advertising. Deal records, commission and split information, payout records, invoices and bills, tax identifiers, uploaded closing or settlement documents, and other Customer Data are not used for targeted advertising, cross-context behavioral advertising, or advertising audience building, and we do not place advertising or retargeting technologies inside authenticated Closivo workspaces.

Conversion measurement. When you sign up for, activate, or upgrade a paid subscription, we may transmit a record of that event to advertising and measurement providers, including Meta and Google, from our own systems rather than from your browser. That record may include the event type and date, the subscription plan and amount, a hashed form of the account contact email address, an advertising click identifier captured when you first visited our public website, and the IP address and browser information from that visit. We transmit these events to measure the performance of our advertising. We do not include any workspace content in these events, including Deal records, commission or payout information, tax identifiers, uploaded documents, or information about agents, payees, or transaction counterparties, and we transmit these events only for the person who holds or pays for the account, not for other users of a workspace.

Depending on your state of residence, the use of these technologies may constitute a “sale” or “sharing” of personal information, or “targeted advertising,” under applicable privacy law. Where that is the case, you may opt out by emailing legal@broadtable.co, and, where we make them available, by using the "Your Privacy Choices" link on our website, by adjusting your choices in our cookie preference tool, or by sending a Global Privacy Control signal from your browser. Where applicable law requires us to confirm that an opt-out request, including one sent through a browser preference signal, has been processed, we will provide that confirmation.

Service providers and subprocessors

We maintain information regarding the categories of service providers and subprocessors that may process personal information on our behalf, and the countries from which they are known or authorized to access it. Business customers may request that list by emailing legal@broadtable.co. The categories of recipients with whom we share personal information are described in the "How we share your personal information" section below.

Do Not Track

Some browsers transmit “Do Not Track” signals. We do not currently respond to traditional Do Not Track signals, because no common industry standard for them has been adopted. Where required by applicable law, we recognize Global Privacy Control or another legally recognized universal opt-out mechanism as a request to opt out of the sale or sharing of personal information or targeted advertising. Third parties, including the advertising and analytics providers described above, may collect information about your activity across different websites through our public-facing websites.

How we use personal information

We may use information to operate both specific applications and the overall Closivo brand ecosystem. We use personal information to operate the Platform, communicate with users, improve our services, and comply with law.

We may use personal information for the following purposes:

Service delivery and operations

We may use personal information to:

• create, administer, secure, and support accounts and workspaces;
• provide the Platform and its features, including commission calculations, Deal lifecycle workflows, field mapping, reconciliation tools, and synchronization with connected systems;
• generate, display, route, or store invoices, bills, payout records, and related workflow data;
• authenticate users, prevent unauthorized access, and maintain account security;
• process subscriptions, billing, renewals, collections, and payment-related administration;
• provide customer service, respond to requests, and resolve support issues;
• send system notifications, deal updates, billing notices, legal notices, and service-related communications.
• provide, maintain, secure, support, and improve the Closivo Platform and specific Closivo Services;
• manage subscriptions, billing, authentication, support, analytics, legal compliance, and communications across one or more Closivo Services;
• enable interoperability, shared administration, unified identity, or coordinated workflows among Closivo Services where configured or authorized;
• develop, test, improve, launch, monitor, and support new Closivo applications, modules, sub-branded offerings, and features;
• create de-identified, anonymized, or aggregated insights across the Closivo brand family for lawful business purposes.

Research, development, and service improvement

We may use personal information and platform activity to:

• improve, test, monitor, and develop the Platform and new features;
• understand how users interact with the Platform;
• identify bugs, latency, workflow bottlenecks, and usability issues;
• create aggregated, de-identified, or anonymized statistics and operational insights;
• develop and improve internal models for reconciliation, data normalization, workflow automation, forecasting, security, and fraud detection.

The limits described in the “Artificial Intelligence (AI) and Automated Processing” section below apply to these activities. Where any of them would apply learnings beyond the account the information came from, we use only de-identified or aggregated information. We act as an independent controller only for information we process for our own account administration, billing, security, fraud prevention, communications, legal compliance, and corporate operations; for service usage, telemetry, diagnostic, performance, and product analytics information generated through operation of the Platform; and for information collected from visitors to our public-facing websites. We do not treat workspace data provided by a customer as independent-controller data for analytics, product improvement, model development, benchmarking, or marketing unless it has been de-identified or aggregated.

