privacy policy

1. Who we are

In this policy, “cahbi,” “we,” “us,” and “our” refer to David Joseph Palmer Jr. doing business as Lonely Brew Club when operating the cahbi technology platform.

John Palmer provides the licensed real estate and mortgage brokerage services identified on this site. The brokerage, mortgage, lending, credit, MLS/VOW, settlement, and other organizations identified in your engagement, application, account, or transaction materials may have their own responsibilities for information in their possession. Their privacy notices and legally required disclosures also apply within their scope.

2. Scope of this policy

This policy applies to personal information collected through cahbi websites, intake forms, portal accounts, buyer workflows, communications, document and identity processes, real estate and mortgage support, and related offline interactions. It applies to prospective buyers, buyers, borrowers, co-borrowers, portal users, and people who communicate with us about those services.

This policy does not replace a separate financial privacy notice, consumer-report authorization, lender notice, MLS/VOW agreement, or notice supplied by another organization. It also does not govern an independent website or service that links to its own privacy notice.

3. Notice at Collection and 12-month disclosure

The table below describes the categories of personal information that cahbi collects or may collect when the corresponding feature or service is used. It also describes the preceding 12 months to the extent the corresponding feature or service was active during that period. Not every category is collected from every person. Collection depends on the feature you use, the information you choose to provide, and the services you authorize.

We do not collect additional categories or use collected information for materially different, unrelated purposes without giving any notice and obtaining any consent required by law.

4. Sources and uses

We obtain personal information from:

• You, including through forms, uploads, messages, and calls.
• Your browser, device, account, and interaction with the site or portal.
• John Palmer and personnel authorized to work on your inquiry or file.
• Service providers that operate forms, databases, authentication, communications, workflow automation, document signing, identity verification, asset or income verification, and security.
• Lenders, mortgage providers, credit providers, employers or verification sources, when you authorize the collection or the law otherwise permits it.
• MLS/VOW systems, listing sources, public property records, sellers and their representatives, and transaction participants.
• Referral sources when they lawfully send us your inquiry.

We use personal information to:

• Respond to you and provide the cahbi platform.
• Support licensed real estate and mortgage brokerage services provided by John Palmer.
• Evaluate purchasing power, prepare information, verify documents, and submit information when you authorize it.
• Provide portal, property-search, and MLS/VOW access where permitted.
• Coordinate offers, inspections, escrow, title, lending, and closing.
• Authenticate users, prevent fraud, protect accounts, and secure systems.
• Communicate by the channels you select and maintain consent, compliance, transaction, dispute, and audit records.
• Measure cahbi’s own buyer journey, improve services, diagnose problems, and understand broad site traffic without providing that information to advertising networks.

5. How information is disclosed

We disclose personal information only as reasonably necessary for a disclosed purpose, at your direction, or as permitted or required by law. Recipient categories include:

• John Palmer and personnel authorized to support your file.
• Platform service providers for hosting, databases, CRM, forms, workflow automation, authentication, communications, document signing, storage, security, identity, and verification.
• Lenders, mortgage brokers, credit reporting or verification providers, loan-origination systems, and underwriting providers involved in an authorized mortgage request or application.
• MLS/VOW and listing providers, sellers and their representatives, escrow, title, appraisal, inspection, insurance, HOA, settlement, and other transaction participants.
• Lawyers, auditors, insurers, accountants, regulators, courts, law enforcement, and other recipients when reasonably necessary to comply with law, protect rights or safety, investigate fraud, or resolve a dispute.
• A successor in a merger, financing, reorganization, or transfer of all or part of the platform, subject to applicable notice and legal restrictions.

We do not permit a service provider to use personal information for cross-context behavioral advertising on cahbi’s behalf. Another organization that independently provides a licensed, financial, MLS, or transaction service may use information under its own legal duties and privacy notice.

6. Do not sell or share

If your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of sharing and the Meta pixel does not load. You can also use the control below; your choice is stored in your browser and applies to this device.

We do not knowingly sell or share personal information of anyone under 16 years old.

7. Cookies, storage, analytics, GPC, and Do Not Track

cahbi may use cookies and browser storage required for authentication, security, language or interface preferences, and session continuity. The public site also uses a first-party funnel beacon operated through cahbi’s own account and database. It helps us understand visits, CTA use, intake progress, submissions, and calculator completion.

