Privacy policy

======================================================= divieight, LLC — PRIVACY POLICY Incorporated into the Waitlist Terms — 1 September 2026 ======================================================= DRAFT — NOT FOR PUBLICATION. Prepared as design judgment, not legal advice. This Policy is incorporated by reference into the Waitlist Terms and the platform Terms and Conditions, and must be published at a stable URL before the first registration. Counsel review is required, with particular attention to the state-specific rights in Section 9 and the Fair Credit Reporting Act treatment in Section 4. ------------------------------------------------------- 1. Who We Are and What This Covers ---------------------------------- divieight, LLC is a Utah limited liability company operating a technology platform through which people acquire second homes together in fractional shares. We are the controller of the personal information described here. This Policy covers both stages of your relationship with us: the pre-launch waitlist, and the platform itself. What we collect differs substantially between them, and Sections 3 and 4 are separated accordingly. If you have only joined the waitlist, Section 4 does not yet apply to you. It also covers information we hold about licensed professionals — real estate agents, brokers, and title or escrow professionals — who register with us. Section 5 addresses that. It does not cover what a third party does with information you give them directly. If you connect a bank account through Plaid, or pay through Stripe, or watch a video hosted by a third party, those companies handle that interaction under their own policies. We name them below so you know who they are. 2. The Short Version -------------------- The detail follows, but the substance is this: - We do not sell your personal information. Not to advertisers, not to data brokers, not to anyone. We never have and the platform is not built to. - We collect what a transaction requires and not more. A waitlist registration needs far less than a home purchase, and we ask for the difference only when it becomes necessary. - Your financial information is not shown to other participants. Verification produces a yes or a no. No score, band, or ranking of your finances is displayed to anyone. - Your waitlist activity is not connected to your platform profile. Deliberately, and at the level of the data model. Section 6 explains why. - You can get your data, correct it, or have it deleted. Section 9 tells you how, and we honor those requests regardless of where you live. 3. Waitlist Participation ------------------------- If you register on the pre-launch waitlist, we collect the following. What Why Where it comes from Name and email address To create your account, deliver what you paid for, and contact you about your market Target market, budget range, and intended use To place you in the right market and to report demand in aggregate You You Payment information To take payment and to process a refund if you ask for one You, entered directly into Stripe What Why Where it comes from Acceptance record — timestamp, IP address, browser, and a version identifier for the terms you accepted Delivery record — what we sent you and when, what you opened, what you attended Video introduction, if you choose to record one Whether you opened our newsletter To evidence what you agreed to and when Automatically, at the moment you accept To evidence that we delivered the benefits you paid for Automatically To display in the participant community You, voluntarily To evidence that we delivered a benefit you paid for Automatically, from the newsletter only Payment card details never reach us. Stripe collects them inside a frame served from Stripe's own systems. We receive confirmation that a payment succeeded, the amount, and the last four digits. We do not receive, store, or have access to your card number. The delivery record exists for your protection as much as ours. It is what allows us to answer a question about whether something was sent, and it is what we would rely on if a payment were disputed. 4. Platform Participation ------------------------- If you proceed to acquire a share through the platform, we collect substantially more, because a real estate transaction requires it. This is where the sensitive material sits. What Why Government identification and a liveness confirmation To verify you are who you say you are, and that a real person is present A consumer report covering criminal history and financial fraud history Verification that you hold the required funds, through Plaid To evaluate eligibility to co-own property with seven other people To confirm capacity before you and seven others commit Social Security number or Tax ID, and a Form W-9 Required for entity formation and tax reporting Transaction records, ownership records, and use-calendar selections To operate the property's limited liability company Bookkeeping records for the property LLC To produce your statements and your Schedule K-1 4.1 Background screening and your rights under the Fair Credit Reporting Act We obtain a consumer report from a consumer reporting agency. We ask for your written authorization first, and we give you a copy of your rights under the Fair Credit Reporting Act before we do. If we take adverse action based on that report — if it is why we decline your participation — you receive notice of the adverse action, a copy of the report, and a statement of your rights. You may dispute the accuracy of the report with the agency that furnished it. The report itself is seen by almost no one. It is held under stricter controls than anything else we keep, accessible only to our compliance personnel and to auditors with a permissible purpose under the Act. Your real estate agent