Privacy Policy

C&A Software, LLC

Effective Date: March 29, 2026

C&A Software, LLC, a Maryland limited liability company doing business as WallsTalk (“WallsTalk,” “Company,” “we,” “us,” or “our”), operates the property intelligence platform at wallstalk.io. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use our platform, website, and services (collectively, the “Services”).

This Privacy Policy also explains your rights regarding your personal information under applicable state privacy laws, including the Maryland Online Data Privacy Act (“MODPA”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other state privacy frameworks. For state-specific rights, see Section 11.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated by reference into our Terms of Service.

NOT A CONSUMER REPORTING AGENCY: WallsTalk is not a consumer reporting agency as defined by the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.). Our Reports and data are not consumer reports and may not be used for any purpose governed by the FCRA. See Section 10 for details.

1. Information We Collect

We collect information in several ways depending on how you interact with our Services. We are committed to collecting only the information that is reasonably necessary and proportionate to provide and maintain the specific products and services you request, consistent with the Maryland Online Data Privacy Act’s data minimization standard.

1.1 Information You Provide Directly

Account Information: When you create an account, we collect your name, email address, phone number, business name, and professional license information. This information is necessary to create and manage your account, verify your professional eligibility, and communicate with you about the Services.

Contact Data You Upload: When you use our contact management features, you may upload information about your clients and contacts, including names, phone numbers, email addresses, and mailing addresses. You are responsible for ensuring you have the legal right to share this data with us and that your contacts have consented to your use of their information. Phone numbers uploaded to the platform are encrypted at rest.

Payment Information: When you purchase a subscription, your payment information is collected and processed by our payment processor, Stripe, Inc. WallsTalk does not store credit card numbers, bank account numbers, or other sensitive financial information on our servers.

Communications: When you contact us for support, provide feedback, or otherwise communicate with us, we collect the content of those communications.

1.2 Information Collected Automatically

Usage Data: We collect information about how you interact with the Services, including features used, reports generated, searches performed, and credit consumption. We use PostHog for product analytics to understand how the platform is used and to improve the Services.

Device and Browser Information: We collect userAgent strings (browser type, operating system, device type) in our audit logs and engagement records. This information is used for security monitoring and service improvement.

IP Addresses: We capture IP addresses in our audit trail, engagement tracking, and webhook processing logs. We use IP addresses for security purposes, fraud prevention, and compliance record-keeping. We do not perform IP-to-location geolocation lookups.

Authentication Cookies: Our authentication provider, Clerk, sets session cookies necessary for you to log in and maintain your authenticated session. These are strictly necessary cookies required for the platform to function. We do not use third-party advertising or tracking cookies.

1.3 Information from Third-Party Sources

Property Data: We obtain property information from third-party data providers and public records, including property characteristics, automated valuation model (AVM) estimates, ownership records, mortgage and lien data, permit history, sales history, and tax assessments. Our primary property data provider is ATTOM Data Solutions. We also obtain data from Realie (property snapshots), FEMA (flood zone classifications via public API), USDA (rural eligibility zones via public API), and Google (address validation and geocoding).

Identity Resolution Data: When you use our enrichment features, we obtain identity resolution data from Trestle, a reverse phone lookup and identity resolution provider. This data may include names, addresses, and phone number verification results associated with phone numbers you submit for enrichment.

1.4 Email Engagement Tracking

When we send emails on your behalf through our automated nurturing features (such as monthly homeowner reports), our email delivery provider, Resend, embeds tracking technologies in those emails. Specifically:

• Tracking pixels: A small, invisible image is included in emails that records when a recipient opens the email, including the time and number of opens
• Tracked links: Links in emails are routed through Resend’s tracking infrastructure, recording when a recipient clicks a link and which link was clicked

This engagement data (opens, clicks, open counts, click counts, and timestamps) is stored in your account dashboard so you can see how your contacts interact with your communications. Recipients may prevent open tracking by disabling image loading in their email client. Recipients may opt out of all tracking by unsubscribing from communications.

