Privacy Policy

This Privacy Policy describes how Verity NHD ("Company," "we," "us," or "our") collects, uses, discloses, retains, and protects Personal Information in connection with the Platform, the Services, and our related business operations. This Privacy Policy applies to Personal Information we collect from and about Users of the Platform, visitors to our websites, individuals identified in Orders and Reports, and individuals who communicate with us.

This Privacy Policy does not apply to information practices of third parties that we do not control, including government agencies whose data is incorporated into Reports, the websites of third parties linked from the Platform, or the independent practices of escrow companies, brokerages, or other transaction participants. This Privacy Policy is an informational disclosure of our privacy practices; it is not a contract and does not create contractual rights or obligations. Our Terms of Service, available at veritynhd.com/terms, govern the contractual relationship between you and the Company, and capitalized terms used but not defined in this Privacy Policy have the meanings given in the Terms of Service.

The Platform is designed for use in connection with real property located in the State of California, and our privacy practices are structured principally around California law. This Privacy Policy serves as our notice at collection under the CCPA and is linked from every page of the Platform where Personal Information is collected, including at Account registration and Order submission.

1.1 Our Role.

For Personal Information of Users — Account holders who register for and use the Platform — we determine the purposes and means of processing and act as a "business" under the CCPA. For Personal Information about other transaction participants (such as buyers and sellers) submitted by an Ordering Party, we process that information to complete the disclosure workflow the Ordering Party initiated, as described in this Privacy Policy; the Ordering Party is responsible for having an appropriate basis to provide that information to us. Enterprise agreements with the Company may contain additional data-protection terms that supplement this Privacy Policy for the customers who sign them.

1.2 Accessibility.

We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you have difficulty accessing this Privacy Policy, or would like a copy in an alternative format, please contact us at support@veritynhd.com and we will provide it.

"Aggregated Data" means information that relates to a group or category of individuals, from which individual identities have been removed, and that is not linked or reasonably linkable to any individual or household.

"AI Services" means the artificial intelligence features of the Platform, including the machine-generated compliance summaries branded as Verity AI℠, together with associated document-processing capabilities such as optical character recognition.

"Applicable Privacy Laws" means all privacy and data protection laws applicable to our processing of Personal Information, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, the "CCPA").

"Business Purpose" has the meaning given in the CCPA and refers to our operational purposes for processing Personal Information, as described in Section 6.

"Cookies" means cookies, software development kits, local storage objects, and similar technologies placed on a browser or device.

"Deidentified Data" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual, and that we maintain and use in deidentified form consistent with the CCPA.

"Device Information" means information about the browser and device used to access the Platform, such as browser type, operating system, and IP address.

"Government Data" means data, maps, records, and geographic information obtained from federal, state, regional, county, or municipal governmental agencies and incorporated into Reports.

"Marketing Communications" means email and text messages that promote Company's products and services, as distinguished from transactional messages sent in connection with an Order, signature, invoice, or request you have made.

"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Personal Information does not include Aggregated Data, Deidentified Data, or publicly available information as defined by the CCPA.

"Platform" means the Company's proprietary software-as-a-service platform accessible at veritynhd.com, together with all associated websites, applications, APIs, and related technology.

"Professional Contact Data" means business contact and licensing information about licensed real estate professionals, escrow companies and officers, transaction coordinators, and similar professionals — such as name, company, business email, business and mobile telephone numbers, license type and number, office address, and association membership — obtained from the sources described in Section 3.5.

"Professional Information" means information concerning a User's professional status and credentials, such as real estate or escrow license type and number, brokerage or company affiliation, and business contact details.

"Professional User" means a User who is a licensed California real estate broker, salesperson, escrow officer, title officer, loan officer, attorney, or other professional accessing the Platform in the course of a real property transaction.

"Sensitive Personal Information" has the meaning given in the CCPA and, as relevant to the Platform, includes account log-in credentials in combination with the means of accessing an Account.

"Service Provider" means a third party that processes Personal Information on our behalf for a Business Purpose pursuant to a written contract that restricts the third party's use of that information, consistent with the CCPA.

