BnB Flow — Privacy Policy

Effective date: August 1, 2025

This Privacy Policy explains how BnB Flow (“BnB Flow,” “we,” “us,” “our”) collects, uses, discloses, and safeguards personal information when you visit our sites, complete our intake forms, subscribe to alerts, or otherwise interact with us, including when we share purchased leads with subscribing real-estate agents and brokerages (collectively, our “Services”).

We operate nationwide in the United States. Certain states grant additional privacy rights; see State-Specific Privacy Rights below.

If you have questions, contact [email protected].

1) Quick “Notice at Collection” (what we collect & why)

Categories of personal information we collect (examples):

  • Identifiers (name, email, phone, postal code, IP address, device ID).

  • Commercial/intent data (budget range, markets of interest, timeline, STR experience, property preferences).

  • Professional info (for agents: license number, brokerage, years of experience, STR client track record).

  • Internet activity (page views, form journey, referrer, UTM tags).

  • Inferences (lead scores, interest level).

  • Communication preferences (email/SMS opt-ins and unsubscribes).

Primary uses:

  • Match STR-interested buyers with vetted, paying agents and deliver purchased lead details to those agents.

  • Operate, secure, and improve our Services; analytics and fraud prevention.

  • Communicate about leads, account status, and product updates.

  • Comply with law and enforce terms.

Selling/Sharing: When an agent purchases a lead, we disclose that lead’s contact details and lead profile to that agent (and sometimes their brokerage). Under certain state laws (e.g., California), this may be deemed a “sale” or “sharing” of personal information. See Your state privacy rights for opt-out options.

Retention: We keep personal information only as long as necessary for the purposes described or as required by law. Typical retention windows:

  • Unmatched or unpurchased leads: up to 18 months.

  • Purchased lead data and agent transaction records: 3–7 years (for audit, chargebacks, and legal compliance).

  • Communications and consent logs: 4 years (TCPA/CAN-SPAM recordkeeping).

2) What we collect & sources

We collect information directly from you (our forms and emails), automatically (cookies, pixels, log data), and from partners:

  • Direct: form fields, emails with us, phone/SMS if you contact us.

  • Automatic: device/browser data, IP, pages viewed, referrer/UTM, on-site events (via analytics tools).

  • Partners: ad platforms, affiliate partners, and (for agents) license verification or public records where lawful.

We do not knowingly collect sensitive data (e.g., SSN, precise geolocation, health info). Please do not submit it.

3) How we use personal information

  • Deliver and improve lead matching and your user experience.

  • Process payments and manage agent subscriptions/lead purchases.

  • Verify agent licensing/eligibility; fraud and abuse prevention.

  • Communicate about leads, alerts, and product changes (per your settings).

  • Personalized marketing and ad measurement (where permitted).

  • Legal compliance and enforcement.

4) How we disclose personal information

We disclose information to:

  • Paying agents/brokerages: When a lead is purchased, we send the lead’s contact info and lead details to that buyer.

  • Service providers: cloud hosting, analytics, email/SMS tools, payment processors, CRM, and security vendors (contractually limited to service performance).

  • Business transfers: in a merger/acquisition, subject to this Policy.

  • Legal: to comply with law, enforce terms, or protect rights/safety.

We do not sell data to data brokers. Our core disclosure is the paid hand-off of a lead to a specific agent.

5) Cookies & tracking

We use cookies, pixels, and similar technologies for authentication, analytics, and marketing measurement. You can control cookies via your browser settings. We currently do not respond to “Do Not Track” signals.

6) Communications, marketing & TCPA/CAN-SPAM

By submitting a form you may choose to receive email, phone, or SMS communications from BnB Flow and, after purchase, from the agent who bought your lead.

  • Opt-out anytime: use the unsubscribe link in emails, reply to any message to request stop, or email [email protected].

  • Message & data rates may apply. Message frequency varies.

  • We maintain consent/unsubscribe logs and honor state/federal rules (e.g., CAN-SPAM, TCPA, state telemarketing rules, internal Do-Not-Call).

If you operate in a state with stricter rules (e.g., Florida, Oklahoma), BnB Flow and partner agents will follow those state-specific calling rules.

7) Children’s data

Our Services are not intended for children under 16. We do not knowingly collect or sell/share personal information of minors. If you believe a minor submitted data, contact [email protected].

8) Security

We employ administrative, technical, and physical safeguards appropriate to the risk (encryption in transit, access controls, least-privilege, intrusion monitoring). No method is 100% secure; please use strong passwords and exercise caution.

9) Your privacy choices

  • Access/Correct/Delete your data (subject to legal exceptions).

  • Opt-out of sale/sharing (for states that require it).
    Email [email protected] with subject “Do Not Sell/Share My Personal Information” or use our opt-out link (if provided on site).

  • Limit use of sensitive PI (we don’t collect it in the ordinary course).

  • Appeal a denied consumer request: reply to our decision email with “Appeal.”

We will verify your identity before fulfilling requests and may deny unverified or manifestly excessive requests. Authorized agents can submit requests with proof of authority.

10) State-specific privacy rights (summary)

California (CCPA/CPRA): Right to know/access, delete, correct, opt-out of sale/share, and non-discrimination. We treat paid transfer of lead info to an agent as a “sale” in California. Request/opt-out: [email protected].
Colorado/Connecticut/Virginia/Utah: Rights to access, delete, correct (varies), and opt-out of targeted advertising/sale/profiling (as applicable).
We honor applicable state timelines and appeal processes.

11) International use

We primarily serve U.S. residents. If you access from outside the U.S., you consent to processing in the United States, which may have different data-protection laws.

12) Changes to this Policy

We may update this Policy. The “Effective date” will change. Material changes will be highlighted or notified as required by law.