2. How We Use Your Information

We use the information we collect for the following purposes, each of which is necessary to provide or maintain the Services you have requested:

• Providing the Services: Operating the platform, generating property reports, processing enrichment requests, delivering automated communications on your behalf, and managing your account and subscription
• Payment processing: Processing subscription payments, managing billing, and preventing fraud
• AI-powered features: Processing your queries through our AI Assistant and generating AI-assisted report narratives (see Section 5 for details)
• Communication: Sending you service-related notices, billing communications, security alerts, and platform updates
• Security and fraud prevention: Detecting unauthorized access, preventing misuse, maintaining audit trails, and protecting the integrity of the Services
• Improvement: Analyzing usage patterns in aggregated, de-identified form to improve the platform, fix bugs, and develop new features
• Compliance: Meeting legal obligations, responding to lawful requests, and enforcing our Terms of Service

We do not use your personal information for targeted advertising. We do not sell your personal information. We do not use personal information for purposes unrelated to the Services you have requested.

3. How We Share Your Information

We share personal information only as described below. We do not sell personal information to third parties for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising.

3.1 Service Providers (Processors)

We share personal information with the following categories of service providers who process data on our behalf to operate the Services. Consistent with the Maryland Online Data Privacy Act, we describe the type of business and processing conducted by each:

Each service provider is contractually obligated to use your information only as necessary to perform the services we have engaged them to provide. We do not authorize our service providers to use or disclose your information for their own purposes.

3.2 At Your Direction

When you generate a branded Report and share it with a client, you are directing us to include your branding and the report content in a communication to that recipient. We act on your instructions in this context.

3.3 Legal Requirements

We may disclose personal information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

3.4 Business Transfers

If C&A Software, LLC is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Services of any change in ownership or uses of your personal information.

3.5 Aggregated and De-Identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you. This data may be used for industry analysis, benchmarking, market research, and platform improvement. We maintain technical and organizational safeguards to prevent re-identification of de-identified data.

4. Cookies and Tracking Technologies

4.1 Cookies We Use

WallsTalk uses a minimal set of cookies and similar technologies:

• Authentication cookies (Strictly Necessary): Set by Clerk, our authentication provider. These cookies are required for you to log in and maintain your session. They cannot be disabled without losing access to the platform.
• Analytics (Product Improvement): PostHog may use cookies or local storage to collect anonymized usage data. You may opt out of PostHog analytics by contacting [email protected].

We do not use third-party advertising cookies, social media tracking pixels on our website, or cross-site tracking technologies.

4.2 Email Tracking Technologies

As described in Section 1.4, our email delivery provider (Resend) embeds tracking pixels and tracked links in emails sent through the platform. These technologies operate within email messages, not on the wallstalk.io website.

4.3 Global Privacy Control

WallsTalk honors the Global Privacy Control (“GPC”) browser signal. When we detect a GPC signal, we treat it as a valid opt-out request for the sale of personal information and targeted advertising, consistent with applicable state law. Since WallsTalk does not sell personal information or engage in targeted advertising, the GPC signal confirms our existing practices. For more information about GPC, visit globalprivacycontrol.org.

5. Artificial Intelligence and Automated Processing

WallsTalk uses artificial intelligence in several ways. We believe in being transparent about how AI processes your data.

5.1 AI Assistant and Report Narratives

Our AI features are powered by OpenAI’s API. When you use the AI Assistant or generate reports with AI-assisted narratives:

• Your queries (such as property addresses and questions about properties) are transmitted to OpenAI for processing
• Our system is designed so that the AI model receives only schema field names and structured prompts — not raw data values from our property data providers. This limits the data exposed to the AI model
• OpenAI processes your queries under their API terms, which provide that API inputs and outputs are not used to train their models unless you opt in (we have not opted in)
• AI-generated content may contain errors or inaccuracies. You should independently verify all AI-generated information before relying on it

5.2 Predictive Analytics and Scoring

WallsTalk may generate propensity-to-move scores, lead scores, and intent signals using statistical modeling and publicly available data. These scores are probabilistic marketing tools designed to help you prioritize outreach. They are not credit scores, insurance scores, or consumer reports. We do not use these scores to make automated decisions that produce legal effects or similarly significant effects concerning any individual.

