Privacy Policy

---

Welcome, and thank you for using our Services. This Privacy Policy describes how Nordic Real Estate Services, LLC ("Nordic Real Estate Services," "NRES," "Company," "We," "Us," or "Our") collects, uses, discloses, and protects your information when you use the Solsten software platform and any associated websites, products, services, and applications (collectively, the "Services").

The Solsten software platform is owned by Compass HoldCo LLC and operated by Nordic Real Estate Services, LLC. References to "We" or "Us" in this Privacy Policy refer to Nordic Real Estate Services, LLC as the operator of the Services.

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use the Services.

This Privacy Policy should be read in conjunction with our License Agreement, Terms of Use, and AI Use Policy.

---

Table of Contents

1. Scope of This Policy
2. Information We Collect
3. How We Use Your Information
4. Disclosure of Information
5. Data Retention
6. Your Rights and Choices
7. Security
8. Data Breach Notification
9. Communications
10. Cookie Policy
11. External Links and Third-Party Services
12. Children's Privacy
13. International Users and Cross-Border Transfers
14. Jurisdictional Privacy Notices
15. Changes to This Privacy Policy
16. Contact Us

---

1. SCOPE OF THIS POLICY

1.1. This Privacy Policy applies to all information collected through the NordicRealEstateServices.com website, the Solsten software platform hosted at app.nordicrealestateservices.com, and any associated NRES websites, products, services, and applications.

1.2. This Privacy Policy does not apply to:

1. Information collected by third-party websites, services, or applications that may be linked from or integrated with our Services — we recommend reviewing their respective privacy policies;
2. Employment-related information collected from current or former job applicants, employees, owners, directors, officers, or contractors of Nordic Real Estate Services — please contact us for the applicable policy; or
3. Information collected by our customers through their own use of our platform — any questions about data collected by our customers should be directed to the applicable customer.

1.3. When using our Services, you may interact with features or links operated by third parties (such as social media widgets or external websites). Nordic Real Estate Services does not control and is not responsible for the privacy practices of such third parties.

---

2. INFORMATION WE COLLECT

We collect information in three ways: information you provide to us, information collected automatically, and information obtained from third parties.

2.1. Information You Provide to Us

(a) Account and Profile Information. When you create an account, register for the Services, or update your profile, you may provide: first and last name, email address, phone number, login credentials (username and password), job title and function, company name, company logo, and business address or geographical location.

(b) Payment Information. To subscribe to or pay for the Services, you may provide: credit or debit card information, bank account information, billing address, and other financial information necessary to process payments. Payment processing is handled by our third-party payment processors, and we do not store full credit card numbers on our servers.

(c) Identity Verification Information. For security, regulatory compliance, or payment-related purposes, you may be required to provide: government-issued identification, date of birth, or answers to security questions.

(d) Business Data. When you use our Services, you provide us with data related to your business and real estate properties, including property details, financial analyses, tenant information, lease data, expense records, revenue projections, and calculation results ("Business Data"). We understand that your Business Data may be sensitive and confidential. We treat Business Data in accordance with the protections described in Sections 3 and 4 of this Privacy Policy.

Important: We do not independently collect, scrape, crawl, mine, or harvest property data, market data, financial data, or any other real estate information from third-party databases, listing services, proprietary platforms, or any other external source. All Business Data in our Services is provided directly by our users. We have no knowledge of the sources from which users obtain data prior to entering it into the Services.

(e) Communications and Feedback. When you contact our support team, respond to surveys, participate in promotions, submit feedback, or otherwise communicate with us, we collect the content of those communications.

(f) Community and Forum Content. If you participate in any community features (forums, property sharing, blogs, or comment sections), any information you voluntarily disclose in those public or semi-public spaces may be collected, viewed, or used by other users.

(g) AI Interaction Data. If you use AI-assisted features (such as Saga), we may collect prompts, responses, context snippets, feedback, and related metadata (for example timestamps, property identifiers, and usage metrics) to provide the feature, enforce safety controls, troubleshoot issues, and improve Service quality.