"Third-Party Data" means data obtained from non-governmental commercial sources, such as licensed property data providers and mapping services, and incorporated into Reports or used to operate the Platform.

"Transaction Information" means information relating to a real property transaction submitted through the Platform, such as property address, assessor's parcel number, escrow file number, the names and email addresses of buyers and sellers, estimated closing dates, and the identity of the designated escrow or settlement agent.

"Usage Data" means information about how the Platform is accessed and used, such as pages visited, features used, actions taken, and timestamps.

"User" and "Account" have the meanings given in the Terms of Service.

3.1 Information You Provide.

We collect Personal Information that you provide directly to us, including:

Account and registration information. Name, email address, password, and company or brokerage name provided when you create an Account.

Professional Information. License type, license number, office telephone number, and mobile telephone number provided by Professional Users, which we use to verify professional credentials as described in Section 6.

Transaction Information. Property address and parcel information, escrow file number, buyer and seller names and email addresses, estimated closing date, and Closing Agent designation submitted in connection with an Order. Some Transaction Information concerns individuals other than the User submitting it, such as buyers and sellers; our role with respect to that information is described in Section 1.1.

Free screen and lead information. When you request a free Preliminary Hazard Screen or ask to receive results, we collect the property address or parcel number you enter, your email address, and, if you provide it, your mobile telephone number and SMS consent. If you place an Order without first creating an Account, we create an Account associated with the email address you provide (see Terms of Service Section 4.5).

Payment information. Payments are processed by our third-party payment processor. We do not store full payment card numbers or bank account numbers on our servers. We receive limited payment-related information from the processor, such as transaction confirmations, payment status, and the last digits and brand of a card, sufficient to administer billing.

Payment method information. Depending on the payment method you select, we collect the escrow company, escrow or file number, escrow officer name, email, and telephone; listing-agent name, company, email, and telephone; or the name, email, and (optionally) mobile telephone number of a property owner or other payor to whom you direct a Payment Invitation. When you select Pay at Close before escrow opens, we record your Payment Acknowledgment together with the date, time, and IP address of the affirmation.

Signature and acknowledgment data. Signatures, acknowledgments, and related completion records captured through the Platform's electronic signature workflows, together with associated audit-trail metadata such as signer email address, timestamps, and IP address, and the escrow-officer confirmation captured when an escrow officer confirms, corrects, or flags an invoice through the invoice link, including timestamp and IP address.

Communications. Messages, inquiries, and any information you choose to include when you contact us through the Platform's contact forms, the resolution center, or support channels.

3.2 Information Collected Automatically.

When you access the Platform, we and our Service Providers automatically collect Usage Data, Device Information, and information gathered through Cookies, including pages visited, features used, session duration, browser type, operating system, and IP address. We also generate audit logs, authentication logs, and security logs reflecting activity on the Platform, including order events, document deliveries, signature events, and administrative actions. Audit trails are a core compliance feature of the Platform and record who took an action and when.

3.3 Information From Other Sources.

We receive information from third parties in the course of providing the Services, including: property, assessment, and ownership data from licensed property data providers; address validation and geocoding data from mapping services; payment status information from our payment processor; signature status and completion data from our electronic signature service; and Government Data from the agencies described in Section 9. Information about a property obtained from these sources may include the names of record owners.

3.4 Sensitive Personal Information.

The only category of Sensitive Personal Information we collect is account log-in credentials (your password, held in protected form, in combination with your email address). We use this information solely to authenticate access to your Account and maintain the security and integrity of the Platform. We do not use or disclose Sensitive Personal Information for purposes other than those permitted by the CCPA without the right to limit, and we do not collect other categories of Sensitive Personal Information such as government identification numbers, precise geolocation, biometric information, or information concerning health, religion, or sexual orientation.

