PACT Privacy Policy

PACT CRE, Inc. ("PACT," "we," "us") is a Delaware corporation located at 951 S Westlake Blvd, Suite 101, Westlake Village, CA 91361.

This policy explains how we collect, use, share and protect personal information when you visit pactcre.com, use the PACT application, review or sign a document through a link we email you, or connect PACT to another service (together, the "Service").

PACT is offered to businesses and professionals in the United States who are at least 18 years old, for commercial purposes. Your use of the Service is also governed by our Terms of Service. Capitalized terms that are not defined here have the meanings given in the Terms.

This policy does not cover services run by others that you choose to connect to PACT, such as Google, QuickBooks, a property management system you export to, or an AI assistant you link to your PACT account. Their own privacy policies apply.

Account Information. Information about you as a PACT user or visitor: your name, email, login, profile, billing status, how you use the Service, and the records we keep to show what happened, such as signature audit trails and the acceptance of our Terms. We decide how this information is used, and this policy describes those uses.

Customer Content. The documents, templates, deal terms, uploaded files, comments and messages that our customers and the people they invite put into PACT. Customer Content often contains personal information about people who are not PACT users, such as tenants, guarantors, signatories and the contacts listed for notices.

For Customer Content, we act as a service provider to the customer who created or uploaded it. That customer decides what goes into a document, who it is shared with, and how long it is kept. We process Customer Content to provide the Service to that customer and the participants they invite, and as described in our Terms. We do not use it for our own advertising or sell it.

Some records sit in both categories. The signature and audit records attached to an executed contract are part of that contract, which belongs to all of its parties, and we also keep them as evidence of how the contract was signed.

You may encounter PACT without ever creating an account: your name may appear in a lease someone drafted on PACT, or you may receive an email inviting you to review or sign a document.

If you are named in a document. The person or company that created or shared the document controls it. If you want information about you changed or removed, please contact them first. If you cannot reach them, or need help, contact us and we will work with the document's owner to respond.

If you review or sign through an emailed link. When you open the link, we record your name and email address as the sender entered them, when you opened and acted on the document, your IP address, and your browser and device type (user agent). Before you can open the document, we ask you to accept a short disclaimer and record that acceptance, with the same details. When you sign, we record the name you type as your signature, your consent to sign electronically, the time, and a fingerprint (SHA-256 hash) of the document data you signed.

Why. These records form the audit trail that shows a contract was signed electronically and by whom, which electronic signature laws (the federal ESIGN Act and state UETA laws) rely on. They also let us show you the document and keep it secure.

Who sees them. When a contract is fully signed, PACT produces a Certificate of Completion. It lists each signer's name, email address, IP address, device type, and the times they viewed and signed, and it is attached to the executed contract and emailed to every party. The signer list is also visible to everyone signing the document.

How long. Signature and audit records are kept with the executed contract for as long as that contract is kept in PACT. See Section 11.

We collect information you give us, information created as you use the Service, and information from other people and services, as set out below.

We do not collect precise location. We store IP addresses but do not use them to locate you beyond what an IP address itself reveals. Address autocomplete sends only the address text you type to Google, through our servers; it does not send your IP address or location.

We use personal information to:

• provide the Service: create and manage accounts, draft and store documents, run negotiations, collect signatures, deliver executed contracts and send the notifications you ask for;

• share documents, comments and status with the participants you choose;

• produce AI features you use, such as summaries, explanations, redrafting suggestions, and reading uploaded leases (Section 6);

• keep records that show how a contract was signed and that you accepted our Terms;

• process payments and manage subscriptions;

• keep the Service secure, prevent fraud and abuse, and fix problems;

• respond to you and provide support;

• understand how the Service is used so we can improve it;

• send service messages, and, if you have not opted out, occasional news about PACT (Section 10);

• comply with law, enforce our Terms, and protect the rights and safety of our users and others.

Some PACT features use artificial intelligence: summarizing or explaining a document, suggesting redrafted language, the in-app assistant, reading an uploaded lease or letter of intent to fill in terms, building a lease from a letter of intent, and preparing renewals and amendments from prior documents.

Who processes it. These features are powered by models from Anthropic, PBC. When you use one, we send Anthropic the text of the relevant document or the file you uploaded, along with your request. We do not send your name, email or account details with it.

