LEGAL
Privacy Policy
The text below is the agreement itself, reproduced in full. Nothing on the rest of this site modifies it. Read it alongside our Terms of Service.
Questions about your data? Our team will answer them.
Full text of the Privacy Policy
Agreement to Policy
This Privacy Policy constitutes a legally binding agreement made between you, whether personally or on behalf of an entity (“you”) and ExactEstate (“Company”, “we”, “us”, or “our”), concerning your access to and use of the https://*.exactestate.com website as well as any other media form, media channel, mobile website or mobile application related, linked, or otherwise connected thereto (collectively, the “Site”). You agree that by accessing the Site, you have read, understood, and agreed to be bound by this Privacy Policy. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, THEN YOU ARE EXPRESSLY PROHIBITED FROM USING THE SITE AND YOU MUST DISCONTINUE USE IMMEDIATELY.
We care about data privacy and security. By using the Site, you agree to be bound by this Privacy Policy, which is incorporated into our Terms of Service. Please be advised that the Site is hosted in the United States. If you access the Site from any other region of the world with laws or other requirements governing personal data collection, use, or disclosure that differ from applicable laws in the United States, then through your continued use of the Site, you are transferring your data to the United States, and you agree to have your data transferred to and processed in the United States.
SMS Messaging and Mobile Opt-In Privacy
When you provide a mobile phone number and choose to opt in, ExactEstate may use that number to send SMS messages related to demo scheduling, product inquiries, account updates, and support. Message frequency may vary. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help.
ExactEstate does not sell, rent, or share SMS opt-in consent, mobile phone numbers, or SMS message data with third parties or affiliates for their marketing or promotional purposes. SMS opt-in data is used only to provide the messaging program requested by the user and to support related service communications.
Cookies and Similar Technologies
The Site uses cookies and similar technologies in three groups. Strictly necessary cookies keep the Site working, protect it from abuse and remember the choice you make in the cookie notice; they are always on. Analytics cookies (Google Analytics) tell us which pages and tools are used so we can improve the Site; they run only after you allow them. Marketing cookies and pixels let us measure our campaigns and recognize returning companies so a representative can follow up; they include Google Tag Manager and the tags it loads (LinkedIn Insight, Microsoft Advertising and Meta), visitor-identification services (Leadpipe and RB2B) and our own ExactOps visitor tag; they also run only after you allow them.
When you first visit we ask for your choice, and nothing in the analytics or marketing groups runs until you make it. You can accept all, reject everything that is not strictly necessary, or choose group by group, and you can change your choice at any time with the “Cookie settings” control in the footer of every page. We ask again after twelve months. If your browser sends a Global Privacy Control signal we treat it as an opt-out of marketing cookies and of the sale or sharing of personal information, and the notice says so. Rejecting cookies does not affect your ability to use the Site, book a demo or contact us.
Google Analytics and the Google tags above receive your choice through Google Consent Mode and do not store analytics or advertising cookies unless you have allowed that group. Cookie lifetimes vary by provider; your choice itself is stored in your browser for up to twelve months.
Biometric Data (ExactID Identity Verification)
Version ee-exactid-legal-2026-10-10c, effective October 10, 2026. It matches the ExactID Biometric Data Policy (version ee-exactid-biometric-policy-2026-10-10c) that applicants see before any photo is taken.
Scope. This section applies when a rental property that uses ExactEstate asks an applicant to verify their identity with ExactID, ExactEstate's identity-verification feature. It is ExactEstate's written biometric data policy, available to the public, including our retention schedule and guidelines for permanently destroying biometric data. It is written to meet the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (CUBI, Tex. Bus. & Com. Code § 503.001), Washington's biometric identifier law (RCW 19.375), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, the Fair Credit Reporting Act (FCRA) and fair housing laws. Where these laws differ, we follow the strictest rule.