does not see it. Your co-owners do not see it. Nobody sees it but us. 4.2 Financial verification produces a yes or a no We verify, through Plaid, that you hold the funds a transaction requires, and we re-verify approximately every thirty days while your account is active. Plaid handles your banking credentials; we never see them. The verification resolves to a single result: verified, or not verified. We do not compute, store for operational use, display, or transmit any score, rating, band, tier, or ranking of your financial standing. No other participant sees your balances, your margin above the threshold, or any figure derived from them. Your financial position is not a factor in which group you are matched with. 5. Licensed Professionals ------------------------- If you register as a real estate agent, broker, or title or escrow professional, we collect your name and contact details, your license number and status, evidence of your errors and omissions coverage, your sponsoring broker, your certifications, and, where we pay you, your tax information. Your professional details appear in a professional directory, which is the point of registering. Where a subscription affects your placement in a buyer-facing directory, we disclose to buyers that the placement is sponsored. What you see about buyers is limited. You see the full record of a buyer tethered to you. For every other buyer, you see aggregate information only — counts, budget ranges as coarse bands, distributions of intended use, and target zip codes. You do not see individual records, names, contact details, or any element of another buyer's verification. 6. What We Deliberately Keep Apart ---------------------------------- Two separations are built into the platform rather than promised in a policy. Your waitlist activity and your platform profile are not linked. If you record a video introduction during the waitlist and later acquire a share, there is no technical path connecting the two. They use independently generated identifiers, share no key, and cannot be joined — not by us, not by an administrator, not by an auditor. Your email address is not used as a common identifier between them. This matters because co-ownership matching must not be influenced by what anyone looks or sounds like. Removing the connection at the data model is the only way to make that true rather than merely stated. Your financial detail is separated from operational systems. Balances, verification values, and consumer report contents live in a restricted area of our records and are not carried into the systems that run matching, pod formation, or the marketplace. 7. Who We Share With -------------------- We share personal information only as described here. Who What they receive Why Your tethered real estate agent Your identity, contact details, target market, and To represent you verified status — not your consumer report or financial values Who Your co-owners What they receive Why Your name and contact details, when all shares are committed and the group proceeds to an offer to purchase real estate You are acquiring property together Title and escrow companies What a closing requires To close the transaction Service providers Only what their function requires The property LLC’s accountant Ownership and financial records for the entity Government authorities Where required by law Payments, identity verification, background screening, email delivery, hosting To prepare returns and your Schedule K-1 Tax reporting, and anti-money-laundering obligations if applicable Service providers act on our instructions and may not use your information for their own purposes. Aggregate market data may be shared with prospective partners — how many buyers are forming in a market, what budget range, what intended use. That data does not identify anyone and cannot be resolved back to an individual. Where we offer partner benefits, we share anonymized demographic and budgetary information only, and never your identity, unless you separately opt in at the moment you choose to redeem an offer. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If we are ever acquired or merged, your information may transfer as part of that transaction. We would notify you before it took effect and before any different policy applied to it. 8. How Long We Keep Things -------------------------- Category Retained for Waitlist registration that never became a platform account Seven years from the point the account is archived, then deleted Platform records for an active property The life of the property LLC plus seven years after dissolution Consumer reports and verification values As above, under restricted access throughout Acceptance and delivery records Video introductions Refund requests that matched no registration As above — these are what evidence what you agreed to and what we delivered Until you delete them, automatically on refund, or twelve months after your market activates, whichever comes first. Retained and flagged for review, so a mistyped address is not silently discarded Where the law requires us to keep something longer, we do. Where it does not, we delete on the schedule above. 