No training on your documents. We do not use Customer Content to train AI models, and we do not permit our AI provider to use it to train theirs. If we ever wish to use Customer Content to train a model, we will ask for your permission first.

Accuracy. AI output can be incomplete or wrong. It is a drafting aid, not legal advice, and you should review it before relying on it, as our Terms explain.

In your browser. The in-app assistant keeps your recent conversation in your own browser's storage so it is still there when you return. You can clear it by clearing your browser's site data.

As our Terms describe, we may combine information from many transactions into aggregated, de-identified statistics, such as typical lease lengths, common concessions, or how long negotiations take. We may use these statistics to improve PACT, to show benchmarks in the Service, and to publish, license or sell market insights and other products built from them. Aggregated, de-identified information is not personal information, so selling or licensing it is not a sale of personal information.

When we do, we commit that:

• the information will be de-identified, meaning it cannot reasonably be used to identify you, any party to a contract, any individual, any specific property, or any specific transaction;

• we will report only on groups large enough to prevent identification, drawn from at least five unrelated customers;

• we will not attempt to re-identify it, and we will contractually require anyone we share it with not to attempt to re-identify it either;

• we will keep it in de-identified form.

We may use aggregated, de-identified information to train, evaluate and improve the AI models used in the Service. We do not use Customer Content itself to train AI models (Section 6).

With the people on a document. When a document is shared, the people it is shared with can see it and the activity on it according to their access: content, comments in shared areas, versions, the names of participants, and the signing records described in Section 3. A side's internal drafts and comments stay with that side until they are sent.

Within your company. If your account is affiliated with a company account on PACT, that company's owners and administrators can see the documents and data in the accounts affiliated with it.

With service providers. We use companies that help us run the Service. They process personal information on our behalf, under contracts that limit their use of it:

With services you connect. If you connect Google Calendar, Drive or Sheets, we send the dates, documents or data you choose. If you export to a property management system such as Yardi, we email the export file, which includes the tenant contact details in it, to the address you choose. If you connect an AI assistant to PACT, it can read the documents, contacts and signing details your account can see. Those services handle the information under their own terms.

For legal reasons. We may disclose information if we believe in good faith that the law, a subpoena or court order requires it, or to protect the rights, property or safety of PACT, our users or others. Where the law allows, we will tell the affected customer first.

In a business transfer. If PACT is involved in a merger, acquisition or sale of assets, information may transfer to the successor, which will be bound by this policy for the information it receives.

With your direction. We share information in other ways when you ask us to or agree.

No sale, no advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past twelve months.

PACT uses cookies and browser storage to run the Service and to understand how it is used. We do not use advertising, social media or third-party analytics cookies, and we do not allow third parties to track you across websites through PACT.

• Sign-in cookies keep you signed in and secure.

• Short-lived cookies carry information through a sign-in with Google or a connected service, such as protection against forged requests and your acceptance of our Terms.

• Our analytics cookie holds a random identifier so we can count visits and see which pages and features people use. What it records (pages visited, the site that referred you, and product events such as creating an account or sending a document for signature) stays in our own systems and is never shared with advertisers or analytics companies. It lasts one year.

• Your browser's own storage holds things like unsent edits, so typed text is not lost if your connection drops, your recent assistant conversation, and small preferences.

Do Not Track and Global Privacy Control. If your browser sends a Global Privacy Control signal, our analytics records nothing for you. We do not otherwise change our practices in response to Do Not Track signals, because we do not track you across websites or sell or share personal information. You can also block or delete cookies in your browser; sign-in will not work without the sign-in cookies.

We send service emails that are part of using PACT: account confirmations, password resets, invitations, documents shared with you, signature requests, executed contracts, reminders you set, and team chat notifications. These are not marketing, and some cannot be turned off while you use the Service.

If we send news or marketing emails, each will include a way to unsubscribe, and unsubscribing will not affect service emails.

We keep personal information for as long as we need it for the purposes in this policy, and then delete or de-identify it. How long depends on the kind of information:

• Account Information: while your account is open, and afterward for as long as we need it to resolve disputes, enforce our agreements, or meet legal obligations.

• Customer Content: for as long as the customer keeps it in PACT, subject to our Terms, including the period after a subscription ends during which customers may export their contracts.