3.5 Professional Contact Data From Other Sources.

For our business-to-business marketing, we collect Professional Contact Data about licensed professionals who may not yet have an Account with us. Sources include: (a) public licensing and registration records and directories, such as the California Department of Real Estate licensee records, the California Department of Financial Protection and Innovation escrow licensee listing, and member directories published by professional associations; (b) licensed commercial data vendors that compile real estate professional contact lists from public and licensed sources; (c) publicly available business listings and mapping services, such as Google business profiles; (d) real estate listing data that identifies the listing agent's name, brokerage, and contact telephone number for an active listing; and (e) email-verification and enrichment services used to confirm or complete business contact details. We use this information as described in Section 6(l) and Section 14, and any professional may opt out at any time as described in Section 14.3 and Section 17.4.

3.6 Disclosure Desk Submissions.

If you submit a question to the Disclosure Desk, we collect the question and any name, email address, or license number you choose to provide. Questions may be published with identifying details removed, as described in the Terms of Service. If you provide an email address, we use it to tell you when your question is answered.

The following summarizes the categories of Personal Information, as enumerated by the CCPA, that we have collected in the preceding twelve (12) months, together with representative examples. All categories are collected from the sources described in Section 5 and used for the purposes described in Section 6.

Identifiers. Name, email address, telephone numbers, IP address, and Account identifiers, including business contact details in Professional Contact Data.

Customer records (Cal. Civ. Code § 1798.80(e)). Contact details, company or brokerage affiliation, and limited payment-related records maintained by our payment processor.

Professional or employment-related information. License type, license number, and brokerage or company affiliation of Professional Users; and Professional Contact Data about licensed professionals obtained from the sources in Section 3.5.

Commercial information. Transaction Information, Order history, Report tiers purchased, invoices, and billing status.

Geolocation information. Property coordinates derived by geocoding a property address; this describes real property, not a person's device, and we do not collect precise geolocation from devices.

Internet or other electronic network activity information. Usage Data, Device Information, Cookies, and log data.

Sensitive Personal Information. Account log-in credentials, as described in Section 3.4.

We do not collect biometric information, precise geolocation information, audio or visual information (other than signature images voluntarily provided through signing workflows), or inferences drawn to create a profile about a consumer's preferences or characteristics. Property addresses and hazard determinations describe real property rather than individuals, but where they are linked to identified buyers, sellers, or owners we treat them as Personal Information.

We collect Personal Information from the following categories of sources: (a) directly from Users and visitors, through Account registration, the free Preliminary Hazard Screen, Order submission, signing workflows, Disclosure Desk submissions, and communications; (b) automatically, from browsers and devices interacting with the Platform; (c) from transaction participants, such as when an Ordering Party provides buyer, seller, owner, listing-agent, or escrow-officer information, a signer completes a signature workflow, or an escrow officer confirms an invoice; (d) from Service Providers, including our payment processor, electronic signature service, property data providers, mapping services, and email and SMS delivery providers; (e) from Government Data sources described in Section 9; and (f) for Professional Contact Data, from public licensing records and directories, professional associations, licensed data vendors, public business listings, real estate listing data, and verification services, as described in Section 3.5.

We use Personal Information for the following Business Purposes:

(a) to create, authenticate, secure, and administer Accounts;

(b) to process and fulfill Orders, generate Reports, and deliver disclosure documents to transaction participants;

(c) to operate escrow, broker, and signing workflows, including dispatching signature requests, tracking signature status, and maintaining audit trails;

(d) to process payments, administer billing (including Escrow Billing, Pay at Close, and Payment Invitations), issue invoices to escrow officers, record Payment Acknowledgments, send billing and escrow-information reminders, and pursue collection of amounts owed;

(e) to verify the professional licenses and credentials of Professional Users, including with the California Department of Real Estate and the California Department of Financial Protection and Innovation;

(f) to send transactional communications by email and, with consent, text message, such as free-screen results, order confirmations, Payment Invitations and payment reminders, signing requests, delivery notices, invoices, and billing notices;

(g) to respond to inquiries, support requests, and resolution-center submissions;

(h) to monitor, maintain, and improve the Platform, diagnose technical issues, and develop new features;

(i) to detect, investigate, and prevent security incidents, fraud, and misuse of the Platform;

(j) to comply with legal obligations, including record-retention obligations associated with California disclosure law; and

(k) to enforce our Terms of Service and protect the rights, property, and safety of the Company, our Users, and others;

(l) to send Marketing Communications to licensed real estate, escrow, and transaction-coordination professionals about Company's products and services, including notices that a free Preliminary Hazard Screen is available for a newly listed property, as described in Section 14; and

(m) to publish anonymized Disclosure Desk questions and answers as educational content.