2.2. Information Collected Automatically

(a) Device and Browser Information. When you access or use our Services, we automatically collect information about your device and browser, including: IP address, device type, operating system, browser type and version, hardware identifiers, device event information (such as crashes and system activity), and referring/exit URLs.

(b) Usage Information. We collect information about how you interact with our Services, including: pages viewed, features used, links clicked, content accessed, time spent on pages, and navigation patterns.

(c) Location Information. We may collect approximate location information based on your IP address. We do not collect precise GPS-based location data unless you explicitly grant permission.

(d) Cookies and Similar Technologies. We use cookies, pixel tags, web beacons, local storage, and similar technologies to collect information about your interactions with our Services. See Section 10 (Cookie Policy) for details.

(e) Log Data. Our servers automatically record information when you access the Services, including: access times, server logs, error logs, and request/response data.

2.3. Information from Third-Party Sources

(a) Publicly Available Information. We may collect information about you or your company from publicly accessible sources, such as public records, news articles, professional networking sites, and government databases.

(b) Service Providers and Partners. We may receive information from third-party service providers who assist us with analytics, fraud detection, identity verification, or payment processing.

(c) Single Sign-On and Authentication Providers. If you choose to authenticate through a third-party service (e.g., Google, Microsoft), we may receive profile information from that provider in accordance with their policies and your privacy settings.

---

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1. Providing and Operating the Services

1. Creating, maintaining, and securing your account;
2. Processing transactions and managing your subscription;
3. Delivering the features and functionality of the Services, including property analysis, financial calculations, and data management;
4. Providing customer support and responding to inquiries;
5. Sending transactional communications (account confirmations, password resets, subscription notices, security alerts).

3.2. Improving and Developing the Services

1. Analyzing usage patterns and trends to improve functionality, performance, and user experience;
2. Conducting internal research and development;
3. Identifying and fixing bugs, errors, and security vulnerabilities;
4. Developing new features, products, and services.

3.3. Aggregated and Anonymized Analytics

We may aggregate and anonymize Business Data and other information to produce industry benchmarks, market reports, trends, and studies. All such aggregated data will be fully anonymized so that no individual, company, or specific property can be identified. We will never publish, sell, or distribute your identifiable Business Data without your explicit consent. All aggregated and anonymized data is derived exclusively from data submitted directly by our users through the Services.

3.4. Safety and Security

1. Detecting, investigating, and preventing security incidents, fraud, abuse, and other harmful or unauthorized activity;
2. Enforcing our License Agreement, Terms of Use, and other policies;
3. Complying with legal obligations, court orders, and governmental requests;
4. Protecting the rights, safety, and property of NRES, our users, and the public.

3.5. Communications and Marketing

1. Sending you information about our Services, including product updates, new features, educational content, and newsletters;
2. Notifying you of changes to our policies or terms;
3. With your consent, sending promotional communications about our Services.

You may opt out of marketing communications at any time as described in Section 6.

3.6. AI-Assisted Features

1. Generating natural-language explanations, summaries, and workflow assistance using your authorized account context;
2. Applying abuse-prevention and security controls, including detection and logging of suspicious prompt activity;
3. Evaluating feature quality and safety through controlled testing and monitoring;
4. Improving AI-assisted functionality in a manner consistent with this Privacy Policy and applicable law.

---

4. DISCLOSURE OF INFORMATION

We do not sell your Personal Information or Business Data. We may disclose your information only in the following limited circumstances:

4.1. Service Providers

We share information with third-party service providers who perform services on our behalf, including: cloud hosting and infrastructure, payment processing, email delivery, analytics, customer support tools, and security monitoring. These service providers are contractually obligated to use your information only for the purposes of providing their services to us and are required to maintain the confidentiality and security of your information.

4.2. Professional Advisors

We may disclose information to our attorneys, accountants, auditors, and other professional advisors as necessary for the operation of our business, subject to confidentiality obligations.

4.3. Legal Compliance and Protection

We may disclose information when we believe in good faith that disclosure is necessary to:

1. Comply with applicable law, regulation, legal process, or governmental request;
2. Enforce our agreements, policies, and terms of service;
3. Protect the security or integrity of our Services;
4. Protect the rights, property, or safety of NRES, our users, or the public; or
5. Detect, prevent, or address fraud, security, or technical issues.

