CRESTAL BALL Privacy Policy

We use personal information to:

• provide, operate, and maintain the Service, including Territory claims, billing, and account management;
• verify Customer license status and eligibility;
• compile, maintain, and deliver Territory Data to the Customer(s) who have claimed the applicable Territory;
• process payments and manage subscriptions;
• communicate with Customers about the Service, including support, billing, and policy updates;
• market the Service to prospective Customers, including through analytics and advertising described in Section 6;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• comply with legal obligations and enforce our Terms of Service; and
• improve and develop the Service, including aggregated or de-identified analysis.

We do not use Territory Data to make decisions about a homeowner's eligibility for credit, insurance, employment, or housing, and Territory Data is not a "consumer report" under the Fair Credit Reporting Act.

We share personal information with:

• Other Customers: Territory Data associated with a claimed Territory is made available to the Customer(s) who hold that Territory (which may include more than one Customer in different, non-competing Profession Categories, as described in our Terms of Service);
• Service providers: payment processors (e.g., Stripe), cloud hosting providers, customer support tools, and analytics/advertising providers described in Section 6, each acting on our behalf under contract;
• Data licensors: the aggregators, county sources, and MLS providers described in Section 1.3, to the extent necessary to obtain and refresh Territory Data;
• Professional license verification services, to confirm Customer eligibility;
• Legal and safety purposes: to comply with a subpoena, court order, or other legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of CRESTAL BALL, our Customers, or others; and
• Business transfers: in connection with a merger, financing, acquisition, or sale of assets, subject to standard confidentiality protections.

We do not sell homeowner or Customer personal information to third parties for their own independent marketing purposes outside the Service. As described in Section 8, however, certain disclosures described above — specifically, providing Territory Data to paying Customers, and certain advertising-technology disclosures described in Section 6 — are treated as a "sale" or "share" under California and similar state privacy laws because of how those laws define those terms, even though we do not consider this a sale in the everyday sense of the word. Section 8 explains your rights regarding this.

If your property or ownership information appears in the Service as Territory Data, you are not a Customer and have likely never interacted with CRESTAL BALL directly. Here is what that means:

• Where it comes from. Your information came from the third-party sources listed in Section 1.3 — typically public government records and licensed data providers — not from you directly and not from your consent to use our Service.
• What we do with it. We compile it into Territory Data and make it available to the real estate or mortgage professional(s) who have claimed the Territory covering your property, for their professional marketing and outreach purposes.
• Your rights. Depending on your state of residence, you may have the right to know what information we have about you, request its deletion, request correction of inaccurate information, and opt out of "sale" or "sharing" of your information, as described in Section 8. Because we do not have a direct account relationship with homeowners, we verify these requests using the property address and other identifying information you provide — see Section 10.
• We are not a data furnisher for credit purposes. Territory Data is not used, and may not be used by our Customers through the Service, to determine your eligibility for credit, insurance, employment, or housing.

We process personal information for the business and commercial purposes described in Section 2, which include: providing and improving the Service; performing our contract with Customers; complying with legal obligations (e.g., tax, licensing verification); and our legitimate business interests in operating, marketing, and securing the Service, balanced against your privacy interests. This Policy is written for a U.S. audience; if you are located outside the United States, be aware the Service is designed for the U.S. market and we may not be able to support all region-specific rights.

We and our vendors use cookies, pixels, SDKs, and similar technologies to:

• keep you logged in and remember preferences (essential/strictly necessary);
• measure site usage and performance through analytics tools such as Google Analytics (analytics); and
• measure and optimize advertising, including through pixels such as Meta Pixel, TikTok Pixel, or Google Ads conversion tracking, which may involve sharing identifiers (e.g., a hashed email or device ID) with those platforms so they can match visitors to their own users (advertising).

The advertising category described above may constitute "cross-context behavioral advertising" or a "share"/"sale" of personal information under California, Colorado, Connecticut, Virginia, Utah, and similar state privacy laws, because it involves disclosing an online identifier to a third party for cross-site advertising purposes. See Section 8 for your opt-out rights, including how we honor the Global Privacy Control (GPC) browser signal.

You can control cookies through your browser settings, and, where legally required, through a cookie-preference banner on our website. Disabling essential cookies may prevent parts of the Service from working.

We retain personal information for as long as reasonably necessary for the purposes described in this Policy:

• Customer account data: for the duration of your account plus a reasonable period afterward for legal, tax, dispute-resolution, and backup purposes;
• Territory Data: for as long as the applicable Territory is active or licensed source data remains current, refreshed and purged consistent with our data licensing agreements; and
• Marketing/analytics data: consistent with the retention settings of the applicable analytics/advertising platform, generally 14–26 months unless you opt out sooner.

We may retain de-identified or aggregated data indefinitely.

The Service is intended for licensed professionals and is not directed to, and we do not knowingly collect personal information from, individuals under 18. If we learn we have collected personal information from a child under 18 without appropriate consent, we will delete it.

To exercise any right described in this Policy, contact us at:

Email: info@crestalball.com
Mail: Koncierge, Inc. d/b/a CRESTAL BALL, [mailing address — to be completed]

For homeowners without a CRESTAL BALL account, please include the property address and your name so we can locate and verify your information; we may ask for additional information solely to verify your identity or authority to make the request. If we deny your request, Colorado and Connecticut residents may appeal by replying to our denial email with the word "Appeal," and we will respond within 60 days, after which you may contact your state Attorney General.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and vendor security review. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

The Service may link to or integrate with third-party services (payment processors, MLS portals, mapping providers). This Policy does not cover those third parties' privacy practices; review their own privacy policies.

We may update this Policy from time to time. Material changes will be reflected by a new "Last Updated" date and, for material changes affecting Customers' rights, additional notice (e.g., email or in-Service notice) consistent with our Terms of Service.

Koncierge, Inc. d/b/a CRESTAL BALL
[Mailing Address — to be completed]
Privacy inquiries: info@crestalball.com
General/legal: info@crestalball.com