5.3 Aggregated Improvement

We may use anonymized, aggregated data from the Services to improve our AI and machine learning capabilities. We will not use your individually identifiable User Content or Contact Data to train third-party AI models without your prior consent.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, plus any period required by law. Specific retention periods:

• Account data: Retained for the duration of your account, plus thirty (30) days post-termination to allow data export
• Contact Data you upload: Retained for the duration of your account, plus thirty (30) days post-termination. Deleted after the retention period unless required by law
• Property report data: Cached for up to ninety (90) days per our data provider agreements. Reports stored within your account are retained for the duration of your account
• Email engagement data: Retained for the duration of your account
• Audit logs and security records: Retained for up to two (2) years for security and compliance purposes
• Payment records: Retained as required by tax and financial reporting obligations (typically seven years)
• Suppression/opt-out lists: Retained indefinitely to ensure continued compliance with opt-out requests

After the applicable retention period, personal information is deleted or de-identified. We do not engage in indefinite retention of personal information.

7. Data Security

We implement reasonable administrative, technical, and physical security measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of phone numbers at rest using application-level encryption
• Authentication and session management handled by Clerk, a dedicated security provider
• Payment information processed by Stripe — WallsTalk never stores credit card numbers
• Role-based access controls within the platform
• Audit logging of access and changes to sensitive data
• Secure HTTPS connections for all data transmission

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security. If you become aware of a security vulnerability or data breach, please contact us immediately at [email protected].

8. Information About Property Owners and Other Non-Users

WallsTalk generates property intelligence reports that may include information about property owners, mortgage holders, and other individuals who are not users of our platform. We believe in being transparent about how this data is handled.

8.1 Sources of Non-User Data

Property data in our Reports is sourced from:

• Public government records: County assessor databases, recorder of deeds offices, tax records, and court records. This information is publicly available and is generally exempt from state privacy laws as “publicly available information.”
• Licensed data providers: ATTOM Data Solutions aggregates and normalizes public record data and provides property characteristics, AVM estimates, and transaction histories under a commercial license.
• Federal government APIs: FEMA provides flood zone classifications and USDA provides rural eligibility data through public APIs. No personal information is submitted to or received from these services.

8.2 How Non-User Data Is Used

Property data is presented to our users (licensed real estate professionals and loan officers) solely for informational purposes in connection with their professional activities. WallsTalk does not use non-user property data for targeted advertising, does not sell non-user data, and does not build consumer profiles for purposes unrelated to the Services.

8.3 Non-User Data Combined with Contact Information

When a user uploads Contact Data and uses our enrichment features, publicly available property data may be linked to contact information (such as phone numbers or email addresses). The non-public elements of this combined data (the phone numbers, email addresses, and any enrichment results) are subject to applicable state privacy laws even though the underlying property records are publicly available.

8.4 Rights of Non-Users

If you are a property owner or other individual whose information appears in a WallsTalk Report and you are not a WallsTalk user, you may:

• Contact us at [email protected] to inquire about what data we hold related to your property
• Request that your information be suppressed from future Reports generated through our platform. We will process suppression requests within thirty (30) days and maintain a suppression list
• Exercise your rights under applicable state privacy laws as described in Section 11

Please note that WallsTalk cannot modify underlying public records maintained by government agencies. Corrections to publicly recorded property data (such as assessor records, deed records, or court filings) should be directed to the relevant county or state authority.

9. Children’s Privacy

The Services are designed for licensed real estate professionals and are not intended for individuals under the age of eighteen (18). We do not knowingly collect or solicit personally identifiable information from children under thirteen (13) years of age. We do not process or sell the personal data of consumers for targeted advertising where we know or should know the consumer is under eighteen (18) years of age.

If we learn that we have collected personal information from a child under thirteen (13), we will delete that information as quickly as possible. If you believe a child under thirteen (13) may have provided us personal information, please contact us at [email protected].

10. FCRA Disclaimer

WallsTalk is not a consumer reporting agency as defined by the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.). Reports, property valuations, lead scores, propensity-to-move scores, and all other data provided through the Services are not “consumer reports” and may not be used, in whole or in part, for any purpose governed by the FCRA, including but not limited to making decisions regarding credit, employment, insurance, tenant screening, or any other eligibility determination. For complete prohibited use details, see Section 7 of our Terms of Service.