4.4. Business Transfers

If Nordic Real Estate Services or Compass HoldCo LLC is involved in a merger, acquisition, reorganization, bankruptcy, asset sale, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your information.

4.5. With Your Consent

We may disclose your information to third parties when you have given your explicit consent to do so.

4.6. Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that does not reasonably identify any individual or company. This data may be used for industry benchmarks, market analysis, research, and publications.

4.7. AI and Model Service Providers

To provide AI-assisted features, we may share limited data with third-party model and infrastructure providers acting as our service providers/processors. We require such providers by contract to process data only for authorized service purposes and to maintain appropriate confidentiality and security protections. Our service providers may change from time to time as our systems evolve.

Current service providers may include: OpenAI (AI model processing), Google (reCAPTCHA, Gmail API, Google Analytics), Brevo (email automation), HubSpot (CRM), DigitalOcean (application hosting and managed infrastructure), Cloudflare (DNS and edge security services), Netlify (marketing site hosting), and YouTube (embedded video delivery on marketing pages).

---

5. DATA RETENTION

5.1. We retain your Personal Information and Business Data for the duration of your account and subscription, plus a reasonable period thereafter as necessary to:

1. Fulfill the purposes described in this Privacy Policy;
2. Comply with applicable legal, tax, and regulatory retention requirements;
3. Resolve disputes and enforce our agreements; and
4. Maintain business records as required by law.

5.2. Following termination or expiration of your account:

1. You will have thirty (30) days to export your data through the Service's export functionality (the "Export Period");
2. After the Export Period, we will delete or anonymize your Business Data within ninety (90) days, except as required by law;
3. We may retain aggregated, anonymized data indefinitely for analytics and reporting purposes;
4. We may retain limited account information (name, email, subscription history) for up to three (3) years after termination for legal compliance and dispute resolution purposes.

5.3. If you request deletion of your personal information under applicable privacy law, we will process your request as described in Section 6.

5.4. AI interaction records and security event logs may be retained for a limited period as necessary for abuse prevention, incident response, legal compliance, and service integrity, then deleted or anonymized in accordance with our retention practices.

---

6. YOUR RIGHTS AND CHOICES

6.1. General Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

(a) Access. The right to request a copy of the personal information we hold about you.

(b) Correction. The right to request correction of inaccurate or incomplete personal information.

(c) Deletion. The right to request deletion of your personal information, subject to certain legal exceptions.

(d) Data Portability. The right to receive your personal information in a structured, commonly used, machine-readable format.

(e) Opt-Out of Sale/Sharing. The right to opt out of the sale or sharing of your personal information for targeted advertising purposes. Note: Nordic Real Estate Services does not sell your personal information.

(f) Non-Discrimination. The right not to be discriminated against for exercising your privacy rights.

6.2. How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: support@NordicRealEstateServices.com
• Mail: Nordic Real Estate Services, LLC, 1919 84th Ave, Greeley, CO 80634

We will respond to verifiable requests within forty-five (45) days of receipt. If additional time is required (up to 90 days total), we will notify you in writing with an explanation.

6.3. Marketing Opt-Out

You may opt out of receiving marketing and promotional communications from us at any time by:

1. Clicking the "unsubscribe" link included in marketing emails;
2. Emailing us at support@NordicRealEstateServices.com; or
3. Updating your communication preferences in your NRES Account settings.

Please note that opting out of marketing communications will not affect transactional or service-related communications that are necessary for the operation of your account (such as security alerts, billing notices, and subscription confirmations).

6.4. Account Deletion

You may request deletion of your account and associated data by contacting us at support@NordicRealEstateServices.com. Account deletion is subject to the data retention provisions in Section 5.

6.5. Automated Processing Notice

Some Service features use automated processing, including machine learning and AI-assisted generation. These features are intended to support user workflows and are not intended to be the sole basis for legal, investment, accounting, tax, employment, insurance, housing, or credit decisions.