Marketing

Where permitted by law, we may use contact information and interaction data that you provide to us directly — including when you create or maintain a user account, accept our terms, communicate with us, or visit our websites — to send newsletters, event information, product announcements, promotional communications, or other non-transactional messages. We do not use information that a business customer submits about you, without your own direct interaction with us, to send you marketing communications. You may opt out of non-essential marketing communications at any time.

Compliance and protection

We may use personal information to:

• enforce our Terms & Conditions and other agreements;
• investigate fraud, misuse, suspicious activity, and security incidents;
• comply with legal, tax, accounting, regulatory, and contractual obligations;
• protect the rights, property, safety, and security of Broad Table, our users, and others;
• exercise, establish, or defend legal claims.

Artificial Intelligence (AI) and Automated Processing

AI and automation may be deployed across multiple Closivo products. Some Closivo features use automation or AI to help users work more efficiently.

When you use AI-enabled or automation-assisted features, we may process personal information and Customer Data using automated and manual methods within a specific Closivo Service or across shared Closivo Platform infrastructure. This may include field mapping, normalization, reconciliation, workflow suggestions, forecasting, summarization, anomaly detection, and other automation or AI-enabled functionality. In some cases, human review may occur for support, quality control, troubleshooting, abuse prevention, or safety purposes.

To the extent permitted by law and consistent with our agreements and disclosures, we may use data, usage signals, feedback, logs, and de-identified information derived from one or more Closivo Services to develop, improve, evaluate, maintain, and support internal automation, analytics, and AI capabilities across the broader Closivo brand family.

We process Customer Data that identifies a customer, an individual, or a specific transaction, commission arrangement, payout, or counterparty only to provide, maintain, secure, support, troubleshoot, administer, and evaluate the Closivo Services for the account that supplied it, and to detect, investigate, and prevent security incidents, fraud, and abuse. We may apply a signal or indicator derived from that activity to protect other customers and the Platform, but we do not disclose the underlying identifiable information to another customer.

We do not use identifiable information to train or improve any model, system, benchmark, or dataset whose learnings are applied for other customers. Cross-customer product improvement, analytics, benchmarking, and model development use only de-identified or aggregated information. We apply reasonable measures designed to prevent those results from being attributable to a particular customer, we do not attempt to re-identify that information, and we do not provide it to others for that purpose. We do not sell Customer Data.

If advanced generative AI functionality is made available, we may use third-party AI subprocessors under enterprise or comparable terms designed to restrict the use of submitted business data for training generally available base models. Even where such controls are used, AI-enabled functionality may produce incorrect, incomplete, or inconsistent outputs, and users remain responsible for reviewing and validating results before relying on them.

We do not intend for AI-enabled or automated features to make final legal, tax, accounting, payment, employment, credit, housing, insurance, eligibility, or similarly significant decisions about individuals without customer review and approval. Where applicable law grants rights to access information about, appeal, or opt out of certain automated decision-making, profiling, or automated processing, we will honor those rights to the extent required and applicable to our role in the processing.

How we share your personal information

We may share information within your organization’s Closivo environment and with service providers supporting multiple Closivo products. We share personal information in limited circumstances to provide the Platform, support integrations, comply with law, and run our business.

We may share personal information:

• with your organization and its authorized users within the relevant Closivo workspace, application, or service environment;
• with service providers, subprocessors, and infrastructure vendors that support the Closivo Platform generally or one or more specific Closivo Services;
• with connected platforms and integration partners at your direction;
• in connection with the development, operation, support, or migration of current or future Closivo Services, where permitted by law and contract.

We may share personal information in the following circumstances:

With your organization and other authorized users

We may disclose information within a workspace to the applicable brokerage, account owner, administrators, and other users authorized by that organization. For example, Deal records, contact records, financial workflow records, and user role information may be visible to administrators or other permitted users.

With connected platforms and integration partners

If you connect an accounting system or other integration, we may share information with that connected provider and receive information back from it according to your or your organization’s instructions. This may include Xero or another user-authorized ERP, accounting, or workflow system.

With service providers and processors

We may share personal information with vendors and service providers that perform services on our behalf, such as:

• cloud hosting and infrastructure providers;
• payment processors and payment service providers;
• analytics and product-improvement providers;
• AI, automation, and machine learning subprocessors, where used;
• email, communications, authentication, logging, security, monitoring, and support vendors.

These providers are permitted to process personal information only for authorized purposes and subject to contractual restrictions and appropriate safeguards. We do not generally store full payment card numbers where a payment processor handles them directly.