11. Your Privacy Rights

Depending on where you reside, you may have specific rights regarding your personal information under applicable state privacy laws. WallsTalk is committed to honoring these rights regardless of your state of residence, to the extent technically feasible.

11.1 Rights Available Under Applicable Law

You may have the right to:

• Confirm and Access: Confirm whether we are processing your personal information and request access to the specific personal information we hold about you
• Correct: Request correction of inaccurate personal information we hold about you
• Delete: Request deletion of your personal information, subject to certain exceptions (such as data required for legal compliance)
• Portability: Request a copy of your personal information in a commonly used, machine-readable format
• Opt Out: Opt out of the sale of your personal information, targeted advertising, or automated profiling that produces legal or similarly significant effects. Note: WallsTalk does not currently sell personal information or engage in targeted advertising
• Third-Party List: Obtain a list of the categories of third parties to whom your personal information has been disclosed
• Non-Discrimination: Exercise your privacy rights without receiving discriminatory treatment. Declining non-essential cookies or tracking does not constitute discrimination under applicable law

11.2 How to Exercise Your Rights

You may submit a privacy request through any of the following methods:

• Email: [email protected]
• Mail: C&A Software, LLC, 303 Lane Ct, Bel Air, MD 21014

We will respond to your request within forty-five (45) days of receipt. If we need additional time, we will notify you and may extend the response period by an additional forty-five (45) days. We will fulfill your request free of charge once per twelve (12) month period. If a request is excessive, repetitive, or technically infeasible, we may deny the request or charge a reasonable fee, with an explanation.

For access, correction, and deletion requests, we will verify your identity before processing your request. You will not be required to create a new account to submit or verify a request, but you may be asked to use your existing account. For opt-out requests, we will not require identity verification.

11.3 Appeals

If we deny your privacy request, you may appeal by contacting us at [email protected] with the subject line “Privacy Request Appeal.” We will respond to appeals within sixty (60) days. If you are not satisfied with the outcome of your appeal, you may contact:

• Maryland residents: Consumer Protection Division, Office of the Maryland Attorney General, 200 St. Paul Place, Baltimore, MD 21202, marylandattorneygeneral.gov
• California residents: California Privacy Protection Agency, cppa.ca.gov
• Other states: Your state attorney general’s office

11.4 Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf. We may require verification that the agent is authorized to act on your behalf, such as a signed written authorization or a power of attorney. We may also require identity verification directly from you.

12. State-Specific Privacy Disclosures

12.1 Maryland (MODPA)

The Maryland Online Data Privacy Act (Md. Code Com. Law §§ 14-4601–14-4614) provides Maryland consumers with the rights described in Section 11. Additional Maryland-specific disclosures:

• Data Minimization: WallsTalk collects only the personal information that is reasonably necessary and proportionate to provide or maintain the specific products and services you have requested
• Sensitive Data: WallsTalk does not collect sensitive data as defined by MODPA (including precise geolocation within 1,750 feet, racial or ethnic origin, religious beliefs, health data, biometric data, sexual orientation, or citizenship status). WallsTalk does not sell sensitive data under any circumstances
• Universal Opt-Out: WallsTalk honors the Global Privacy Control (GPC) browser signal as a valid opt-out mechanism
• Data Protection Assessments: WallsTalk conducts data protection assessments for processing activities that present heightened risks, including our AI-powered features, identity resolution enrichment services, and email engagement tracking, as required by MODPA § 14-4610. These assessments are documented internally and available to the Maryland Attorney General upon request
• Algorithm Assessments: Consistent with MODPA § 14-4610(B), we assess each algorithm used in our Services, including our OpenAI-powered AI Assistant, automated report generation logic, and any scoring or enrichment algorithms
• Minors: WallsTalk does not process or sell personal data for targeted advertising where we know or should know the consumer is under eighteen (18) years of age
• Consent Revocation: You may revoke any consent you have provided at any time. We will cease processing based on that consent within thirty (30) days of receiving your revocation request