We may create and use Aggregated Data and Deidentified Data for lawful business purposes, including analytics and product improvement. Where we maintain Deidentified Data, we maintain and use it without attempting to reidentify it (except as permitted by the CCPA to test deidentification), and we contractually require any recipient of Deidentified Data to comply with the same commitments.

California law does not require the articulation of legal bases in the manner of certain other privacy regimes. For transparency: we process Personal Information (a) to perform our contract with you (providing the Platform and fulfilling Orders); (b) to comply with legal obligations (including statutory record retention); (c) for legitimate operational interests such as securing the Platform, preventing fraud, administering billing, and improving the Services; and (d) with your consent, where we ask for it. Where a signer or transaction participant interacts with the Platform at the invitation of an Ordering Party, we process that individual's Personal Information to complete the transaction workflow the Ordering Party initiated.

8.1 AI-Generated Summaries.

Certain Report tiers include an AI Compliance Summary generated by AI Services using an enterprise large-language-model provider. To generate a summary, hazard determinations and related Report data for the subject property are transmitted to the AI provider by API and a natural-language summary is returned. The AI Compliance Summary is a convenience feature; the statutory disclosures in the Report control in all cases, as described in our Terms of Service.

8.2 Document Processing.

The Platform may apply optical character recognition and similar document-processing techniques to documents submitted through Platform workflows in order to extract text, dates, and structured data needed to provide the Services.

8.3 No Training on Your Personal Information.

We do not use your Personal Information to train artificial intelligence models, and we do not permit our AI provider to use Personal Information submitted through our API integration to train its models. Our AI provider processes API inputs and outputs as a Service Provider for the purpose of returning results to the Platform, subject to contractual restrictions on retention and use.

8.4 Limitations.

AI-generated content is probabilistic and may contain errors, omissions, or inaccuracies, including statements that appear plausible but are incorrect. AI output is not reviewed by a licensed professional before delivery unless expressly stated. The models, providers, and configurations used by the AI Services may change over time, and AI features may be modified, interrupted, or discontinued. In the event of any conflict between AI-generated content and Government Data or statutory disclosure content, the Government Data and statutory disclosures control.

8.5 No Automated Decision-Making With Legal Effects.

We do not use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning individuals, and we do not use Personal Information to profile individuals or to predict their characteristics, behavior, or preferences. Hazard determinations in Reports describe real property and are drawn from Government Data, not from AI inference about any individual. Escrow Billing and Pay at Close are available to every Ordering Party without an eligibility decision. The Platform applies an automated limit on the number of open unpaid deferred-payment Orders per Account, as described in the Terms of Service; that limit restricts a payment method, not access to the Services, and a person can always pay by card. Suspension of deferred payment methods for non-payment is decided by our personnel.

Reports are compiled substantially from Government Data and Third-Party Data rather than from information about individuals. Government Data sources include the Federal Emergency Management Agency, CAL FIRE, the California Geological Survey, the California Department of Water Resources, the California Department of Toxic Substances Control, the State Water Resources Control Board, the National Oceanic and Atmospheric Administration, and county and city assessor, recorder, and GIS offices. Third-Party Data sources include licensed property data providers and mapping and address-validation services.

Information obtained from these sources describes real property — hazard zone designations, parcel boundaries, assessments, and recorded ownership — and is distinct from information you provide to us. Public records incorporated into Reports, including recorded ownership information, may constitute publicly available information that is not Personal Information under the CCPA. We do not control, and are not responsible for, the accuracy or content of Government Data, and government agencies may revise their data at any time. Requests to correct government records must be directed to the originating agency.

