Privacy Policy

CDAFlow is a brokerage operations platform developed and operated under the CDAFlow name. The platform provides agent management, transaction tracking, commission automation, document workflows, and reporting tools to licensed real estate brokerages (“Clients”).

For purposes of data protection law, your brokerage (the Client) is the data controller — the entity that determines how your personal data is used within the platform. CDAFlow acts as a data processor, processing personal data solely on your brokerage's instructions and within the scope of our subscription agreement with them.

Account and identity data

• Full name, email address, and phone number
• Role within the brokerage (agent, admin, broker-owner)
• License number and expiration date
• Profile information added during onboarding

Transaction and commission data

• Real estate transaction records associated with your account
• Commission amounts, splits, and disbursement records
• Document upload history related to transactions

Usage and technical data

• Login timestamps and session activity
• Features accessed and actions taken within the platform
• Browser type, device information, and user agent
• Error logs and performance diagnostics

Communications

• Transactional emails sent through the platform (notifications, alerts, document delivery)
• Support requests and correspondence with our team

• Platform operation: Authenticating your account, enabling features, and fulfilling your brokerage's subscription
• Transaction management: Processing and storing transaction records, commissions, and documents on behalf of your brokerage
• Communications: Sending transactional emails via Postmark and responding to support requests
• Security: Detecting and preventing unauthorized access, fraud, and policy violations
• Compliance:Retaining records as required by applicable law, including TREC's four-year retention requirement for Texas-based brokerages
• Product improvement: Analyzing aggregated, de-identified usage data to improve platform features

We do not sell your personal data. We do not use your data for advertising or share it with third parties for their own marketing purposes.

CDAFlow uses a tiered infrastructure model. The database environment assigned to your brokerage is determined by your subscription plan and is disclosed in the Platform Subscription Agreement.

Multi-tenant clients (Small Team, Growth, Scale): Your data is logically separated from other brokerages through row-level security enforced at the database layer. No user from another brokerage can access your records. However, your data co-resides on shared infrastructure. In the event of a platform-level security incident, this shared environment could be affected.

Silo clients (Enterprise, Premier): Your brokerage's data is stored in a fully dedicated, isolated database. A security incident affecting another client's environment does not affect your data.

We share personal data only with sub-processors who assist in operating the platform, under data processing agreements that require them to protect your data. Our current sub-processors are:

Google Analytics scope: Google Analytics is used only on the public-facing CDAFlow marketing website (cdaflow.com). It is not present inside the authenticated platform application. Marketing site visitors may opt out via browser settings or the Google Analytics Opt-out Browser Add-on.

We may update this list as sub-processors change. We will notify affected Clients of material changes in accordance with the Platform Subscription Agreement. We may also disclose data when required by law, court order, or to protect the rights, property, or safety of CDAFlow, our clients, or others.

When a brokerage subscribes to CDAFlow and accepts the Platform Subscription Agreement, it assumes responsibility as the data controller for all personal data belonging to its agents, administrators, and staff that is entered into or processed through the platform.

This means the brokerage is responsible for:

• Ensuring it has a lawful basis for providing its agents' personal data to CDAFlow
• Informing its agents and staff that their data is processed on the platform
• Receiving and responding to data rights requests from individual agents
• Ensuring agents and administrators comply with acceptable use obligations when accessing the platform

Individual users who access CDAFlow through their brokerage's account are bound by the platform's Terms of Use, which are presented at login and accepted through clickwrap acknowledgment. By checking the acceptance box and logging in, each user agrees that their access and use of the platform is governed by those terms, which are available at cdaflow.com/terms. CDAFlow records the timestamp and Terms version accepted by each user at the time of acknowledgment.

In plain terms: Your brokerage controls your data on this platform. CDAFlow processes it only on their instruction. If you have questions about how your data is used, your first point of contact is your broker or brokerage administrator.

Depending on the state or jurisdiction where you are located, you may have rights under applicable privacy law regarding your personal data. CDAFlow complies with applicable U.S. state privacy laws, including but not limited to the Texas Data Privacy and Security Act (TDPSA) and the Colorado Privacy Act (CPA), as they apply to our role as a data processor.

Rights you may have

• Access: The right to confirm whether we process your personal data and to obtain a copy of it
• Correction: The right to correct inaccurate personal data we hold about you
• Deletion: The right to request deletion of your personal data, subject to applicable legal retention requirements
• Portability: The right to receive your personal data in a portable, usable format
• Opt-out: The right to opt out of certain processing activities, such as the sale of personal data or use for targeted advertising — neither of which CDAFlow engages in

How to exercise your rights

Because your brokerage is the data controller for your personal data on CDAFlow, data rights requests should be directed to your brokerage first. Your brokerage has the authority and obligation under applicable law to respond to your request and will coordinate with us as the data processor where needed.

If you are unable to reach your brokerage, or believe your request is not being addressed, you may contact us directly at admin@cdaflow.com and we will assist in routing your request appropriately.

Note on retention limits: Some deletion requests may be subject to mandatory retention periods under applicable law. For example, TREC requires Texas brokerages to retain transaction records for a minimum of four years. We will inform you if a retention requirement affects your request.

We retain personal data for as long as your brokerage's subscription remains active, and for the period required by applicable law thereafter. For Texas-based brokerages, transaction and commission records are retained for a minimum of four years in accordance with TREC regulations.

Upon termination of a brokerage's subscription, CDAFlow will work with the Client to facilitate an orderly transition, including reasonable access to data export. Specific data retention and deletion timelines following termination are governed by the terms of the Platform Subscription Agreement. Clients are encouraged to export their data prior to or promptly following termination.

We implement industry-standard technical and organizational measures to protect personal data, including encryption in transit (TLS) and at rest, row-level security policies, authentication controls, and periodic security reviews.

No security system is impenetrable. In the event of a data breach affecting your personal information, we will notify affected Clients as required by applicable law.

The CDAFlow platform application uses browser local storage to persist your authenticated session token and interface preferences (such as brand settings). These are not advertising cookies and are not shared with third parties. Your authentication session is cleared when you log out.

The CDAFlow marketing website (cdaflow.com) uses Google Analytics to collect anonymized usage data such as page views and traffic sources. Google Analytics uses cookies on the marketing site. This analytics tool is not present inside the authenticated platform application — it is limited to the public marketing website only. Marketing site visitors may opt out using the Google Analytics Opt-out Browser Add-on.

We do not use advertising pixels, retargeting scripts, or any tracking technology that shares your personal data with advertisers.

CDAFlow is designed for licensed real estate professionals and is not directed at individuals under 18. We do not knowingly collect personal data from minors and will delete any such data promptly upon discovery.

We may update this Privacy Policy from time to time. If we make material changes, we will notify active Clients by email at least 30 days before the changes take effect. Continued use of the platform following the effective date constitutes acceptance of the revised policy. The “Last updated” date at the top of this page reflects the most recent revision.

For questions about this Privacy Policy or to submit a data rights request: