How we handle your data

Last updated: May 26, 2026

Who we are

OfferFlow (“OfferFlow,” “we,” “us”) is a product of REI Unlock LLC. We provide a multi-tenant SaaS platform for real-estate investors to search active MLS listings and dispatch letters-of-intent (LOIs) to listing agents through their connected REI Unlock CRM.

What we collect

From OfferFlow customers (subscribers)

Account email, name, and login activity
Stripe customer ID and subscription ID (we do not store card data)
GHL sub-account identifier (your tenant's location ID)
Search history (city, state, filters, result count, timestamp)
LOI dispatch history (property, recipient agent contact, offer amount, channels, outcome)

From listing agents

Publicly-published business contact information (name, email, phone, brokerage) sourced from licensed MLS data feeds
Property-listing data tied to those contacts

How we use it

To deliver the product you subscribed to (searching, composing, dispatching LOIs)
To compute fair-use search caps
To produce analytics dashboards visible only to your tenant
To dispatch your LOIs through your own connected GHL/REI Unlock workflow — replies land in YOUR CRM, not ours
To process payment via Stripe Checkout
To send transactional notifications (sign-in links, welcome, billing receipts)

Third parties we share with

A PCI-DSS-compliant payment processor for subscription billing
A US-East managed Postgres provider for database hosting
A US managed serverless platform for application hosting
A licensed MLS data feed for property listings
A licensed property-data feed for comparable sales
An open mapping data provider for the search map view
Your own connected REI Unlock CRM (governed by your existing CRM agreement)

A current list of named subprocessors is available on request to privacy@reiunlock.com. We do not sell personal information and have no advertising or analytics trackers on the application surface.

Retention

Account records: kept while your subscription is active and for 6 months after cancellation, then deleted on request.
LOI dispatch history (sent_offers): kept for 24 months for audit and attribution.
Search history (search_log): kept for 90 days for fair-use cap enforcement.
Stripe payment records: kept indefinitely as required by tax and dispute regulations.
Vercel function logs: ~30 days, contain limited PII (email addresses in error traces).

Your rights

Depending on your jurisdiction, you may have the right to access, correct, port, or delete personal information we hold about you, and to withdraw consent for processing.

To exercise any of these rights, email privacy@reiunlock.com. We respond within 30 days. We may verify your identity before acting on a request.

Listing agents: if you appeared as a recipient of an LOI sent through OfferFlow and want your contact information removed from our records and excluded from future sends across all tenants, email the same address.

Security

We follow the security posture documented in our SECURITY.md. Notable practices: TLS-only database connections, audience-scoped JWT sessions, HMAC-signed iframe authentication, Stripe webhook signature verification, CAN-SPAM-compliant LOI footers appended server-side. Report security issues to security@reiunlock.com.

Data residency

All data is stored within the United States. We do not currently serve EU-resident customers.

Changes

We'll update this page when our practices change and revise the “Last updated” date. Material changes will be announced via email to your account.

Contact

REI Unlock LLC · privacy@reiunlock.com