10.1 How We Use Cookies.

We use Cookies for the following purposes:

Strictly necessary and authentication. Cookies that maintain your session, keep you signed in, and route requests securely. The Platform cannot function without them.

Security. Cookies and similar identifiers that help us detect suspicious activity and protect Accounts.

Preferences. Cookies that remember settings you have chosen.

Analytics. Cookies that help us understand how the Platform is used, as described in Section 11.

We use both session Cookies, which expire when you close your browser, and persistent Cookies, which remain until they expire or are deleted. We do not use Cookies for advertising, and we do not permit third parties to collect Personal Information across other websites over time through our Platform for targeted advertising (i.e., no cross-context behavioral advertising).

10.2 Your Choices.

Most browsers allow you to refuse or delete Cookies through browser settings. If you disable Cookies, portions of the Platform — including sign-in — may not function. We process opt-out preference signals, including the Global Privacy Control (GPC), as valid requests to opt out of the sale or sharing of Personal Information, as the CCPA requires. Because we do not sell Personal Information or share it for cross-context behavioral advertising, receiving such a signal results in no change to our processing; if our practices ever change, we will update this Privacy Policy before doing so and honor previously received signals. We do not respond to legacy "Do Not Track" browser signals, for which no industry standard has been adopted.

We use analytics services, including Google Analytics, to collect Usage Data and Device Information about interactions with our public websites and the Platform, such as pages visited, referral sources, approximate location derived from IP address, and session metrics. We use this information to understand Platform performance and improve the Services. We configure our analytics services to process this information for the purpose of providing analytics to us, and we do not use analytics Cookies for advertising or cross-context behavioral advertising. You can learn more about Google's practices at policies.google.com and opt out of Google Analytics through Google's browser add-on.

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising. We have not done either in the preceding twelve (12) months, and we have no actual knowledge of selling or sharing the Personal Information of consumers under sixteen (16) years of age.

We disclose Personal Information only as follows:

(a) Service Providers. We disclose Personal Information to Service Providers that process it on our behalf for the Business Purposes described in Section 6, under contracts that restrict use of the information, as described in Section 13.

(b) Transaction participants. Buyer, seller, owner, listing-agent, and escrow-officer names and related Transaction Information appear in Reports, disclosure documents, invoices, Payment Invitations, and signing requests delivered to the parties to the transaction — buyers, sellers, owners or other payors, agents, and the designated Closing Agent — as necessary to complete the workflow the Ordering Party initiated. Escrow officers receive invoices containing the ordering party's name, the property, the product, the amount, and the file number. Signature certificates and audit-trail information are included in executed disclosure documents.

(c) Professional oversight. Where permitted by our Terms of Service, we may disclose information concerning delinquent professional accounts to the applicable California licensing authority as a professional conduct matter, and to collection agencies engaged to recover amounts owed.

(d) Legal process and protection. We may disclose Personal Information to comply with law, regulation, legal process, or a governmental request; to enforce our Terms of Service; or to protect the rights, property, or safety of the Company, our Users, or others.

(e) Corporate transactions. Personal Information may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets, as described in Section 22.

Disclosures to Service Providers and within transaction workflows are made for Business Purposes and are not sales under the CCPA. We do not offer financial incentives or price or service differences in exchange for the collection, retention, sale, or sharing of Personal Information. We do not disclose Personal Information to third parties for those parties' own direct marketing purposes within the meaning of California Civil Code Section 1798.83 (the "Shine the Light" law). We do not disclose Professional Contact Data to third parties for their own marketing.

We use Service Providers in the following functional categories. Each processes Personal Information on our behalf under written contracts limiting its use of that information to providing services to us:

Cloud hosting and database infrastructure — hosting the Platform, application data, and file storage, with database-level access controls.

Authentication — managing Account sign-in and credential security.

Payment processing — processing card and bank payments and maintaining associated payment records; the Company does not store full card or bank account numbers.

Electronic signature — dispatching, capturing, and certifying electronic signatures on disclosure documents.

Property data — supplying assessment, ownership, sale, and property characteristic data used in Reports.

Address validation and mapping — validating property addresses, geocoding, and generating property location maps.

