Privacy Policy

1. Introduction

This Privacy Policy explains how Huntsville Real Estate Investors LLC ("HREI," "we," "our," or "us") collects, uses, discloses, and protects your personal information when you:

• Visit our website at hreinvestor.com (the "Site")
• Communicate with us via phone, SMS/text message, or email
• Submit forms or inquiries through our website
• Use our Grasshopper business phone system
• Interact with our services in any capacity

By using our Site or services, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use our Site or services.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information you voluntarily provide, including:

• Contact Information: Name, phone number, email address, mailing address
• Property Information: Property address, condition, sale timeline, ownership details
• Communication Content: Messages, inquiries, and information shared during calls, texts, emails, or form submissions
• Account Information: Username, password (encrypted), and membership details if you create an account

2.2 Information Collected Automatically

When you visit our Site, we automatically collect certain technical information:

• Device & Browser Information: IP address, browser type and version, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, referring/exit pages
• Cookies & Tracking Technologies: We use cookies, web beacons, and similar technologies to enhance user experience and analyze site traffic (see Section 3)
• Location Data: General geographic location based on IP address (not precise GPS location)

2.3 Information from Third Parties

We may receive information from:

• Public records (property ownership, tax records)
• Data brokers or marketing partners (with your consent)
• Social media platforms (if you interact with us there)

3. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Remember your preferences and settings
• Analyze site traffic and user behavior (via Google Analytics or similar services)
• Improve site functionality and user experience
• Deliver relevant content and advertisements

Types of Cookies We Use:

• Essential Cookies: Required for site functionality (e.g., login sessions)
• Analytics Cookies: Help us understand how visitors use our Site
• Marketing Cookies: Track your activity to deliver personalized ads

Managing Cookies: You can control cookies through your browser settings. Note that disabling cookies may limit site functionality.

4. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: Respond to inquiries, provide real estate services, process transactions
• Communication: Send appointment reminders, transaction updates, follow-ups, and business-related communications
• Marketing: Send promotional offers, newsletters, and updates (with your consent; you may opt out anytime)
• Site Improvement: Analyze usage patterns, troubleshoot issues, enhance user experience
• Legal Compliance: Comply with legal obligations, enforce our terms, protect our rights
• Fraud Prevention: Detect and prevent fraudulent or unauthorized activity

5. SMS/Text Messaging Terms

By providing your phone number and agreeing to receive texts, you consent to receive text messages from HREInvestor from 256-242-8207 regarding customer care and marketing.

• Consent: Consent is not a condition of purchase
• Frequency: Message frequency may vary
• Rates: Message and data rates may apply
• Opt-Out: Reply STOP to unsubscribe at any time
• Help: Reply HELP for assistance or contact us at 256-242-8207 or office@hreinvestor.com

TCPA Compliance: We comply with the Telephone Consumer Protection Act (TCPA). Mobile opt-in information is never shared with third parties for any purpose.

Data Transfer Prohibition: Mobile opt-in information and any personal data collected for messaging will never be shared, sold, disclosed, or transferred to third parties for any purpose, even with user consent.

6. Data Sharing and Transfer Prohibition

Absolute Prohibition on Data Transfer:

• We do not share, sell, rent, license, disclose, or transfer consumer data to any external organization under any circumstances, even with user consent.
• Mobile opt-in information, consent records, phone numbers, message content, and any personal data collected for messaging or business communications will never be shared or transferred to any third party for any purpose.
• Service providers and vendors do not receive mobile opt-in data or personal data collected for messaging. Messaging data remains within HREI-controlled systems only.
• Customer data is not used for cross-context behavioral advertising or data monetization.

6.1 Limited Internal Use Only

Personal information is used solely by authorized HREI personnel for the following internal purposes:

• Responding to your property inquiries and providing real estate services
• Sending transactional communications (appointment reminders, offer updates, closing details)
• Maintaining our customer relationship management (CRM) system
• Complying with legal obligations

6.2 Legal Disclosures (Non-Voluntary)

We may be legally compelled to disclose information in response to:

• Valid subpoenas or court orders
• Government or regulatory requests required by law
• Protection of our legal rights when required by law

Important: Even in these cases, mobile opt-in data and SMS consent information is never disclosed.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, customer data may be transferred to the acquiring entity. However:

• You will be notified of any such change
• The acquiring entity will be bound by the same data protection obligations
• Mobile opt-in and SMS consent data will remain subject to the same transfer prohibitions

Absolute Guarantee: Customer data is not shared with third parties for promotional or marketing purposes. Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned elsewhere in this policy excludes mobile opt-in data.

