Cookies notice.

Purpose

This Cookies Notice (the “Notice”) explains how Vestora Technologies LLC (“Vestora,” “we,” “us,” or “our”) uses cookies, web beacons, local storage, software development kits, and similar tracking technologies (collectively, “Cookies”) when you visit our website at vestoraiq.com or use the Vestora platform, including the Vestora iOS application and any related services (collectively, the “Platform”). This Notice supplements and should be read together with our Privacy Policy and any applicable Master Services Agreement, Terms of Service, or Brokerage Subscription Agreement in effect between Vestora and your brokerage or you. Defined terms used in this Notice and not otherwise defined have the meanings given in the Privacy Policy.

Scope

This Notice applies to all visitors and users of the Platform, including unauthenticated visitors browsing the public website, prospective customers requesting a demo or joining the waitlist, and Authorized Users (as defined in the Privacy Policy) at contracted Brokerage Tenants. This Notice does not apply to third-party websites that link to or from the Platform; those websites have their own cookies and privacy practices.

Geographic coverage

Vestora operates exclusively within the United States and, at the date of this Notice, makes the Platform available only to users located in the United States. References in this Notice to laws and consent frameworks reflect U.S. legal practice and applicable U.S. state privacy laws. Vestora is not subject to the European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation, or other non-U.S. privacy regimes, and the Platform is not configured for compliance with those regimes.

Updates

We may update this Notice from time to time to reflect changes in the Cookies we use, changes in applicable law, or changes in our business practices. Any updated Notice will be posted on the Platform with a revised “Last Updated” date. Material changes will be communicated to Authorized Users through in-application notice and, where appropriate, by email.

Definition

A cookie is a small text file that a website places on your device (computer, tablet, or phone) when you visit. Cookies allow the website to recognize your device on subsequent visits, remember your preferences, keep you signed in, measure how the site is used, and support security functions. Similar technologies include web beacons (small invisible images that track whether a page or email has been viewed), local storage (a browser feature that stores data on your device similar to cookies but with greater capacity), and software development kits or “SDKs” embedded in mobile applications that perform comparable functions.

Session vs. persistent cookies

Cookies are commonly classified by duration. A session cookie is deleted automatically when you close your browser. A persistent cookie remains on your device for a defined period (which may be days, months, or years) until it expires or is deleted. Vestora uses both types, depending on the function the cookie performs.

First-party vs. third-party cookies

A first-party cookie is set by the domain you are visiting (in our case, vestoraiq.com or the Vestora application). A third-party cookie is set by a different domain than the one you are visiting, typically by a service provider whose code is embedded in the page (such as an analytics or fraud-prevention service). Vestora uses both first-party and third-party cookies, as detailed in the Third-party cookies and service providers section.

Mobile application tracking

On the Vestora iOS application, similar functionality is performed through device identifiers and SDK-based analytics rather than browser cookies. References in this Notice to “Cookies” include these mobile-equivalent technologies. The categories, purposes, and choices described in this Notice apply equally to our mobile Platform.

Vestora groups the Cookies it uses into four functional categories. The categories below describe the purpose of each group; the specific cookies in use, including provider names and retention periods, are listed in the Cookie inventory section below.

Strictly necessary cookies

These Cookies are essential to the operation of the Platform and cannot be disabled while you are using the Platform. They support core functions such as authenticating users, maintaining a logged-in session, enforcing multi-factor authentication, routing requests to the correct server, applying our security controls (including row-level data isolation between brokerages), and remembering items required for the page to function correctly. Without these Cookies, the Platform cannot be provided. Because they are essential, Vestora does not seek consent for these Cookies; we rely on the legitimate-interest basis described in the Legal basis and consent section.

Functional cookies

These Cookies allow the Platform to remember your preferences and provide enhanced functionality. Examples include remembering your dashboard layout, your saved Watchlists, your default Map View, time zone, and similar interface preferences. Functional Cookies do not track you across websites and are not used for advertising. Disabling Functional Cookies will not prevent you from using the Platform but may require you to reset your preferences each time you log in.

Analytics and performance cookies

These Cookies help us understand how visitors and users interact with the Platform so that we can improve them. They report metrics such as which pages are visited, how long users spend on each page, what features are used most often, and where users encounter errors. Analytics Cookies use industry-standard tooling and, where supported by the provider, are configured to anonymize or pseudonymize identifiers. We do not use Analytics Cookies to build advertising profiles or to sell your information.

Security and fraud-prevention cookies

These Cookies support our security posture by detecting suspicious patterns of access (including impossible-travel logins and new-device sign-ins), supporting our web application firewall, and protecting against denial-of-service attacks. Some Security Cookies are set by our infrastructure providers, including Cloudflare and Supabase.