6.6. Enterprise Privacy Requests

If you require additional contractual privacy or security documentation, such as a data processing addendum, you may contact us at support@NordicRealEstateServices.com. Any such documentation is subject to legal review, plan eligibility, and mutual agreement.

---

7. SECURITY

7.1. Nordic Real Estate Services takes the security of your information seriously. We implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including:

1. Encryption of sensitive data in transit (TLS/SSL) and at rest;
2. Multi-layer perimeter security, including firewalls and intrusion detection systems;
3. Access controls limiting access to personal information to authorized personnel who need it to perform their job functions;
4. Regular security reviews and assessments;
5. Secure server hosting environments with managed infrastructure; and
6. Contractual requirements for third-party service providers to maintain security standards consistent with our own.

7.2. While we strive to protect your information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security and are not responsible for any unauthorized access, loss, or alteration of information beyond our reasonable control, to the fullest extent permitted by applicable law.

7.3. You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Please notify us immediately at support@NordicRealEstateServices.com if you suspect unauthorized access to your account.

---

8. DATA BREACH NOTIFICATION

8.1. In the event we become aware of a security breach that results in unauthorized access to, disclosure of, or loss of your personal information, we will:

1. Investigate and take prompt steps to contain and remediate the breach;
2. Notify affected users without undue delay and in accordance with applicable law;
3. Provide information about the nature of the breach, the types of information involved, and the steps we are taking to address the breach; and
4. Cooperate with applicable regulatory authorities as required.

8.2. Where required by applicable law, we will provide notification within the timeframes mandated by such law (e.g., 72 hours under GDPR, "most expedient time possible" under Colorado law).

---

9. COMMUNICATIONS

9.1. Service-Related Communications. We will send you transactional and service-related communications necessary for the operation of your account, including: account verification, password resets, subscription confirmations, billing notices, security alerts, and system notifications. These communications are not marketing and cannot be opted out of while you maintain an active account.

9.2. Product Updates and Newsletters. We may periodically send you information about our Services, including new features, product updates, educational content, and newsletters. You may opt out of these communications as described in Section 6.3.

9.3. Research and Surveys. We may occasionally contact you to understand how you use our Services and how we can improve them. Participation in surveys and research is voluntary.

9.4. Methods of Communication. We may communicate with you via email, through notifications within the Service, or through your NRES Account. We will use the contact information you have provided to us.

---

10. COOKIE POLICY

10.1. What Are Cookies

Cookies are small text files that are stored on your device when you visit a website. They serve various purposes, including remembering your preferences, enabling functionality, and helping us understand how you interact with our Services.

10.2. Types of Cookies We Use

(a) Strictly Necessary Cookies. These cookies are essential for the operation of our Services. They enable core functionality such as authentication, security, and session management. These cookies cannot be disabled without impairing the functionality of the Services.

(b) Functional Cookies. These cookies remember your preferences and settings (such as language, display preferences, and region) to provide a more personalized experience.

(c) Analytics Cookies. These cookies help us understand how users interact with our Services by collecting information about pages visited, features used, errors encountered, and performance metrics. This information is used in aggregate to improve our Services.

(d) Security Cookies. These cookies support security features such as fraud detection, authentication monitoring, and abuse prevention.

10.3. Third-Party Cookies

Our Services may use cookies set by third-party service providers for analytics and performance monitoring. These third parties are contractually obligated to use this information only for the purposes of providing their services to us.

10.4. Managing Cookie Preferences

You can manage your cookie preferences through your web browser settings. Most browsers allow you to:

1. View cookies stored on your device;
2. Accept or reject cookies on a per-site or global basis;
3. Delete existing cookies; and
4. Set your browser to notify you when cookies are being set.

Please note that disabling certain cookies may limit your ability to use some features of our Services.

---

11. EXTERNAL LINKS AND THIRD-PARTY SERVICES

11.1. Our Services may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices, content, or security of any third-party sites or services.

11.2. We strongly recommend that you review the privacy policy of every third-party website or service that you access through links within our Services or that collects your information.

