Privacy Policy

1. Overview

This Privacy Policy explains how KaaS Solutions LLC ("we," "us," or "our") collects, uses, discloses, and protects information in connection with the TitleRelay platform, marketing websites, and related services (collectively, the "Service").

This Policy applies to visitors, account holders, administrators, and authorized users of customer organizations that use the Service.

2. Roles: Controller and Processor

We act in different roles depending on the data:

• For our own website, billing, support, and platform operations data, we are generally the data controller.
• For mortgage order emails, parsed transaction data, borrower and property information, and similar content submitted by or on behalf of our business customers, the customer organization is typically the controller and we process that information as a service provider on the customer's instructions.

Customers remain responsible for providing required privacy notices to their employees, clients, borrowers, and other data subjects, and for obtaining any consents required by applicable law.

3. Information We Collect

We may collect the following categories of information:

• Account and profile information, such as name, email address, role, organization, authentication identifiers, and security settings
• Communications and support requests, including emails and messages you send to us
• Service content, including inbound emails, attachments, parsed order fields, audit logs, configuration settings, and integration metadata
• Sensitive or regulated information that may appear in mortgage and title workflows, which can include Social Security numbers, tax identifiers, financial account details, and other nonpublic personal information when present in customer-provided content
• Technical and usage information, such as IP address, browser type, device information, session data, timestamps, and diagnostic logs
• Billing and transaction information for paid services

4. How We Use Information

We use information to:

• Provide, operate, maintain, and secure the Service
• Authenticate users, enforce access controls, and prevent fraud or abuse
• Parse, display, review, and submit order data according to customer configuration
• Provide customer support and respond to inquiries
• Send administrative, security, and service-related communications
• Monitor performance, troubleshoot issues, and improve the Service
• Comply with legal obligations and enforce our agreements
• Process payments and manage billing where applicable

5. Legal Bases for Processing

Where required by applicable law, we rely on one or more of the following legal bases: performance of a contract, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where appropriate.

6. How We Share Information

We do not sell personal information. We may share information in the following circumstances:

• With our subprocessors (Microsoft Azure and Microsoft Graph API) that host, secure, and deliver the Service, subject to contractual data protection obligations
• With ResWare when you or your organization enable that integration to submit order data
• With your organization's administrators and authorized users according to role-based permissions
• In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality safeguards
• When required by law, legal process, or governmental request, or to protect rights, safety, and security
• With your consent or at your direction

We will provide at least 30 days' prior notice of material additions to our subprocessor list. A current list of subprocessors is available at https://titlerelay.com/subprocessors.

7. Data Retention

We retain information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Specifically:

• Account and profile information is retained for the duration of the customer relationship and for a reasonable period afterward to support any post-termination inquiries or legal obligations.
• Service content, including parsed order data and audit logs, is retained in accordance with customer configuration settings and applicable law. Default audit log retention is 12 months unless a customer configures a different period or applicable law requires otherwise.
• Backup and log copies may be retained for up to 90 days after deletion before being overwritten or destroyed.

Customers may request deletion of their organization's data by contacting hello@titlerelay.com. We will process such requests in accordance with our retention obligations and applicable law.

8. Cookies and Similar Technologies

We use cookies, session tokens, and similar technologies to keep you signed in, remember preferences, protect against abuse, and understand how the Service is used. You can control some cookies through browser settings, but disabling them may affect Service functionality.

9. Data Security

We implement administrative, technical, and organizational measures designed to protect information, including:

• Encryption in transit (TLS) for all Service communications
• Access controls and role-based permissions
• Audit logging of significant account and data access events
• Environment isolation between customer organizations
• Multi-factor authentication support for user accounts

No method of transmission or storage is completely secure. You are responsible for safeguarding your credentials and enabling security features such as multi-factor authentication where available.

In the event of a security incident involving your organization's data that requires notification under applicable law, we will notify you in a timely manner consistent with our legal obligations.

10. Customer Responsibilities

If you are a customer organization, you are responsible for providing any required privacy notices to your employees, clients, and other data subjects, obtaining necessary consents, and responding to data subject requests relating to data you control. You should configure mailbox access, user permissions, auto-submit rules, and retention practices in a manner consistent with your legal and contractual obligations.

11. Your Rights and Choices

Depending on your location and role, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, or to receive a portable copy of information we hold about you.

Account holders should contact their organization's administrator for requests relating to service content controlled by the organization. You may also contact us at hello@titlerelay.com and we will assist or direct your request as appropriate.

Residents of certain U.S. states may have additional rights under applicable state privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), and other states with comprehensive privacy laws. We will not discriminate against you for exercising rights where prohibited by law.

12. International Transfers

We process and store information primarily in the United States through Microsoft Azure infrastructure. Those facilities operate under Microsoft's data protection commitments. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

13. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us at hello@titlerelay.com so we can take appropriate action.

14. Third-Party Links and Services

The Service may link to or integrate with third-party websites and services, including Microsoft and ResWare. Their privacy practices are governed by their own policies, not this Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy, revise the effective date, and where practicable provide notice to tenant administrators by email. Continued use of the Service after a material update constitutes acceptance of the revised Policy.

16. Contact Us

Privacy questions, data subject requests, or security concerns may be sent to hello@titlerelay.com. Please include sufficient detail for us to understand and respond to your request. We aim to respond to all inquiries within 30 days.