Privacy Policy

Overview

This Privacy Policy describes how Welcome to Whatcom LLC ("Welcome to Whatcom," "we," "us," or "our") collects, uses, and discloses information when you use welcometowhat.com and our related real estate search, communication, notification, and agent-resource services (collectively, the "Services").

This policy applies to information handled through the Services. Third-party websites, applications, and services have their own privacy practices.

Information We Collect

Information You Provide

Depending on how you use the Services, we may collect:

• Contact and account information, such as your name, email address, phone number, profile photo, sign-in information, and communication preferences.
• Real estate interests and activity, such as property searches, saved searches, favorites, notes, recently viewed homes, tours, map preferences, showing requests, and property addresses submitted for valuation or other services.
• Communications, including messages, questions, feedback, and information you include in contact, valuation, showing, or lead forms. Depending on your request, this may include a property address and preferred showing dates or times. An address entered only to view an anonymous valuation result is not treated as a lead; the address is routed for broker follow-up only if you voluntarily submit a form.
• Collaboration information, such as the names or email addresses of people you invite to a shared search, favorite group, tour, or house-hunting partnership.
• Agent-resource information, such as contact details, brokerage-transfer information, dates, notes, tasks, and help requests submitted through an agent runbook or onboarding portal.

Information Collected Automatically

When you use the Services, we and our service providers may automatically collect:

• Device and log information, including IP address, browser type, device type, operating system, user agent, access times, pages and URLs visited, and referring pages.
• Usage information, including searches, filters, map activity, listing views, favorites, clicks, feature use, campaign information, and interactions with our emails or advertisements.
• Consent-limited product analytics, when permitted by your CookieYes settings and applicable consent or opt-out rules. We use PostHog with first-party browser storage to recognize a browser across visits and measure page and listing views, searches, favorites, shares, tour planning, and inquiry submissions. We may send listing identifiers and non-address property characteristics, such as price, bedrooms, and square footage. After account sign-in, we may connect prior permitted activity to a pseudonymous analytics profile using a PostHog-specific internal identifier. An accepted inquiry event may carry an opaque internal reference that lets us reconcile product analytics with our own lead record. We do not send PostHog your name, email address, phone number, form messages, street-address text, URL query strings, advertising click identifiers, exact search values, typed valuation addresses, or CRM identifiers. When Analytics is permitted, we may send PostHog the campaign source, medium, and campaign label associated with a visit. We do not send URL query strings, keyword or creative values, or unique advertising click identifiers.
• Location information, including approximate location derived from an IP address and, if you allow it, device location used for map and nearby-property features. For PostHog events, a network IP address may be used briefly for bot detection and approximate geographic enrichment, but our PostHog project is configured to discard the raw client IP address before the event is stored.
• Cookies and similar technologies, including pixels, browser storage, consent records, and advertising or analytics identifiers.
• Abuse-prevention information, including a temporary pseudonymous identifier produced from an IP address using keyed HMAC-SHA-256. Our rate-limiting provider receives the pseudonymous identifier rather than the raw IP address used to create it.
• Notification and diagnostic information, including browser push-subscription details, error reports, performance information, and sampled or error-triggered session recordings used to troubleshoot errors. Sentry recording is configured to mask all text and inputs. When Analytics is permitted, PostHog may collect a limited sample of sessions on designated public pages. PostHog recordings mask page text and form inputs and exclude private, account, invitation, administration, tokenized, address-bearing, and shared-tour routes. Console logs, network request contents, canvas content, and cross-origin frames are not included.

Information from Other Sources

We may receive information from sign-in providers such as Google, real estate listing sources such as NWMLS and MLS Grid, advertising and analytics partners, and people who invite you to use a collaborative feature.

We may temporarily preserve allow-listed, campaign-level UTM parameters in session storage for the current browser tab so a voluntary inquiry can retain its first-party source and campaign context. Advertising click identifiers are preserved and added to a lead record only while advertising is permitted. Click identifiers are removed when permission is absent or withdrawn, or when a Global Privacy Control signal applies.

Please do not include Social Security numbers, financial account credentials, medical information, or other sensitive information in free-form messages.

How We Use Information

We may use information to:

• Provide, maintain, personalize, and improve the Services.
• Create and manage accounts, saved searches, favorites, tours, collaboration features, and notifications.
• Respond to inquiries and provide real estate, valuation, showing, recruiting, transfer, or onboarding assistance.
• Communicate about requested services, account activity, listings, and, where permitted, marketing.
• Manage leads and customer relationships with the Welcome to Whatcom and John L. Scott Real Estate teams.
• Measure campaigns, personalize advertising, understand use of the Services, and develop new features.
• Detect fraud, prevent abuse, secure the Services, troubleshoot errors, and enforce our Terms of Service.
• Comply with applicable law, real estate rules, MLS/IDX obligations, and other legal or contractual requirements.

Cookies, Analytics, and Advertising

We use cookies, pixels, browser storage, and similar technologies to operate the Services, remember preferences, understand how the Services are used, measure campaigns, and support advertising.