7. Data Retention

We retain your personal information for as long as necessary to:

• Fulfill the purposes described in this Privacy Policy
• Comply with legal, accounting, or reporting requirements
• Resolve disputes and enforce our agreements

Retention Periods:

• Active Leads/Customers: Retained while relationship is active and for 7 years thereafter for legal/tax purposes
• Marketing Contacts: Retained until you opt out or request deletion
• Website Analytics: Aggregated data retained indefinitely; individual data retained for 26 months (Google Analytics default)

When data is no longer needed, we securely delete or anonymize it.

8. Data Security and Access Controls

We implement comprehensive administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction.

8.1 Technical Security Measures

• Encryption: Data is encrypted in transit using SSL/TLS 1.2+ and at rest using industry-standard encryption algorithms
• Secure Authentication: Multi-factor authentication (MFA) is required for all administrative access to systems that store or process customer data
• Role-Based Access Control (RBAC): Access to customer and messaging data is restricted to authorized personnel based on job function and granted on a least-privilege basis
• Data Handling Restrictions: Export, external transmission, or transfer of messaging-related data is disabled or strictly controlled through technical measures

8.2 Administrative Controls

• Access Logging and Monitoring: All access to customer and messaging data is logged and monitored. Logs are retained and reviewed regularly
• Regular Audits: We conduct quarterly access reviews and periodic security audits to verify that no unauthorized access or data sharing has occurred
• Employee Training: Personnel receive ongoing training on data protection, SMS compliance (TCPA), and prohibited data transfers
• Vendor Management: Any third-party service providers are contractually prohibited from accessing mobile opt-in or SMS consent data

8.3 Physical Security

• Secure data centers with restricted physical access
• Environmental controls and monitoring
• Secure disposal of physical media containing customer data

8.4 Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify you and relevant authorities as required by law, typically within 72 hours of discovery
• Provide details about the nature of the breach and steps being taken
• Offer guidance on protective measures you can take

Note: No method of transmission or storage is 100% secure. While we implement industry-leading security measures and conduct regular audits to protect your data, we cannot guarantee absolute security.

9. Your Privacy Rights

9.1 General Rights (All Users)

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Opt-Out: Unsubscribe from marketing emails or texts at any time
• Object: Object to certain processing activities (e.g., direct marketing)

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request details about the categories and specific pieces of personal information we collect, use, and disclose
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell personal information, but you may opt out if this changes
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Information: Request limits on use of sensitive personal information

Categories of Information Collected (CCPA Disclosure):

• Identifiers (name, email, phone, IP address)
• Commercial information (transaction history, property inquiries)
• Internet activity (browsing history, site interactions)
• Geolocation data (general location from IP address)
• Professional information (if provided)

9.3 Alabama Residents (HB 283 Compliance)

If Alabama House Bill 283 (Consumer Data Privacy Act) is enacted, Alabama residents will have rights similar to CCPA, including rights to access, delete, correct, and opt out of certain data processing activities. We will update this policy accordingly.

9.4 How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: office@hreinvestor.com
• Phone: 256-242-8207
• Mail: 119 Terry Drake Road, Owens Cross Roads, AL 35763

We will respond to verified requests within 45 days (or as required by applicable law). We may request additional information to verify your identity before processing your request.

10. Children's Privacy (COPPA Compliance)

Our Site and services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will promptly delete it.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at office@hreinvestor.com.

11. Third-Party Links and Services

Our Site may contain links to third-party websites or services (e.g., social media platforms, partner sites). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) signal. Our Site does not currently respond to DNT signals. We will update this policy if our practices change.

13. International Users

Our services are primarily intended for users in the United States, specifically Alabama. If you access our Site from outside the U.S., your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using our Site, you consent to this transfer.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. Updates will be posted on this page with a revised "Effective Date."

Material Changes: If we make material changes that significantly affect your rights, we will notify you by email (if you have provided one) or by posting a prominent notice on our Site at least 30 days before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: