Privacy Policy

01Roles: who is responsible for what

For this marketing website, Aurum Estate is the controller of the personal information we collect. For marketplace and tenant data — consumer accounts, leads, offers, transaction records — Aurum Estate is a processor acting on a partner's documented instructions, and the partner is the controller.

That distinction determines who answers a data-subject request. Requests relating to a marketplace are routed to the responsible partner; we assist them in fulfilling it.

02Information we collect

• Website: contact details you submit through a demo or application form, and standard server logs for security and abuse prevention.
• Accounts: name, work email, phone number, role, and organization membership.
• Marketplace activity: listings, saved searches, inquiries, offers, and transaction records created on behalf of a partner.
• Documents: contracts, disclosures, and signature records uploaded or generated inside a transaction.
• Device and usage data: IP address, browser characteristics, and product interaction events used for security, reliability, and aggregate analytics.

03Why we process it

• To provide, secure, and support the platform a partner has purchased.
• To verify identity and entity standing during onboarding, including KYB and licensing checks.
• To communicate about service status, security events, and contractual matters.
• To produce aggregate operational metrics that do not identify an individual or a partner.
• To meet legal, tax, and record-retention obligations.

04What we do not do

• We do not sell personal information.
• We do not use partner-identifiable marketplace data to market to another partner's customers.
• We do not train third-party models on partner documents or transaction data.
• We do not use marketplace data for advertising or audience building.

05Subprocessors and disclosure

We use a limited set of subprocessors for hosting, storage, email and SMS delivery, payment processing, error monitoring, and electronic signature. Each is bound by written terms covering confidentiality, security, and permitted use.

A current subprocessor list is available on request and partners receive notice before a new subprocessor is added where the agreement requires it.

06Retention

• Website inquiry records: retained while the commercial relationship is active, then for a defined review period.
• Transaction and disclosure records: retained for the period required by the applicable state, which varies and is configured per tenant.
• Signature certificates and audit logs: retained for the statutory period and treated as evidence rather than content.
• Backups: rotated on a defined schedule and purged within the documented cycle after a deletion request.

07Security

Access is least-privilege and reviewed periodically. Data is encrypted in transit and at rest, credentials are stored in a dedicated secret store, and administrative actions are written to an append-only audit log. Tenant data is isolated at the data layer, not only at the application layer.

08Your choices and rights

• Request access to, correction of, or deletion of your personal information.
• Withdraw marketing consent at any time; transactional messages are unaffected.
• Object to processing or request portability where applicable law provides for it.
• Contact us using the address in the side panel; we respond within the period required by applicable law.

09Changes to this policy

Material changes will be announced before they take effect, and the effective date at the top of this page will be updated when counsel approves the final version. This draft is not an executed policy.