Privacy Policy.

1. Who we are and what this covers

This Privacy Policy explains how CREx Software, Inc. ("CREx," "we," "us," or "our") collects, uses, shares, and protects personal information. It applies to:

• our websites, including crexsoftware.com;
• our products, including CREx OS, CREx Intelligence, CREx Core, and the CREx MCP connection (together, the "Platform");
• our training programs, webinars, newsletters, and events; and
• our sales, marketing, support, and recruiting communications.

This policy describes our practices. It is not a contract, and it does not change the terms of any agreement you or your organization has with us. Section 2 explains how we handle data our clients load into the Platform, which is governed mainly by our agreement with each client.

CREx Certified, at cre10x.crexsoftware.com, has its own privacy policy. That policy applies to CREx Certified accounts and controls where it differs from this one.

2. Data we process for our clients

Our clients are real estate owners and investment managers. When a client uses the Platform, the client and its property managers' systems (such as Yardi, MRI, RealPage, or Entrata) supply data to us. That data can include personal information about tenants, residents, investors, vendors, and employees, such as names, lease terms, balances, and contact details ("Customer Data").

We process Customer Data on the client's behalf and under the client's instructions, as its service provider or processor. We use it to provide and support the Platform for that client, as set out in our agreement with the client. The client decides what data is loaded and how it is used. We do not sell Customer Data.

If you are a tenant or resident at a property whose owner uses CREx and you want to see, correct, or delete your information, please contact the owner or property manager. If you contact us instead, we will pass your request to the right client and help them respond.

3. Information we collect

Information you give us

• Contact and professional details, such as your name, work email, phone number, company, job title, and details about your portfolio, when you fill out a form, request a demo, download a resource, or email us.
• Account information, such as your name, email, role, and login credentials, when you or your organization sets up a Platform or training account.
• Training and event information, such as course enrollment, progress, quiz results, certificates, and event or webinar registrations.
• Payment information, when you buy an event ticket or another paid offering. Our payment providers process payments, and we do not store full card numbers.
• Communications, such as emails, support requests, survey answers, and notes from calls and meetings with us. Calls and video meetings may be recorded or transcribed, and we will tell you when that is happening.
• Job application information, such as your résumé and anything else you send us when you apply for a role.

Please do not send us sensitive personal information, such as government ID numbers, financial account numbers, or health information, through our website forms or general email addresses.

Information we collect automatically

When you visit our websites or open our emails, we and our service providers collect information such as your IP address, browser and device type, approximate location based on your IP address, the pages you view, the links you click, the site that referred you, and the date and time of your visit. Our marketing emails tell us whether an email was opened and which links were clicked. When you use the Platform, we log activity such as sign-ins, features used, and errors so we can run, secure, and support it.

Information from other sources

• Your organization, when it adds you as a Platform user or enrolls you in training.
• Public and commercial sources, such as company websites, professional networking profiles, and business contact data providers, which we use to find and verify business contact details for sales and marketing.
• Event partners, when you register for an event or webinar we run with a partner.

4. Cookies and analytics

Our websites use cookies and similar technologies. Some are set by us and some by the providers below. They help us measure traffic, see which pages are useful, keep forms working, and play embedded videos and reports.

• Google Analytics measures how visitors use our websites. Google explains its practices in How Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on.
• Google Ads runs on our blog through Google Tag Manager. It measures whether people who click our ads go on to visit or contact us, and Google may use that information to show our ads to people who have visited our site. You can manage ad personalization in Google's ad settings.
• YouTube hosts our embedded videos. YouTube (Google) may set cookies and collect information when a page with an embedded video loads or when you play it.
• HubSpot and ActiveCampaign run our forms, contact database, and email. They receive what you enter in a form and record email opens and clicks.
• Microsoft Power BI hosts some interactive reports shown on our website and may set cookies when a report loads.
• Google Fonts serves the fonts on our websites, so your browser sends your IP address to Google when a page loads.

These providers may collect information about your online activity over time and across different websites. You can block or delete cookies in your browser settings, though some parts of our websites may not work properly without them.

Do Not Track. There is no common industry standard for responding to browser Do Not Track signals, so our websites do not currently respond to them.