The current funnel beacon uses a random per-visit identifier stored in session storage. It may record page path, site host, locale, a referrer stripped of query and fragment data, campaign parameters and ad click identifiers present in the URL, a closed-set CTA category, completion events, browser user agent, and coarse country or region. It does not intentionally send names, email addresses, phone numbers, free-form form entries, uploaded documents, or the financial numbers entered into the calculator. The beacon endpoint does not read or set advertising cookies and does not return person-level conversion data to an advertising network.

Other than the Meta pixel described in this policy, we do not permit another party to collect personal information through cahbi over time and across unrelated websites for that party's own advertising or profiling.

Your IP address is necessarily processed to deliver and protect an internet service, but the current funnel record does not store the raw IP address. Hosting and security providers may separately process network data to deliver requests and prevent abuse.

A browser Global Privacy Control signal is honored as a request to opt out of sharing, and the Meta pixel does not load when it is present. GPC and Do Not Track signals do not disable cahbi's first-party operational and funnel analytics, which involve no sale or sharing. You may request deletion of information reasonably linkable to you as described below. Some anonymous session records may not be reasonably linkable to an identified person.

The Meta pixel sets or reads Meta cookies in your browser on public pages only and reports page views and intake completion events to Meta Platforms, Inc., which may use that information for its own purposes as described in Meta's privacy policy. The pixel sends no advanced matching data such as names, email addresses, or phone numbers, and it never runs on signed-in surfaces.

8. Financial privacy, mortgage information, and consumer reports

When you seek mortgage-related services, information in your file may be nonpublic personal information under federal or state financial privacy law. This can include financial, employment, asset, debt, credit, identity, and loan-related information. It is used and disclosed only as reasonably necessary to provide requested services, process an authorized mortgage inquiry or application, maintain records, comply with law, protect against fraud or security incidents, and work with providers and transaction participants involved in your file.

This policy is not a substitute for a financial institution’s privacy notice under the Gramm-Leach-Bliley Act. John Palmer, a lender, mortgage broker, credit provider, or other financial institution may provide a separate notice. That notice controls the institution’s handling of information within its scope.

A general inquiry does not authorize a consumer-report pull. Before a consumer report is obtained, the responsible party must have a permissible purpose and any authorization required by the Fair Credit Reporting Act or other law. If information from a consumer report contributes to an adverse decision, the responsible financial institution or licensed party must provide any required adverse-action notice and credit-provider information.

9. Documents, identity verification, and MLS/VOW access

Upload sensitive documents only through the secure upload process provided by cahbi. Documents may be stored in private platform storage and made available through controlled access to you, John Palmer and authorized staff, and providers that need them for the requested service. Do not send Social Security numbers, bank statements, identity documents, or similar information through ordinary email unless you are specifically given an approved secure process.

Identity verification may be performed by a specialized provider. That provider may collect an identification document, selfie, liveness signal, or biometric information under its own notice. cahbi is designed to receive the result and identifiers needed to continue the workflow rather than a reusable biometric template.

MLS/VOW and listing access may require a separate registration, consumer-broker relationship acknowledgment, clickwrap agreement, and provider rules. Listing and usage information may be disclosed to the applicable MLS/VOW or listing provider as required to supply access, enforce its rules, and prevent scraping or redistribution.

10. Retention and deletion

The current retention schedule uses these category-level periods and criteria: deal, transaction, executed-document, identity-verification-result, consent, and security-audit records generally follow a five-year schedule; financial-verification reports and derived profiles are targeted for disposal no later than 24 months after closing; marketing and nurture contacts are kept until opt-out or 24 months of inactivity; browser session storage normally ends with the session; daily database backups use a 35-day rolling window; and pre-change snapshots may be kept for 12 months.

A specific record may be kept longer when reasonably necessary for an active account or transaction, a brokerage or mortgage recordkeeping duty, a credit or fair-lending obligation, tax or accounting records, fraud or security prevention, dispute resolution, an audit, enforcement of an agreement, or a valid legal or litigation hold. Category-level details appear in the Notice at Collection table.

When no exception or hold applies, records are reviewed for deletion, deidentification, or other reasonable disposal. A valid deletion request does not require deletion of information that applicable law allows or requires us or another responsible organization to retain.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure. Specific security controls may vary by system and vendor. Do not upload documents unless you are using the secure upload process provided by cahbi.

