Legal
US state privacy notice
For residents of US states with consumer privacy laws, including California: what we collect, your rights, and how prop.forsale honours your choices.
On this page
The short version
- We do not sell your personal information, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising or profiling.
- We honour Global Privacy Control (GPC) automatically: with it on, optional analytics stay off.
- You can ask to know, access, correct or delete your information, and appeal if we say no.
- Email privacy@pfs-stage.dev to make a request, yourself or through an authorised agent.
- The service is not for children, and we do not knowingly collect information from anyone under 16.
This summary helps you find your way. The full text below is what applies.
1. Who this notice is for
This notice supplements our privacy policy (/privacy) for residents of US states with comprehensive privacy laws. Some of these laws apply only to businesses above certain size thresholds, shown below. Whether or not a threshold is met, we give the rights in this notice to every US resident.
For information an agency collects through its own website or deal rooms, the agency is the business (controller) and we are its service provider (processor). Send requests about that information to the agency; we will help it respond.
| State | Law | Applies to a business that | Must honour browser opt-out signals such as GPC |
|---|---|---|---|
| California | California Consumer Privacy Act, as amended by the CPRA | Has annual gross revenue over $26,625,000 (2025 figure, adjusted every two years); or buys, sells or shares the personal information of 100,000 or more consumers or households; or earns half or more of its revenue from selling or sharing it. | Yes |
| Colorado | Colorado Privacy Act | Controls or processes the data of 100,000 or more Colorado consumers a year; or 25,000 or more and earns revenue or a discount from selling data. | Yes, since 1 July 2024 |
| Connecticut | Connecticut Data Privacy Act (as amended in 2025) | From 1 July 2026: processes the data of 35,000 or more Connecticut consumers; or processes any sensitive data; or sells any personal data. | Yes |
| Virginia | Consumer Data Protection Act | Processes the data of 100,000 or more Virginia consumers a year; or 25,000 or more and earns over half its revenue from selling data. | Not required by this law |
| Texas | Texas Data Privacy and Security Act | Does business in Texas and is not a small business under US Small Business Administration standards. Small businesses still need consent before selling sensitive data. | Yes |
| Florida | Florida Digital Bill of Rights | Has over $1 billion in global revenue and meets one of three further tests (online advertising revenue, a smart speaker, or a large app store). | Not applicable to us |
| Other states | Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and others | Varies by state, usually by the number of residents whose data is processed. | Many do |
2. Notice at collection
In the last 12 months we have collected the categories below. We keep each only as long as the privacy policy’s retention table says (see the privacy policy, section "How long we keep it").
| Category (California law) | Examples | Source | Why we use it | Disclosed to | Sold or shared? |
|---|---|---|---|---|---|
| Identifiers | Name, email, phone, account id, IP address | You; the agent who invites you; your browser | Accounts, enquiries, deal rooms, security | The agency concerned, deal room parties, our service providers | No |
| Customer records | Billing contact, address you enter, documents in a deal room | You; the agent | Billing, deal rooms, legal record keeping | Stripe, the agency, deal room parties, our service providers | No |
| Commercial information | Plan, purchases, credits; properties you enquired about | You; our systems | Billing, enquiries | Stripe, the agency | No |
| Internet or network activity | Pages viewed, clicks, device and browser type (analytics only with consent) | Your browser | Security; product analytics if you accept | Cloudflare, PostHog (as service providers) | No |
| Approximate location | Country or city derived from your IP address | Your browser | Security, showing relevant listings | Cloudflare | No |
| Audio or visual information | Profile and listing photos an agent uploads | The agent | Showing listings and agent profiles | The public, when the agent publishes | No |
| Professional information | Agency, role, licence or registration details an agent enters | The agent | Agent profiles and websites | The public, when the agent publishes | No |
| Sensitive personal information | Account sign-in credentials; identity documents and proof of funds uploaded to a deal room | You; the agent | Sign-in; the agent’s legal checks | The agency and deal room parties the agent allows; our service providers | No |
| Inferences | None. We do not build profiles to predict your preferences or characteristics. | Not applicable | Not applicable | Not applicable | No |
3. Sensitive personal information
We use sensitive personal information only to provide the service you asked for, to keep it secure and to meet legal obligations, which are the purposes the California regulations allow without a right to limit. We do not use it to infer characteristics about you.
4. We do not sell or share
We have not sold or shared (for cross-context behavioural advertising) personal information in the last 12 months, and we do not sell or share the personal information of consumers under 16.
Our optional product analytics provider, PostHog, acts as our service provider under a contract that forbids it from using the data for its own purposes or for advertising. We send it data through our own domain, only after you accept analytics, and never for advertising. We use no advertising cookies or pixels.
Because we do not sell or share, we do not show a "Do Not Sell or Share My Personal Information" link. If that ever changes, we will add the link and update this notice first.
5. Global Privacy Control
If your browser sends the Global Privacy Control signal, we treat it as a request to opt out: optional analytics stay off and the cookie banner is not shown. If you are signed in, we also save the opt-out to your account, so our servers stop linking business events to you. The signal applies to the browser that sends it.
6. Your rights
Depending on your state, you have the right to:
- Know and access
- What personal information we collect, use and disclose about you, and a copy of it in a portable format.
- Delete
- Deletion of personal information we collected from you, subject to legal exceptions such as deal records we must keep.
- Correct
- Correction of inaccurate personal information.
- Opt out
- Of sale, sharing, targeted advertising and profiling. We do none of these, and we honour GPC.
- Limit sensitive information
- We use it only for permitted purposes (see above).
- Equal treatment
- We will not charge you more, give you a worse service, or treat you differently for using your rights.
- Appeal
- If we decline a request, reply to our answer with "Appeal". We will answer the appeal within the time your state law sets (45 or 60 days) and tell you how to contact your attorney general if you still disagree.
7. How to make a request
Email privacy@pfs-stage.dev. We operate only online and have a direct relationship with the people who use us, so email is our request method. We acknowledge a request within 10 business days and answer within 45 days, extendable once by 45 days when necessary (we will tell you why).
To protect you, we verify your identity by matching information we already hold, usually by confirming a code sent to your account email. We will not ask for more than we need, and will use what you give us only to verify the request.
8. Authorised agents
You can ask someone to make a request for you. We will ask the agent for your signed permission and may ask you to verify your identity directly, unless the agent holds a power of attorney under your state’s probate law.
9. Children (COPPA)
prop.forsale is a service for property professionals and adult buyers, sellers and tenants. It is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has given us information, email privacy@pfs-stage.dev and we will delete it.
10. Commercial email (CAN-SPAM)
Marketing email sent through the platform goes only to people who opted in and confirmed. Each message says who sent it and has a one-click unsubscribe, which we act on immediately (the law allows up to 10 business days). Agencies that send newsletters through us are the senders and are responsible for the content of their messages.
11. Calls, texts and WhatsApp (TCPA)
The platform does not send marketing calls, text messages or WhatsApp messages. WhatsApp and phone links on listings open your own app and send nothing until you choose to. Agents who call or text you are responsible for having the consent the Telephone Consumer Protection Act and state laws require, and for stopping when you ask.
12. Contact
Kwestra LLC, 14 NE 1st Ave, Ste 1403 #146, Miami, FL 33132, USA. Email: privacy@pfs-stage.dev.