5. How we use your information

We use personal information to:

• provide, operate, maintain, and support the Platform, our training programs, and our events;
• set up and manage accounts and verify users;
• answer questions, schedule demos, and send information you ask for;
• send newsletters, webinar invitations, and marketing about CREx products and training, subject to your choices in Section 8;
• understand how our websites and products are used, and improve them;
• process payments and registrations;
• review job applications;
• protect the security of our websites, Platform, and business, and detect and prevent fraud and abuse; and
• comply with the law and enforce our agreements.

We may also create aggregated or de-identified information that does not identify you, and use it for any lawful purpose. When we do, we take reasonable steps to keep it from being re-identified.

6. AI features

The Platform includes AI agents and AI-assisted features, for example to draft variance commentary, review rent rolls, or summarize data. We also use AI tools in our own work.

• We use AI model providers as our service providers. Our agreements with them limit their use of the data we send to providing services to us, and do not allow them to use it to train their models.
• We do not use Customer Data to train AI models that we offer to other clients.
• If you connect the Platform to an AI assistant you choose, such as Claude, ChatGPT, or Copilot, through the CREx MCP connection, the data you request is sent to that assistant. Its provider handles that data under your or your organization's agreement with them, not under this policy.

7. How we share your information

We share personal information only as described below:

• Service providers that work for us, such as cloud hosting and data storage, CRM and email (HubSpot and ActiveCampaign), analytics and advertising (Google), video hosting (YouTube), event ticketing and payments, AI model providers, and communication and meeting tools. They may use the information only to provide services to us.
• Affiliates, meaning companies under common control with CREx, which use it in line with this policy.
• Your organization. If you use the Platform or training through your employer's account, the account administrator can see your account and activity.
• Event partners. If you register for an event or webinar we run with a co-host or sponsor, we may share your registration details with them. The registration page will say so.
• Legal and safety. When we believe in good faith that disclosure is required by law, subpoena, or other legal process, or is needed to protect the rights, property, or safety of CREx, our clients, or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to confidentiality obligations.
• With your consent or at your direction.

We do not sell personal information.

8. Marketing choices

You can unsubscribe from marketing emails at any time with the link in the email or by writing to privacy@crexsoftware.com. We will still send messages about your account, purchases, or registrations. We keep a record of your opt-out so that we do not email you again.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorized access. Our security program, including our SOC compliance, is described on our Trust Center.

No method of sending or storing data is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If a security incident affects your personal information, we will notify you as required by law.

10. Retention

We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it. How long depends on the type of information and why we have it. For example:

• Marketing contacts: until you unsubscribe or ask us to delete your information, or until it is no longer useful for marketing. We keep a suppression record so that we continue to honor your opt-out.
• Platform accounts: while the account is active, and afterward as set out in our agreement with the client.
• Legal, tax, accounting, and security records: for as long as those obligations require.

Customer Data is kept and deleted as set out in our agreement with the client.

11. International data transfers

CREx is based in the United States. We and our service providers may process personal information in the United States and in other countries, which may have different data protection laws from the ones where you live. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases: performing a contract with you or taking steps before entering one; our legitimate interests in running, securing, and marketing a business-to-business company, where your rights do not override those interests; your consent, which you can withdraw at any time; and compliance with legal obligations.

12. Your rights and choices

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• object to or restrict certain processing, including direct marketing; and
• withdraw consent where we rely on it.

To make a request, email privacy@crexsoftware.com. We will verify your identity before acting on it, which may mean asking you to confirm information we already have. Where the law allows, you can use an authorized agent, and we may ask for proof of the agent's authority. We will respond within the time the law requires, and we will not discriminate against you for exercising your rights.

If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. If you are in the EEA, the UK, or Switzerland, you can also complain to your local data protection authority.

Requests about Customer Data should go to the client that controls it, as explained in Section 2.

13. Children

Our websites and products are made for business users. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

14. Other sites and services

Our websites link to other websites, and the Platform connects to services we do not control, such as property management systems and AI assistants. This policy does not cover them. Their own privacy policies apply.

15. Changes to this policy

We may update this policy. When we do, we will post the new version here and change the "Last updated" date. If we make a material change, we will give notice on our website or by email before it takes effect.

16. Contact us

For questions or requests about this policy or our privacy practices, contact:

CREx Software, Inc.
Attn: Privacy
Houston, TX · New York, NY
Email: privacy@crexsoftware.com

If you have a disability and need this policy in another format, email us and we will provide it.