Cookies we do not use

Vestora does not use advertising Cookies, retargeting Cookies, cross-context behavioral advertising Cookies, social-media tracking Cookies, or any Cookies that share personal information with third parties for advertising purposes. We do not sell personal information collected through Cookies, and we do not engage in “share” of personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

Cookie inventory

An inventory of the specific Cookies in use on the Platform, including the name, provider, category, purpose, and approximate retention period of each Cookie, is set forth in the Cookie inventory section near the end of this Notice. The inventory is updated periodically as Cookies are added or removed.

Changes between inventory updates

Because Cookies set by third-party service providers may change without notice from those providers, the inventory below is provided for informational purposes and may not always reflect the most current state. We make commercially reasonable efforts to maintain accuracy and review the inventory at least annually.

Authoritative source

If you wish to inspect the actual Cookies set on your device by the Platform, your web browser provides this capability through its developer tools or privacy settings. Browser-specific instructions are provided in the Browser cookie management section near the end of this Notice.

The following third-party service providers may set Cookies through the Platform. Each is bound by a contractual data-processing agreement with Vestora that limits the use of any data collected to the purposes described below.

• Supabase, Inc. — backend infrastructure, authentication, and session management. Supabase sets Cookies necessary for user authentication and session continuity. Supabase’s privacy practices are governed by its own privacy policy, available at supabase.com/privacy.
• Vercel, Inc. — application hosting and content delivery. Vercel may set Cookies for routing and performance. Vercel’s privacy practices are available at vercel.com/legal/privacy-policy.
• Cloudflare, Inc. — web application firewall, denial-of-service protection, and content delivery. Cloudflare sets Cookies for security, fraud detection, and bot mitigation. Cloudflare’s privacy practices are available at cloudflare.com/privacypolicy.
• Sentry (Functional Software, Inc.) — application error monitoring. Sentry uses identifiers to associate error reports with sessions for debugging purposes. Sentry’s privacy practices are available at sentry.io/privacy.
• Google LLC (Google Workspace, Google Authenticator support) — used for our internal email and document infrastructure. Google does not set tracking Cookies on the Platform in connection with end-user use of the Vestora platform.

Provider changes

We may change service providers from time to time. Material changes that affect the categories of data collected through Cookies will be reflected in an updated version of this Notice. We do not engage advertising-network providers and do not anticipate adding any.

Data processing agreements

Each third-party service provider that processes data through Cookies on our behalf is contractually obligated under a data-processing agreement to use that data only for the purposes for which it was collected, to maintain appropriate security measures, and to delete or return the data when no longer needed. Vestora’s broader sub-processor list and disclosures regarding public-record sources, DBPR license verification, and Stripe Identity are set forth in the Privacy Policy. Vestora does not activate an MLS feed in its public-record-only launch mode.

United States legal framework

Vestora processes data collected through Cookies in accordance with applicable U.S. federal and state privacy laws, including (where applicable) the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Florida Digital Bill of Rights, and similar state laws as enacted. We do not currently operate in jurisdictions subject to the GDPR or UK GDPR.

Strictly necessary cookies

Strictly Necessary Cookies are processed on the basis of our legitimate interest in operating, securing, and providing the Platform, and on the basis of contractual necessity for authenticated users. These Cookies are not subject to consent because they are essential to providing the Platform you have requested.

Functional, analytics, and security cookies

For Functional, Analytics, and Security Cookies that are not strictly necessary, Vestora provides notice through this Notice and through the cookie banner displayed on first visit to the Platform. Where required by applicable state law, your continued use of the Platform following such notice constitutes acknowledgment of the Cookies described herein. You may withdraw any consent and exercise the choices described in the Your choices section at any time.

Sale and sharing

Vestora does not sell personal information and does not share personal information for cross-context behavioral advertising purposes. Accordingly, no opt-out is required under the “Do Not Sell or Share My Personal Information” provisions of applicable state laws. You may nonetheless exercise rights to access, correct, delete, or port your personal information by contacting us as described in the Contact information section.

Browser controls

Most web browsers allow you to view, manage, delete, and block Cookies for any website. Detailed instructions for the major browsers are provided in the Browser cookie management section near the end of this Notice. Please note that disabling Strictly Necessary Cookies will prevent you from using the Platform.

Cookie preferences in the Platform

Where applicable, Vestora provides in-application controls to manage non-essential Cookies. These controls can be accessed from your account settings under “Privacy and Cookies.” Changes take effect immediately upon save and apply prospectively to subsequent sessions.

Mobile application controls

On the Vestora iOS application, you may manage tracking through your device’s privacy settings, including Apple’s App Tracking Transparency framework. Disabling tracking will not prevent you from using the application but may limit certain analytical features used to improve the Platform.

Effect of disabling cookies

Disabling Functional Cookies may cause the Platform to forget your preferences between sessions. Disabling Analytics Cookies will not affect your ability to use the Platform but will limit Vestora’s ability to identify and resolve issues that affect you. Disabling Security Cookies is not recommended and may expose your account to detection and prevention failures for fraudulent access attempts.