If you believe your account or information may be at risk, contact us promptly at hello@cahbi.com. Do not include sensitive documents or full account numbers in that message.

12. Automated tools and human review

cahbi may use rules, models, or automated tools to route work, identify missing information, summarize documents, surface possible inconsistencies, generate drafts, detect fraud or security risks, and support property or workflow recommendations. These tools support the service and human review.

When a document-analysis feature is enabled, cahbi may disclose redacted document text, document metadata, and relevant property or transaction context to a contracted artificial-intelligence provider acting as a service provider. The provider may process that information only for the requested analysis and subject to the applicable service agreement and legal restrictions.

cahbi does not make a final lending, underwriting, appraisal, property, legal, or brokerage decision solely through an automated tool. John Palmer, a lender, or another responsible licensed or regulated party makes the applicable decision and remains responsible for required notices. If a future use triggers an additional access, opt-out, or appeal right under applicable law, we will provide the required notice before that use.

13. California privacy rights

Subject to applicability, identity verification, and legal exceptions, California residents may have the right to:

• Know the categories and specific pieces of personal information collected, used, disclosed, sold, or shared.
• Access or receive a portable copy of eligible information.
• Delete eligible personal information.
• Correct inaccurate personal information.
• Opt out of sale or sharing for cross-context behavioral advertising.
• Limit certain uses or disclosures of sensitive personal information when that right applies.
• Receive equal service and not be retaliated against for exercising a right.

cahbi uses sensitive personal information only for the requested services, identity and account security, fraud prevention, and legal or compliance purposes described in this policy. We do not use it to infer unrelated characteristics or for cross-context behavioral advertising. We therefore do not currently offer a separate “Limit the Use of My Sensitive Personal Information” control. If our use changes in a way that triggers that right, we will provide the required notice and control before the change.

Some financial information governed by the Gramm-Leach-Bliley Act, consumer-report information governed by the Fair Credit Reporting Act, or other regulated information may be wholly or partly exempt from a particular state privacy right. Other legal access, correction, dispute, and notice rights may apply instead.

14. How to submit a privacy request

Email hello@cahbi.com with the subject “Privacy Request.” Tell us the right you want to exercise and provide the name, email address, telephone number, or portal information you previously used with cahbi. Do not email a Social Security number, government identification image, bank record, or other sensitive document. If additional verification is needed, we will provide a safer method.

We verify requests by matching information you provide against information already associated with the relevant account or file and, when appropriate, by asking you to authenticate or confirm through an existing contact channel. We use verification information only for the request and related security or compliance records. We may deny or limit a request if we cannot reasonably verify it or if an exception applies, and we will explain the basis when required.

We will confirm receipt and respond within the period required by applicable law. When the CCPA applies, we generally confirm receipt within 10 business days. Verified access, correction, or deletion requests are generally answered within 45 calendar days. If a permitted extension is reasonably necessary, we will notify you and explain why.

Authorized agents

An authorized agent may submit a request for you. We may require proof of the agent’s signed permission or valid power of attorney and may contact you directly to verify your identity and confirm the request, unless applicable law provides otherwise. An agent should email the same address with the subject “Authorized Agent Privacy Request.”

Non-discrimination

We will not deny services, charge a different price, provide a different level of service, or retaliate because you exercised an applicable privacy right. This does not prevent a result that is reasonably related to information needed for a requested service or permitted by law.

California direct-marketing disclosure

California residents may request information about certain disclosures of personal information to third parties for their own direct-marketing purposes. You may submit that request using the method above.

15. Children

cahbi is not directed to children under 13. If we learn that personal information was submitted by a child under 13 without legally sufficient parental authorization, contact us so we can review the information and take the action required by law. Because cahbi does not sell or share any person’s personal information, it also does not sell or share personal information of people it knows are under 16.

16. Changes to this policy

We may update this policy when our services, vendors, or legal duties change. We will post the updated policy and change the “Last updated” date. If a change materially affects how we use information already collected, we will provide any additional notice and obtain any consent required by law before applying the change.

17. Contact

Questions, privacy requests, or accessibility requests for this policy may be sent to hello@cahbi.com. Please do not include sensitive documents in ordinary email.