For legal, safety, and compliance reasons

We may disclose personal information where we believe disclosure is reasonably necessary to:

• comply with law, regulation, subpoena, court order, or legal process;
• respond to lawful requests by public authorities;
• protect the rights, property, or safety of Broad Table, our users, or others;
• detect, investigate, prevent, or address fraud, security incidents, misuse, or illegal activity;
• enforce our agreements.

In connection with corporate transactions

We may disclose personal information in connection with an actual or proposed merger, financing, reorganization, acquisition, asset sale, bankruptcy, or similar transaction, subject to appropriate confidentiality measures where practical.

With professional advisors

We may share information with our auditors, accountants, lawyers, insurers, financing sources, and other professional advisors as reasonably necessary to operate our business or manage legal and financial matters.

De-identified and aggregated information

We may share de-identified, anonymized, or aggregated information that does not identify you personally for lawful business purposes, including analytics, benchmarking, research, product improvement, and marketing.

Your personal information rights and choices

You may have choices about how your personal information is used, and you may have legal rights depending on where you live.

Subject to applicable law and verification of your identity, you may have the right to:

• access or request a copy of certain personal information we hold about you;
• correct inaccurate personal information;
• request deletion of personal information, subject to legal, contractual, tax, accounting, fraud prevention, and operational retention obligations;
• request portability of certain personal information;
• opt out of non-essential marketing communications;
• manage cookie settings through your browser or device, where available.

You may exercise privacy requests by contacting legal@broadtable.co or through any privacy request form, cookie preference tool, or in-product privacy mechanism we make available. Where applicable law requires additional request methods, such as a webform, toll-free number, or specific opt-out link, we will provide those methods to the extent required for the relevant processing. If you use Closivo through a brokerage or other business customer, we may direct you to that organization first for requests relating to workspace data that it controls. We may need to verify your identity before responding to a request, and we may request additional information for verification purposes.

Data retention

Retention may depend on the specific Closivo service, customer configuration, data type, legal obligation, and operational need.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide and administer the Closivo Platform, maintain accounts and workspaces, support integrations, comply with legal, tax, accounting, audit, regulatory, and contractual obligations, resolve disputes, enforce agreements, maintain security, prevent fraud and abuse, and support business continuity. Retention periods vary by category as summarized in the “Notice at collection and retention summary” above.

Financial records and tax-related records, including 1099-related identity information where applicable, may be retained for the period required by law or standard business practice, which is typically up to seven (7) years and may be longer if a legal hold, dispute, investigation, audit, security need, or other obligation applies. Logs, backups, and security records may be retained for different periods depending on their purpose. If we cannot fully delete information immediately due to technical, legal, or operational reasons, we may securely isolate, restrict, or retain it until deletion is practicable or the applicable retention need expires.

International data transfers

The Platform is primarily hosted and processed in the United States.

Broad Table is a U.S. company. Our primary production environment and primary stores of personal information are hosted in the United States. Certain service providers may process or temporarily store limited information, such as logs, error reports, support records, or AI processing requests, in other countries. We can identify those countries on request. The Platform is intended for commercial use by U.S. businesses and professionals and is not offered for personal, family, or household use.

Access from outside the United States. Some of our personnel, contractors, and service providers are located outside the United States, including software development and support personnel located in Sri Lanka, and they may access personal information stored in the United States in order to build, maintain, support, secure, and troubleshoot the Platform. That access is subject to written confidentiality obligations, role-based access controls, and our security policies. Remote access of this kind does not change where personal information is hosted or stored. We can identify the countries from which such access occurs on request.

If personal information is transferred from another country to the United States or another jurisdiction, we will use appropriate safeguards as required by applicable law, which may include Standard Contractual Clauses or similar approved transfer mechanisms.

Security of your personal information

We use safeguards designed to protect personal information, but no system is perfectly secure.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, loss, misuse, alteration, and disclosure. These safeguards may include access controls, authentication measures, encryption where appropriate, logging, monitoring, and logical separation of customer environments. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You should use strong credentials, restrict access appropriately, and notify us promptly if you suspect unauthorized access to your account or information.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including as the Closivo brand expands.

We may update this Privacy Policy to reflect new Closivo Services, rebranding, sub-branding, integrations, AI features, changed data practices, legal requirements, or business needs. If we make a material change, we will provide notice, or obtain consent, to the extent required by applicable law, and may do so by posting an updated version on the Platform, sending an email, displaying an in-product notice, or using another reasonable method. The “Last updated” date above indicates when this Privacy Policy was most recently revised.

Children’s privacy

The Platform is intended for adults and business use.

The Platform is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from children under 13. Because the Platform is intended for brokerage, accounting, and commission management functions, users must be at least 18 years old under our Terms & Conditions. If you believe a child has provided us personal information, contact us and we will take appropriate steps.