• Executed contracts and their signature and audit records: for as long as the contract is kept in PACT. A fully signed contract belongs to all of its parties, so we may keep it available to the other parties after one party leaves.

• Records of acceptance of our Terms or the signer disclaimer: permanently, as evidence of what was agreed.

• Templates: each version of a template is kept permanently as a record of the wording used in contracts created from it.

Deleted information may remain in backups and storage systems for a period before it is removed in the normal course.

We use administrative, technical and physical safeguards designed to protect personal information, including:

• encryption of data in transit between your browser and PACT (HTTPS);

• database rules that limit each record to the people entitled to see it, and private file storage;

• long, random links for document signing, and stored fingerprints, not copies, of the keys used to connect AI assistants;

• a tamper-evident fingerprint (SHA-256 hash) of each signed document's data, and permanent records of Terms and disclaimer acceptances;

• hosting with established infrastructure providers, and limiting access to the people who need it to run and support the Service.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization. Please keep your password private, and do not forward signing links, which give access to the document they belong to. If we learn of a breach affecting your personal information, we will notify you as the law requires.

PACT does not ask for Social Security numbers, bank account numbers, government ID numbers or other sensitive information, and we ask that you not put them in documents unless a transaction truly requires it. If Customer Content does contain sensitive information, we process it only to provide the Service. We do not use sensitive information to infer characteristics about anyone, and we do not sell it.

Your account password is used only to sign you in, and is stored by our authentication provider in a form we cannot read.

Whatever state you live in, you can ask us to:

• tell you what personal information we have about you and give you a copy;

• correct information that is inaccurate;

• delete personal information about you.

You can update your name, profile details and password yourself in your account settings. For anything else, email drew@pactcre.com with the subject "Privacy request." There is no self-serve option for account deletion or data export today; we handle these requests by email.

Verification. To protect your information, we will confirm your identity before acting, usually by having you reply from the email address on your account. You may use an authorized agent; we will ask for proof that they are authorized and may ask you to confirm your identity directly.

Timing. We will respond within 45 days, and tell you if we need up to 45 more.

Limits. Some requests we cannot fully grant. A fully signed contract and its signing records belong to every party to it, so we may keep them available to the other parties. We keep records we need for legal, security or dispute purposes, including Terms and disclaimer acceptances. And where information is Customer Content that a customer controls, we may refer your request to that customer and help them respond.

Appeals. If we decline your request, you may appeal by replying to our decision. We will respond to an appeal within 45 days. If you remain unsatisfied, you may contact your state attorney general.

No discrimination. We will not treat you differently for exercising your privacy rights.

Opt-outs. Because we do not sell personal information, share it for advertising, or use it for targeted advertising or profiling with significant effects, there is nothing to opt out of today. If that changes, we will update this policy and provide a way to opt out before it happens.

This section gives California residents the details California law asks for. In the past twelve months we have collected the categories below, from the sources and for the purposes described in Sections 4 and 5, and disclosed them for business purposes to the recipients described in Section 8.

We do not collect precise geolocation, biometric information or inferences about you. We have not sold or shared personal information, including that of anyone under 16. We use sensitive personal information only as California law permits for providing the Service, so a right to limit its use does not apply.

Shine the Light. We do not share personal information with third parties for their own direct marketing.

To exercise your rights, see Section 14.

Residents of Nevada, Virginia, Colorado, Connecticut, Texas, Oregon and other states with privacy laws can use the rights in Section 14. We do not sell personal information as Nevada law defines it; Nevada residents may still send a request to drew@pactcre.com.

PACT is a business service for people 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

PACT is intended for use in the United States. Our database and file storage are located in the United States, and we and our service providers process information primarily in the United States.

PACT's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google account information only to sign you in and to provide the Google integrations you turn on, and we do not use it for advertising or to train AI models.

We may update this policy. The date at the top shows when it last changed. If we make a material change, we will tell you by email or in the Service before it takes effect, at least 30 days ahead where our Terms require it. We will not use personal information we have already collected in a materially different way without your consent.

Questions or requests about this policy or your information: drew@pactcre.com, or PACT CRE, Inc., 951 S Westlake Blvd, Suite 101, Westlake Village, CA 91361.

If you are named in a document or were invited to one, the person who shared it controls that document; you may want to contact them as well.