GIS and hazard data processing — querying government geographic data services to determine statutory hazard zone status.

AI processing — generating AI Compliance Summaries from Report data, as described in Section 8.

Email delivery — sending transactional email such as order confirmations, signing requests, and billing notices.

SMS delivery — sending transactional and Marketing Communications by text message and processing STOP/HELP replies.

Real estate listing data — supplying active-listing information, including listing-agent contact details, used to identify newly listed properties.

Professional contact data and verification — supplying, verifying, and enriching business contact details of licensed professionals for Marketing Communications.

Business listings and mapping — supplying business names, addresses, telephone numbers, and websites of escrow companies and transaction coordinators.

Analytics — measuring website and Platform usage, as described in Section 11.

Platform infrastructure and development — supporting the build, deployment, and operation of the Platform.

14.1 Types of Messages.

We send two kinds of text messages. Transactional messages are sent to a mobile number you provided in connection with a request or Order, including: (a) free Preliminary Hazard Screen results you asked to receive; (b) Payment Invitation links and payment reminders sent to an owner or other payor at a number supplied by the Ordering Party, who represents that it has the payor's permission; (c) notices that a Report is ready; (d) electronic signature requests and completion notices; and (e) escrow-information reminders. Marketing Communications by text are sent only to licensed real estate professionals at business or mobile numbers obtained from the sources in Section 3.5, and only to let the professional know that a free Preliminary Hazard Screen is available for a property they have listed. We do not send marketing text messages to consumers, buyers, sellers, or owners. Every message identifies Verity NHD and includes STOP and HELP instructions.

14.2 Message Frequency and Rates.

Message frequency varies based on your use of the Platform and the number of transactions in which you participate. Standard message and data rates charged by your wireless carrier may apply. We do not charge separately for SMS messages.

14.3 Opt-Out.

You may opt out of text messages at any time by replying STOP to any message you receive from us, or by emailing support@veritynhd.com with the number to be removed. After you reply STOP you will receive one confirmation message and no further texts to that number unless you re-subscribe by replying START. STOP applies to Marketing Communications immediately and to transactional texts as well; if you have an active Order, we will continue to notify you by email. Opting out does not affect your ability to use the Platform.

14.4 Help.

For help with SMS messages, reply HELP to any message you receive from us, or contact us at support@veritynhd.com.

14.5 Carrier Disclaimer.

Carriers are not liable for delayed or undelivered messages. Message delivery is subject to effective transmission from your wireless carrier.

14.6 Consent Records.

We maintain records of SMS consent, including the telephone number, the date and time of consent, the text of the consent disclosure presented, and the opt-in method (e.g., web form submission), as required by applicable messaging industry guidelines and our carrier partners.

14.7 Suppression.

We maintain a suppression list of telephone numbers and email addresses that have opted out, bounced, or been flagged, and we check it before every send.

We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Retention periods vary by category:

Account information — retained while your Account is active and for a reasonable period thereafter to administer wind-down, resolve disputes, and satisfy legal obligations.

Free-screen and lead records — retained while we have an ongoing relationship or reasonable expectation of one, and deleted or deidentified thereafter.

Professional Contact Data — retained while the professional's license is active and the information is used for Marketing Communications, refreshed or removed when it becomes inaccurate, and suppressed (not deleted) upon opt-out.

Disclosure Desk submissions — retained as long as the published answer remains available; unpublished submissions are deleted within a reasonable period after being declined.

Reports and transaction records — retained for a minimum of five (5) years to support compliance and audit requirements associated with California Civil Code § 1103 disclosures and professional record-retention obligations.

Invoices and payment records — retained as required for tax, accounting, and audit purposes, generally seven (7) years.

Audit trails and signature records — retained with the executed documents they authenticate, for at least the same period as the associated Report.

Authentication and security logs — retained for a limited period sufficient to investigate security events.

Support communications — retained as needed to resolve the inquiry and maintain a record of the resolution.

Backups — retained on rolling cycles; information deleted from production systems ages out of backups in the ordinary course.