How to contact us

Broad Table, Inc.
790 Florida St, Ste 3
Mandeville, LA 70448
Email: legal@broadtable.co

Region and state-specific terms

United States

Additional rights and disclosures may apply depending on your state of residence.

If you are a resident of a U.S. state that has enacted a comprehensive consumer privacy law, you may have certain rights regarding your personal information in addition to the choices described in the "Your personal information rights and choices" section above. These rights vary by state and by the nature of your relationship with us, and they are subject to verification of your identity and to the exceptions and exemptions permitted by applicable law. Depending on your state of residence, these rights may include:

• the right to confirm whether we process your personal information and to access that information;
• the right to correct inaccurate personal information;
• the right to request deletion of personal information;
• the right to obtain a portable copy of certain personal information you provided to us;
• the right to opt out of the sale of personal information, targeted or cross-context behavioral advertising, and certain profiling, where applicable;
• the right to opt out of, appeal, or obtain information about certain automated decision-making or profiling, where applicable;
• the right to limit the use or disclosure of sensitive personal information, where applicable; and
• the right not to receive unlawful discriminatory treatment for exercising your privacy rights.

Sensitive information and consent. Where applicable state law requires consent to process sensitive personal information, Broad Table or the applicable business customer, depending on the parties' roles and the source of the information, will obtain that consent. Where a business customer submits your information to its workspace, that customer is responsible for obtaining any required consent. Where required by applicable law and where we act as a business or controller, we will obtain your consent before processing sensitive personal information, such as Social Security numbers and Employer Identification numbers, for purposes that require consent under that law. We use such information only as described in the "Sensitive personal information" section above. Where the Platform is used by a brokerage or other business customer, that organization may be the party responsible for obtaining any required consents from the individuals whose information it submits.

Universal opt-out and Global Privacy Control. Where required by applicable law, we recognize universal opt-out mechanisms, such as the Global Privacy Control (GPC) signal, as a valid request to opt out of the sale of personal information or targeted or cross-context behavioral advertising for the browser or device from which the signal is sent.

How to exercise your rights. You may submit a privacy request by emailing legal@broadtable.co. We may need to verify your identity before responding and may request additional information for that purpose. You may use an authorized agent to submit a request on your behalf, subject to verification of the agent's authority and your identity. If you use the Platform through a brokerage or other business customer, we may direct you to that organization first for requests relating to workspace data it controls.

Appeals. If we decline to act on your request, you may appeal our decision by replying to our response or by emailing legal@broadtable.co with the subject line "Privacy Appeal." We will respond within the time required by applicable law.

This section provides additional information for U.S. residents generally. The following section provides further detail for California residents where the California Consumer Privacy Act applies.

California Residents

This section applies only to California residents to the extent the California Consumer Privacy Act (“CCPA”), as amended, applies to our processing.

Scope

This section applies only to the extent the California Consumer Privacy Act, as amended, and its implementing regulations (the "CCPA") apply to our processing of Personal Information of California residents and we act as a "business" under the CCPA with respect to that processing. Where it applies, this section describes how we collect, use, disclose, and otherwise process Personal Information of California residents, and the rights California residents may have regarding that Personal Information. “Personal Information” and “Sensitive Personal Information” have the meanings given in the CCPA, subject to applicable exclusions and exemptions.

Categories of Personal Information we may collect

Depending on how you interact with us, we may collect the following categories of Personal Information:

• identifiers and contact information, such as name, email address, phone number, online identifiers, IP address, account username, and similar identifiers;
• customer records and business information, such as billing information, account details, Deal records, property addresses, contact records, financial workflow records, and subscription information;
• commercial information, such as information about your subscription and interactions with the Platform;
• internet or other electronic network activity information, such as usage logs, page views, feature interaction data, session information, and device/browser information;
• professional or employment-related information, such as brokerage affiliation, title, role, and workspace permissions;
• Sensitive Personal Information, such as SSNs, EINs, and account credentials, where applicable.

Sources of Personal Information

We collect Personal Information from:

• you directly;
• your brokerage or organization;
• third parties, such as title companies, settlement agents, and cooperating agents, who send documents or information to a customer's workspace through intake features;
• automatic collection technologies and system logs;
• service providers acting on our behalf.

Business and commercial purposes

We collect, use, and disclose Personal Information for the purposes described in this Privacy Policy, including:

• service delivery and operations;
• synchronization, workflow management, and support;
• billing and account administration;
• security, fraud prevention, and compliance;
• research, development, analytics, and service improvement;
• communications and, where permitted, marketing.