What we collect. Photos of the front and back of the applicant's government-issued photo ID (or the photo page of a passport), and a short series of selfie photos taken while the applicant turns their head as prompted. From these photos ExactID measures face geometry to compare the selfie with the ID photo and to confirm that a live person took the selfie. Face geometry is a "biometric identifier" and "biometric information" under BIPA, a "biometric identifier" under CUBI and RCW 19.375, "sensitive personal information" under the CCPA/CPRA, and "sensitive data" under the Colorado, Virginia and Connecticut acts.
Purpose (notice at collection). We use these photos and face data only to confirm that the applicant is the person on the ID for the rental application they are completing. We do not use them for advertising, profiling, inferring characteristics, training models, or any other or later purpose.
Informed written consent before collection. Before any photo is taken, ExactID shows the applicant what is collected, why, how long anything is kept, and this policy, and the applicant must tick "I agree to take photos of my ID and face." That is the applicant's informed written release (an electronic signature) under BIPA and their opt-in consent to processing sensitive data under the CCPA/CPRA and the Colorado, Virginia and Connecticut acts. We record who agreed, when, and the version of the consent text and policy shown. Applicants may instead choose "Verify in person instead"; that choice never counts against their application.
Handling. Photos travel over an encrypted connection to the ExactID verification service and are processed in memory only for the length of the check (usually seconds). ExactEstate does not store ID photos, selfie photos or face data (face geometry, templates or embeddings) in any database, file, backup or log. We protect them using the reasonable standard of care in our industry and in a manner at least as protective as the way we protect our other confidential and sensitive information.
Retention schedule and destruction. Photos and face data are permanently destroyed when the check ends, which is when the initial purpose for collecting them has been satisfied. That is within every applicable limit: BIPA (destruction when the initial purpose is satisfied or within 3 years of the individual's last interaction, whichever occurs first), CUBI (within a reasonable time and no later than the first anniversary of the date the purpose expires) and RCW 19.375 (no longer than reasonably necessary). What we keep is not biometric: the result of the check (no issues found, needs review, or staff must look), short per-check reasons and the consent record. These are kept as part of the applicant's application record for as long as the property retains that record under its record-retention schedule, and are deleted when the application record is deleted or sooner on request where the law allows.
No sale; limited disclosure. We do not sell, lease, trade or otherwise profit from biometric identifiers or biometric information, and we do not "sell" or "share" them for cross-context behavioral advertising. We disclose them only to the ExactID verification service that performs the check on our behalf under a written contract that limits it to this purpose and requires equivalent protection, or where required by law, a valid warrant or a subpoena. The result of the check (not the photos or face data) is shared only with the property the applicant applied to.
Your rights. You may ask to know what we hold about you, to receive a copy, to correct it, or to delete it. California residents may also ask us to limit the use of their sensitive personal information; we use it only to perform the check requested. Residents of Colorado, Virginia and Connecticut may withdraw consent and may appeal if we decline a request. We will not discriminate against you for exercising these rights. To make a request, use the Privacy and biometric data request form on the ExactEstate pages of the property you applied to (linked from the ExactID consent screen, the ExactID Biometric Data Policy and the applicant portal), ask that property's leasing office, or use our contact form. We verify your identity before acting and respond within 45 days.
Housing decisions, FCRA and fair housing. ExactID only confirms identity; it does not report credit, rental, eviction or criminal history. Its result is advisory for the property's staff and is never the sole basis for approving or denying housing. Properties must make an individualized decision, offer the in-person alternative, and must not use ExactID to treat anyone differently because of race, color, religion, sex, national origin, disability, familial status or any other protected characteristic. If a property takes adverse action based in whole or in part on information in a consumer report, the FCRA's adverse-action notice requirements apply to that property. ExactEstate is not a consumer reporting agency as defined by the Fair Credit Reporting Act. ExactID results are provided to the property as a tool to confirm identity and review documents; ExactEstate does not furnish consumer reports, and the property alone makes and is responsible for any decision and any notice it requires.
Effective date
Effective October 10, 2026 (ExactID biometric data section added); previously effective October 5, 2026 (cookie section added); previously effective July 6, 2026.
Questions? Contact us.