Closed and deleted Accounts — following Account closure, previously delivered Reports remain available for download for thirty (30) days as described in the Terms of Service, after which Account data is deleted or deidentified except as retention obligations require.

You may request deletion of your Personal Information as described in Section 17; deletion is subject to the statutory exceptions of the CCPA and the retention obligations described above.

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, alteration, and destruction, appropriate to the nature of the information. These safeguards include, by way of general category and without constituting a representation as to any particular control at any particular time: encryption of data in transit; encrypted storage provided by our cloud infrastructure; logical access controls at the application and database layers; least-privilege access principles limiting access to authorized personnel; authentication controls on Accounts; logging and monitoring of Platform activity; and incident response planning. We periodically review our safeguards in light of the sensitivity of the information we process.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying us promptly at support@veritynhd.com of any suspected unauthorized access to your Account. If a breach of security requiring notification occurs, we will notify affected individuals and regulators as required by Applicable Privacy Laws.

If you are a California resident, the CCPA provides you the following rights, subject to its exceptions:

Right to know and access. You may request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, our purposes for collection, and the categories of third parties to which we have disclosed it.

Right to delete. You may request that we delete Personal Information we have collected from you, subject to statutory exceptions, including our need to complete transactions, comply with legal obligations, and maintain records required by California disclosure and professional record-retention law.

Right to correct. You may request that we correct inaccurate Personal Information we maintain about you.

Right to data portability. You may request a copy of the Personal Information you provided to us in a portable and readily usable format.

Right to opt out of sale or sharing. We do not sell Personal Information or share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of. Should our practices change, we will update this Privacy Policy and provide the required opt-out mechanisms, and we will honor Global Privacy Control signals as opt-out requests.

Right to limit use of Sensitive Personal Information. We use Sensitive Personal Information (account credentials) only for the purposes permitted by the CCPA without a right to limit — principally, providing the Services and maintaining security — so the right to limit does not apply to our current practices.

Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.

17.1 Submitting Requests.

You may exercise these rights by emailing support@veritynhd.com. Because we operate exclusively online and have a direct relationship with the consumers whose Personal Information we collect, an email address is our designated method for submitting requests, as the CCPA permits. Please indicate which right you wish to exercise and provide sufficient information for us to locate your records. We will confirm receipt within ten (10) business days and respond to verifiable requests within forty-five (45) calendar days, which may be extended once by an additional forty-five (45) days where reasonably necessary, with notice to you. Requests to know are not limited to the twelve (12) months preceding the request; you may request information beyond that period for Personal Information collected on or after January 1, 2022, unless doing so proves impossible or would involve disproportionate effort. When we grant a deletion request, we will also direct our Service Providers to delete the relevant Personal Information from their records, subject to the same statutory exceptions. These rights are available to any California resident whose Personal Information we hold — including buyers, sellers, and signers who are not Account holders.

17.2 Verification.

We must verify your identity before acting on a request. For Account holders, we will generally verify identity by matching the request to the email address associated with the Account and, where appropriate, requiring you to confirm the request from that email address or through the Account. For individuals who are not Account holders — such as buyers, sellers, and signers — we will generally verify identity by matching identifying details you provide against the transaction records we hold, such as the email address at which you received signing requests. For requests concerning particularly sensitive information or deletion, we may require additional verification. If we cannot verify your identity to the required degree of certainty, we will tell you and may deny the request in whole or in part, and we will explain why.

17.3 Requests Concerning Transaction Records.

Certain information appearing in delivered Reports, executed disclosure documents, and audit trails is retained to satisfy legal obligations and to document completed real property transactions. The CCPA's deletion right does not require the deletion of such records, and we will explain the basis for any denial in our response.

17.4 Opt-Out of Marketing Communications; Professional Contact Data.

Whether or not you have an Account, you may opt out of Marketing Communications at any time by using the unsubscribe link in any marketing email, replying STOP to any text, or emailing support@veritynhd.com. Licensed professionals whose Professional Contact Data we hold may also exercise the rights in this Section — including the right to know the sources of that information and the right to delete it — by emailing support@veritynhd.com; where deletion would prevent us from honoring your opt-out, we retain the minimum information needed to keep you suppressed.