Categories of recipients

We may disclose Personal Information to:

• service providers and processors;
• your organization and authorized workspace users;
• integration partners and connected platforms at your direction;
• legal, tax, and financial advisors;
• regulators, law enforcement, and other parties where required by law;
• counterparties in a corporate transaction.

Sensitive Personal Information

We use Sensitive Personal Information only for lawful and permitted purposes, such as providing requested services, performing tax-related workflows, ensuring security, detecting fraud, fulfilling legal obligations, and operating the Platform. We do not use Sensitive Personal Information to infer characteristics about you, and we do not use or disclose it for purposes other than those permitted under the CCPA without offering a right to limit. As a result, the right to limit the use of Sensitive Personal Information does not apply to our processing.

Sales and sharing

We do not sell Personal Information for monetary consideration. We do not knowingly sell or share Personal Information of consumers under sixteen (16). We do not use Sensitive Personal Information to infer characteristics about you beyond permitted purposes. On our public-facing websites we use analytics, advertising, measurement, and retargeting technologies, including technologies provided by Meta and Google, to measure advertising performance, build advertising audiences, and show advertising to prior website visitors on other websites and applications. To the extent this constitutes “selling” or “sharing” Personal Information under the CCPA, the categories involved are identifiers and internet or other electronic network activity information, and the recipients are advertising networks, social networks, and analytics and measurement providers. We do not sell or share Deal records, commission or payout information, tax identifiers, uploaded closing documents, or other authenticated Closivo workspace data for advertising purposes. To the extent any disclosure through cookies or similar technologies is deemed a "sale" or "sharing" under the CCPA or another applicable privacy law, you may opt out by contacting legal@broadtable.co, and, where we make them available, by using a "Do Not Sell or Share My Personal Information" link, a "Your Privacy Choices" link, a cookie preference tool, or a Global Privacy Control signal.

State privacy rights

Some U.S. state privacy laws apply only to businesses that meet specified revenue, volume, or data-sale thresholds, and many exempt information processed in a business-to-business or employment context. Where a state privacy law applies to our processing, we will honor the rights it provides, including any applicable rights of access, correction, deletion, portability, and opt-out, and we will provide the request methods and any confirmation of an opt-out that the law requires.

The categories of personal information we collect, the purposes for which we use them, the categories of recipients, and our retention approach are described in the notice-at-collection table and the sharing sections above. Our use of advertising and retargeting technologies on our public-facing websites, and the choices available to you, are described in the “Advertising and retargeting technologies” section.

California privacy rights

Where the CCPA applies to our processing and we act as a business with respect to it, and subject to verification and applicable exceptions, California residents may have the right to:

• know and access the categories and specific pieces of Personal Information we have collected about them;
• request correction of inaccurate Personal Information;
• request deletion of Personal Information;
• receive a portable copy of certain Personal Information;
• opt out of sale or sharing, if applicable;
• limit certain uses of Sensitive Personal Information, if applicable;
• access information about, appeal, or opt out of certain automated decision-making technology where applicable; and
• be free from unlawful discrimination for exercising privacy rights.

Requests about workspace data

Much of the personal information in the Platform is submitted and controlled by a Closivo customer, typically a brokerage, and we process it on that customer's behalf as a service provider. If we receive a request relating to information in a customer's workspace, we will forward the request to that customer, or direct the requester to that customer, and will assist the customer in responding as required by law. If you are an agent, payee, or transaction counterparty, the brokerage that submitted your information is generally the right place to direct a request.

How to exercise California rights

California residents may submit requests by emailing legal@broadtable.co or by using any privacy request form, cookie preference tool, “Your Privacy Choices,” “Do Not Sell or Share My Personal Information,” or similar mechanism we make available where required. Please include sufficient information for us to verify your identity and understand your request. You may designate an authorized agent to make a request on your behalf, subject to verification of the agent’s authority and your identity.

We may deny a request where permitted by law, including if we cannot verify your identity, if an exemption applies, or if we are required to retain the information for legal, tax, accounting, security, or contractual reasons.

Appeals

Where applicable law provides a right to appeal a denied request, you may appeal using the method and within the period stated in our response to your request. Where no such right applies, you may still contact us at legal@broadtable.co if you believe we have misunderstood your request.

Nevada Residents

Nevada residents may have the right to submit a request directing us not to make certain sales of covered information under Nevada law. We do not currently sell covered information as Nevada law traditionally defines that term. Nevada residents may submit requests to legal@broadtable.co.