12.2 California (CCPA/CPRA)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100–1798.199.100), provides California residents with specific privacy rights. Additional California-specific disclosures:

Categories of personal information collected in the preceding 12 months:

• Identifiers: Name, email address, phone number, IP address, account name
• Customer Records: Name, business address, phone number, professional license information
• Commercial Information: Subscription and transaction records, credit usage history, reports generated
• Internet/Electronic Network Activity: Usage data, browser type, userAgent strings, engagement data (email opens and clicks)
• Professional Information: Professional license type, business name, professional role
• Inferences: Engagement patterns, platform usage profiles (derived from usage data for product improvement only)

Sale and Sharing: WallsTalk has not sold personal information in the preceding twelve (12) months. WallsTalk has not shared personal information for cross-context behavioral advertising in the preceding twelve (12) months.

Retention: We retain personal information as described in Section 6 of this Privacy Policy.

Do Not Sell or Share: WallsTalk does not sell your personal information for monetary or other valuable consideration. WallsTalk does not share your personal information for cross-context behavioral advertising. Because we do not engage in these practices, we do not offer a separate “Do Not Sell or Share My Personal Information” link. If our practices change in the future, we will update this Policy and provide the required link.

Shine the Light (Cal. Civ. Code § 1798.83): California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. WallsTalk does not disclose personal information to third parties for their direct marketing purposes.

Financial Incentives: WallsTalk does not offer financial incentives or price differences in exchange for the retention or sale of personal information.

12.3 Virginia, Colorado, Connecticut, and Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana, Indiana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Kentucky, Rhode Island, Tennessee, Minnesota, and other states with comprehensive privacy laws have the rights described in Section 11, as applicable under their respective state laws. The process for exercising these rights is the same for all states: submit your request as described in Section 11.2.

Minnesota residents: You have the additional right to ask questions about our profiling practices and how the results of profiling are used.

Texas and Nebraska residents: Your state privacy laws apply regardless of processing volume thresholds.

Opt-out preference signals: WallsTalk honors the Global Privacy Control signal as a valid universal opt-out mechanism in all states that recognize it, including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.

13. Data Processing Roles

WallsTalk operates in two capacities depending on the type of data being processed:

• Controller: WallsTalk is the controller for account registration data, property data sourced from our data providers and public APIs, AI processing logic and methodology, platform analytics, and decisions about how enrichment services operate. As controller, WallsTalk determines the purposes and means of processing this data.
• Processor: WallsTalk acts as a processor for Contact Data that you upload to the platform and for automated communications sent on your behalf. In these contexts, you (the user) are the controller who determines the purposes and means of processing, and WallsTalk processes the data on your behalf in accordance with your instructions and our Terms of Service.

When WallsTalk acts as a processor, we process Contact Data only in accordance with documented instructions from you and in compliance with our Terms of Service. Enterprise customers may request a Data Processing Agreement by contacting [email protected].

14. Do Not Track

Some browsers include a “Do Not Track” (DNT) signal. There is no accepted standard for how to respond to DNT signals, and we do not currently respond to DNT signals. However, we do honor the Global Privacy Control (GPC) signal as described in Section 4.3.

15. Third-Party Links

The Services may contain links to third-party websites or services that are not operated by WallsTalk. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party website or service before providing personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account or by posting a prominent notice on the Services at least fourteen (14) days before the changes take effect. We will also update the “Effective Date” at the top of this page. We encourage you to review this Privacy Policy periodically.

If we make changes to our data practices that are materially inconsistent with the representations made to you at the time your data was collected, we will provide you with the opportunity to access, correct, delete, or opt out of the new uses of your personal information, consistent with the Maryland Online Data Privacy Act.

17. Contact Us

If you have any questions about this Privacy Policy, your privacy rights, or our data practices, please contact us:

C&A Software, LLC (d/b/a WallsTalk)

303 Lane Ct

Bel Air, MD 21014

[email protected]

For privacy-specific requests, please include “Privacy Request” in the subject line of your email so we can route and track your request appropriately.

© 2025–2026 C&A Software, LLC. All rights reserved.