9. Your Rights -------------- These rights are available to you regardless of where you live. Some states grant them by statute; we extend them to everyone rather than sorting our participants by residence. - Know what we hold about you and why - Access a copy of it, in a portable format - Correct anything inaccurate - Delete it, subject to what we must keep by law or to complete a transaction you are party to - Opt out of the sale or sharing of your information — though we do neither - Limit how we use sensitive information - Withdraw consent to marketing email at any time, without affecting anything you have paid for - Not be discriminated against for exercising any of these How to exercise them. Contact us at support@divieight.com, or use the controls in your account. We respond within forty- five days and will tell you if we need longer. We may need to verify your identity, particularly for a deletion request — we will not delete an account on the say-so of someone who cannot show it is theirs. An authorized agent may act for you with written authorization; we may still verify your identity directly. One limit worth stating plainly. If you hold an interest in a property LLC, some records — ownership, capital accounts, tax filings — cannot be deleted while you hold it. They are the company's records as much as yours, and other owners have rights in them. We will tell you which records those are if you ask. 10. Marketing and Email ----------------------- Two kinds of email, treated differently. Transactional email — payment confirmations, refund notices, verification links, and notices we are required to send — carries no unsubscribe link. You cannot opt out of these while you have an active relationship with us, because they carry information you need. Unsubscribing from marketing does not stop them. Marketing email — our newsletter and market reports — carries an unsubscribe link in every message, honored promptly. Note that the newsletter is a stated benefit of paid waitlist tiers; unsubscribing means we cannot deliver something you paid for, which we will not treat as a reason to withhold a refund. We do not currently send text messages. If we introduce them, we will ask separately, it will not be a condition of participation, and consent will meet the requirements of the Telephone Consumer Protection Act. 11. Cookies and Tracking ------------------------ We use cookies necessary to operate the site — keeping you logged in, remembering your market, securing your session — and analytics to understand which pages people use. We do not use advertising cookies and we do not permit third- party advertising trackers. We honor Global Privacy Control signals where your browser sends them. Email open tracking. Our newsletter contains a small invisible image that tells us whether the message was opened. We use this for one purpose: to evidence that we delivered a benefit you paid for, since the newsletter is part of every waitlist tier. We do not track opens on transactional email — payment confirmations, refund notices, verification links, and legal notices carry no tracking of any kind. We do not track which links you click in any email. If you would rather not be counted, most email programs let you block remote images, and unsubscribing from the newsletter ends it entirely. 12. Security ------------ Access to personal information is limited by role, and the most sensitive material — identification documents, Social Security numbers, consumer reports, financial values — sits under stricter controls accessible only to compliance personnel. Every access to it is logged. Payment card data never reaches our systems. Banking credentials never reach our systems. We will tell you if something goes wrong. If a breach affects your personal information, we notify you and the relevant authorities within the timeframes the law requires. No system is perfectly secure, and we do not claim otherwise. 13. Children ------------ The platform is for adults. We do not knowingly collect information from anyone under eighteen. If we learn we have, we delete it. 14. Where Your Information Is Held ---------------------------------- We operate in the United States and hold information here. We do not offer the platform outside the United States. 15. Changes ----------- We may update this Policy. Material changes will be notified in advance by email and posted here with a new effective date. Continued use after a change takes effect means acceptance of it. The version in effect when we collected information governs what we did with it. 16. Contact ----------- divieight, LLC — PO Box 688, Lehi, UT 84043. Privacy questions and requests: support@divieight.com. Notices under Section 22 of the platform Terms and Conditions: legal@divieight.com. Open Items - Counsel review before publication. State privacy statutes differ in the rights they grant, the timelines they impose, and the disclosures they require. This Policy extends rights uniformly rather than by residence, which is the more protective approach but should be confirmed as adequate in each market of offer. - FCRA treatment. Section 4.1 describes authorization, adverse action, and access controls. The end-to-end procedure — including who at divieight may view a report and under what circumstances — should be reviewed by FCRA-experienced counsel. - Service provider list. Section 7 describes categories rather than naming vendors. Confirm whether any market of offer requires specific naming, and keep an internal list current regardless. - Cookie inventory. Section 11 describes categories. Before publication, inventory what the site actually sets, and confirm no advertising or cross-context tracker is present. - Retention enforcement. Section 8 states schedules. Confirm the platform can actually execute them — a stated retention period that nothing enforces is a commitment you are not keeping. - The unlinkability claim at Section 6 is the strongest statement in this Policy and the one most exposed if untrue. Confirm the implementation matches before publication: independently generated identifiers, no shared key, no join path, email not used as a common identifier. - Publication URL. This Policy must be reachable at a stable address before the first registration, and that address goes in the Waitlist Terms, the platform Terms, and every email footer. Prepared as a working draft for divieight, LLC. Not legal advice. Counsel review required before publication.