• Necessary technologies support functions such as security, authentication, consent choices, and account features.
• Analytics technologieshelp us understand traffic, searches, feature use, and performance. When Analytics is permitted, PostHog uses first-party local storage to maintain pseudonymous browser and session identifiers across visits. We route PostHog analytics traffic through PostHog's managed reverse proxy. Data sent through that proxy is transmitted to and processed by Cloudflare, a PostHog subprocessor. Anonymous activity does not create a person profile. A profile is created only after an authenticated account is identified with a PostHog-specific pseudonymous identifier. PostHog click autocapture remains disabled; our intentionally defined product events are the source of truth. A limited sample of designated public-page sessions may be recorded with page text and inputs masked.
• Advertising technologies from providers such as Google, Meta, and the OpenAI Ads Measurement Pixel help measure campaigns and may be used to personalize advertising. Paid SDKs and generic page-view events are suppressed on invitation, authentication, administration, private runbook, address-bearing search, and dynamic property-link routes.

We use CookieYes to manage cookie and browser-storage choices. Depending on your location and applicable law, non-essential technologies operate only after consent or subject to an available opt-out. Analytics and Advertising are separate choices. Withdrawing Analytics stops PostHog event collection, cross-visit recognition, identified profiling, and session recording, and removes the PostHog identity stored by our site. Even when advertising storage is limited, providers may receive limited, cookieless consent-state or measurement signals. Global Privacy Control overrides Advertising and Analytics permission, and Do Not Track disables product analytics. User-triggered paid conversion events and unique advertising click identifiers require Advertising permission. Campaign-level UTM dimensions may still accompany a form you voluntarily submit for first-party source reporting.

You can review or change your choices at any time using the "Cookie Settings" link in the footer. You can also control cookies through your browser, although blocking some technologies may affect site features.

How We Disclose Information

We may disclose information in the following circumstances:

• Real estate services. We may share information with the Welcome to Whatcom team, John L. Scott Real Estate, real estate professionals, and other parties involved in responding to or fulfilling your request.
• Service providers. We use providers for hosting, databases, cloud storage, authentication, email, customer relationship management, maps, analytics, advertising, consent management, content management, security, push notifications, and error monitoring. Examples include Vercel, Google, Mapbox, Follow Up Boss, Resend, PostHog, Cloudflare, Sentry, CookieYes, Meta, OpenAI, and Slack. When you voluntarily submit a lead form, the contact details and property or showing context needed to respond may be sent to Follow Up Boss.
• Sharing features. If you invite someone, create a public link, or use a collaborative feature, we share the information needed to provide that feature with the people you select.
• Legal and safety purposes. We may disclose information to comply with law, legal process, or government requests, or to protect rights, safety, property, and the integrity of the Services.
• Business transactions. Information may be disclosed as part of a financing, merger, acquisition, reorganization, sale of assets, or similar transaction.
• At your direction. We may disclose information with your consent or when you ask us to do so.

Sale or Sharing

We do not sell personal information for money. Our use of advertising and measurement providers may involve disclosing identifiers, device information, and internet activity in ways that some privacy laws define as a "sale," "sharing," or targeted advertising. Where applicable, you may opt out through Cookie Settings or by contacting us.

Data Retention

We retain information for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, maintain business and transaction records, comply with legal and MLS obligations, resolve disputes, prevent fraud, and enforce agreements. Retention periods vary based on the type of information and the system in which it is stored.

Deleting an account does not necessarily remove information that must be retained for legal, security, backup, business-record, or transactional purposes, or information maintained by a third party under its own retention practices.

Our automated website cleanup deletes marketing-intake queue rows based on their latest update and legacy listing-inquiry rows based on their creation date after 24 months. This cleanup does not delete a separate Follow Up Boss record or a record retained for an active client, transaction, legal, or regulatory purpose; those systems and obligations have their own retention practices.

Security

We use reasonable administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Choices and Privacy Rights

• Account information. You may update certain profile and notification settings through your account.
• Marketing communications. You may unsubscribe from promotional messages by following the instructions in the message or contacting us. We may still send service, account, or transaction-related messages.
• Push and location permissions. You can change browser-notification and device-location permissions in your browser or device settings.
• Cookie choices. Use Cookie Settings in the footer to manage available cookie and advertising choices.
• Privacy requests. Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information, or to opt out of certain uses or disclosures for targeted advertising. These rights are subject to verification, exceptions, and other limitations under applicable law.

To submit a privacy request, email privacy@welcometowhat.com. We may request information needed to verify your identity and authority. We will respond as required by applicable law.

MLS Data and Third-Party Services

Property information displayed through the Services is licensed from NWMLS through MLS Grid and is subject to applicable IDX rules. This listing information generally concerns properties and real estate professionals rather than information collected from you.

The Services may contain links to or content from third parties, including maps, street imagery, videos, virtual tours, social networks, and other websites. Those third parties may collect information under their own privacy policies and terms.

Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review the request.

Processing in the United States

We are based in Washington State, and information may be processed and stored in the United States and other locations where our service providers operate.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date shows when the policy was most recently revised. Changes are effective when posted unless otherwise stated.

Contact Us

Questions or requests about this Privacy Policy may be sent to:

• Email: privacy@welcometowhat.com
• Phone: (360) 812-2080
• Mail: 3410 Woburn St, Bellingham, WA 98226