Do Not Track

The Platform currently does not respond to browser “Do Not Track” (DNT) signals, because no industry consensus exists on how such signals should be interpreted. Vestora’s practices regarding the sale and sharing of personal information are described in the Legal basis and consent section above and in the Privacy Policy. Because Vestora does not engage in cross-site tracking or behavioral advertising, our practices are consistent with the user expectations underlying DNT regardless of the signal’s state.

Global Privacy Control

Vestora recognizes the Global Privacy Control (“GPC”) signal as a valid request to opt out of the sale or sharing of personal information for cross-context behavioral advertising, where applicable under state law. Because Vestora does not sell or share personal information for these purposes, GPC signals require no further action on our part to be honored.

Age restriction

The Platform is intended for use only by individuals who are at least eighteen (18) years of age and who hold an active real estate license issued by a U.S. state regulatory authority. The Platform is not directed to children, and we do not knowingly collect personal information through Cookies or otherwise from children under thirteen (13) years of age. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take prompt steps to delete that information.

COPPA

This Notice is consistent with the requirements of the Children’s Online Privacy Protection Act (“COPPA”). If you believe that a child has provided personal information to Vestora, please contact us as described in the Contact information section.

Right to update

Vestora reserves the right to modify this Notice at any time. The most current version will always be available at vestoraiq.com/cookie-policy, and the revised “Last Updated” date will be displayed at the top of this document.

Notice of material changes

Where changes are material — for example, the addition of a new category of Cookies or a new third-party provider that materially changes how Cookies are used — Vestora will provide notice to authenticated users through in-application notification and, where appropriate, by email. Continued use of the Platform following notice of changes constitutes acknowledgment of the updated Notice.

Archived versions

Prior versions of this Notice may be made available on request by contacting us at the address listed in the Contact information section. We retain archived versions for a minimum of three (3) years.

Inquiries

Questions, concerns, or requests related to this Notice or the Cookies used by Vestora may be directed to Vestora’s privacy team at legal@vestoraiq.com.

Response timeframe

We will acknowledge receipt of inquiries within ten (10) business days and respond substantively within thirty (30) days, except where applicable law provides a longer or shorter response time.

State-specific rights requests

Residents of states with applicable privacy laws may exercise their rights to access, correct, delete, port, opt out of sale or sharing, or limit the use of sensitive personal information by contacting us at the address above. We will verify such requests in accordance with applicable law before responding.

The following is a non-exhaustive inventory of Cookies set by the Platform. The inventory is updated periodically; the version below reflects the state of the Platform at the date of this Notice. Cookies set by third-party providers may change without notice from those providers. Each entry identifies the cookie name, provider, purpose, and approximate retention period.

Strictly necessary cookies

• sb-access-token — Provider: Supabase. Purpose: maintain authenticated session. Retention: 1 hour (rotates).
• sb-refresh-token — Provider: Supabase. Purpose: refresh expired access tokens. Retention: 7 days.
• vestora-mfa-state — Provider: Vestora (first-party). Purpose: track multi-factor authentication enrollment status. Retention: session.

Functional cookies

• vestora-prefs — Provider: Vestora (first-party). Purpose: remember dashboard layout, theme, and time zone. Retention: 365 days.
• vestora-map-state — Provider: Vestora (first-party). Purpose: remember last viewed region in Map View. Retention: 90 days.

Analytics and performance cookies

• vestora-analytics-id — Provider: Vestora (first-party). Purpose: anonymized usage analytics for product improvement. Retention: 13 months.
• sentry-trace — Provider: Sentry. Purpose: associate error reports with user sessions for debugging. Retention: session.

Security and fraud-prevention cookies

• __cf_bm — Provider: Cloudflare. Purpose: bot management and abuse detection. Retention: 30 minutes (rotating).
• cf_clearance — Provider: Cloudflare. Purpose: confirm a visitor passed Cloudflare’s security challenge. Retention: 30 days.
• vestora-device-id — Provider: Vestora (first-party). Purpose: detect new-device sign-ins for step-up MFA. Retention: 365 days.

Each major browser provides controls to view, delete, and block Cookies. The following references are provided for convenience; current instructions are maintained by the respective browser providers and may change over time.

Google Chrome

Settings → Privacy and security → Cookies and other site data. Reference: support.google.com/chrome/answer/95647.

Apple Safari (Desktop)

Safari → Preferences → Privacy → Manage Website Data. Reference: support.apple.com/guide/safari.

Apple Safari (iOS / iPadOS)

Settings → Safari → Privacy & Security → Block All Cookies (or Advanced → Website Data). Reference: support.apple.com/HT201265.

Mozilla Firefox

Settings → Privacy & Security → Cookies and Site Data. Reference: support.mozilla.org/kb/clear-cookies-and-site-data-firefox.

Microsoft Edge

Settings → Cookies and site permissions → Manage and delete cookies and site data. Reference: support.microsoft.com/microsoft-edge.

iOS application tracking

Settings → Privacy & Security → Tracking. You may also adjust permissions for the Vestora application individually under Settings → Vestora.