In the preceding twelve (12) months, we collected the categories of Personal Information described in Section 4 from the sources described in Section 5, we did not sell Personal Information, and we did not share Personal Information for cross-context behavioral advertising. The following maps each category to its purposes of collection, the categories of recipients to which it was disclosed for a Business Purpose, and the applicable retention criteria:

Identifiers. Purposes: Section 6(a)–(g), (i)–(k). Disclosed to: cloud hosting, authentication, email delivery, payment processing, electronic signature, and analytics Service Providers; transaction participants (names and email addresses). Retention: Account and transaction record criteria in Section 15.

Customer records. Purposes: Section 6(a), (d), (f), (j). Disclosed to: cloud hosting and payment processing Service Providers. Retention: account and payment record criteria in Section 15.

Professional or employment-related information. Purposes: Section 6(e), (a), (j). Disclosed to: cloud hosting Service Providers; California licensing authorities for verification and, where applicable, as described in Section 12(c). Retention: account record criteria in Section 15.

Commercial information. Purposes: Section 6(b)–(d), (f), (j)–(k). Disclosed to: cloud hosting, payment processing, electronic signature, property data, and AI processing Service Providers; transaction participants. Retention: Report, invoice, and audit trail criteria in Section 15.

Internet or other electronic network activity information. Purposes: Section 6(h)–(i). Disclosed to: cloud hosting and analytics Service Providers. Retention: log and security criteria in Section 15.

Sensitive Personal Information (account credentials). Purposes: Section 6(a), (i). Disclosed to: authentication and cloud hosting Service Providers, in protected form. Retention: account record criteria in Section 15. We do not use or disclose Sensitive Personal Information for purposes subject to the right to limit under the CCPA.

You may designate an authorized agent to submit a CCPA request on your behalf. We require the agent to provide written authorization signed by you, and we may also require you to verify your own identity directly with us or confirm that you granted the agent permission, except where the agent holds a qualifying power of attorney under California Probate Code sections 4121 to 4130. We may deny requests from agents who do not provide adequate proof of authorization.

The Platform is operated from the United States and is designed for California real property transactions. If you access the Platform from outside the United States, you understand that your Personal Information will be transferred to, processed, and stored in the United States, where privacy laws may differ from those of your jurisdiction. We do not target the Platform to individuals located in the European Economic Area or the United Kingdom.

The Platform is intended for adults engaged in real property transactions and is not directed to individuals under eighteen (18) years of age. We do not knowingly collect Personal Information from anyone under eighteen. If you believe we have collected Personal Information from a minor, please contact us at support@veritynhd.com and we will delete it as required by law.

If the Company is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of its assets, Personal Information may be disclosed to counterparties and their advisors in connection with diligence, subject to confidentiality obligations, and may be transferred to a successor entity as part of the transaction. Any successor's use of Personal Information will remain subject to this Privacy Policy unless and until it is amended as described in Section 23.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will post the updated Privacy Policy on the Platform and revise the effective date above. For material changes, we will provide notice to registered Users by email to the address associated with the Account or by prominent notice on the Platform before the change takes effect. Changes apply prospectively from their effective date; we will not use previously collected Personal Information in a materially new way without first providing notice and, where required by Applicable Privacy Laws, obtaining consent. This Version 4.0 discloses the use of Professional Contact Data and Marketing Communications; those practices apply from the effective date above.

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your privacy rights, please contact us:

Verity NHD

Attn: Privacy

Email: support@veritynhd.com

Last updated: September 12, 2026. Summary of changes in Version 4.0: professional contact data obtained from licensing directories, public sources, and licensed data vendors (Sections 3.5, 5); marketing communications by email and text message to licensed professionals (Sections 6, 14); the free Preliminary Hazard Screen and ordering without an Account (Section 3.1); Payment Invitations and escrow-officer invoices (Sections 3.1, 12); the Disclosure Desk (Section 3.6); updated automated-processing statement (Section 8.5).