11.3. The inclusion of a link to a third-party site within our Services does not imply endorsement, sponsorship, or affiliation with that site.

---

12. CHILDREN'S PRIVACY

12.1. The Services are not directed to individuals under the age of eighteen (18). We do not knowingly collect, solicit, or maintain personal information from anyone under the age of eighteen (18).

12.2. If you are a parent or guardian and believe that a child under 18 has provided us with personal information, please contact us immediately at support@NordicRealEstateServices.com. If we become aware that we have collected personal information from a child under 18, we will take prompt steps to delete such information from our records.

---

13. INTERNATIONAL USERS AND CROSS-BORDER TRANSFERS

13.1. Nordic Real Estate Services is based in the United States and the Services are hosted in the United States. Our Services are primarily marketed to and designed for organizations and individuals located in the United States.

13.2. If you access the Services from outside the United States, you understand and consent to the transfer, processing, and storage of your information in the United States, where data protection laws may differ from those in your country of residence.

13.3. We take commercially reasonable steps to ensure that your information receives an adequate level of protection in the jurisdictions in which we process it.

---

14. JURISDICTIONAL PRIVACY NOTICES

14.1. California Residents — CCPA/CPRA Notice

This section provides additional disclosures required under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"), and applies to California residents ("consumers").

14.1.1. Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information (as defined by the CCPA):

14.1.2. Sale and Sharing of Personal Information

Nordic Real Estate Services does not sell your personal information as defined by the CCPA. We do not share your personal information with third parties for cross-context behavioral advertising.

14.1.3. Your CCPA Rights

As a California resident, you have the following rights:

(a) Right to Know. You may request that we disclose: the categories and specific pieces of personal information we collected about you; the categories of sources from which we collected it; the business or commercial purposes for collecting it; and the categories of third parties to whom we disclosed it.

(b) Right to Delete. You may request that we delete personal information we collected from you, subject to certain legal exceptions (described below).

(c) Right to Correct. You may request that we correct inaccurate personal information we maintain about you.

(d) Right to Opt-Out of Sale/Sharing. You may direct us not to sell or share your personal information. As stated above, we do not sell your personal information.

(e) Right to Limit Use of Sensitive Personal Information. You may request that we limit the use of your sensitive personal information to purposes necessary to provide the Services.

(f) Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA rights. We will not deny you services, charge different prices, provide a different quality of service, or suggest that you will receive different treatment for exercising your rights.

14.1.4. Exercising Your Rights

To exercise your CCPA rights, submit a verifiable consumer request by emailing us at support@NordicRealEstateServices.com. You, or a person authorized to act on your behalf (registered with the California Secretary of State), may make a verifiable consumer request. You may make a request for access or data portability no more than twice in a twelve (12) month period.

Your request must provide sufficient information for us to reasonably verify your identity and describe your request with sufficient detail for us to properly understand, evaluate, and respond to it.

14.1.5. Response Timing

We will respond to verifiable consumer requests within forty-five (45) days of receipt. If we require additional time (up to 90 days total), we will inform you of the reason and extension period in writing. Disclosures will cover the twelve (12) month period preceding the request. For data portability requests, we will provide your information in a readily usable, machine-readable electronic format.

14.1.6. Exceptions to Deletion

We may deny a deletion request if retention of the information is necessary to:

1. Complete a transaction or provide a service you requested;
2. Detect security incidents or protect against fraudulent or illegal activity;
3. Debug products to identify and repair errors;
4. Exercise free speech or another right provided by law;
5. Comply with the California Electronic Communications Privacy Act;
6. Engage in public or peer-reviewed research in the public interest;
7. Enable internal uses reasonably aligned with your expectations;
8. Comply with a legal obligation; or
9. Make other internal and lawful uses compatible with the context in which you provided the information.

14.1.7. California's "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. If you have questions, contact us at support@NordicRealEstateServices.com.

14.2. Colorado Residents — Colorado Privacy Act Notice

If you are a Colorado resident, you may have additional rights under the Colorado Privacy Act (CPA), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us at support@NordicRealEstateServices.com.

14.3. European Union Residents

14.3.1. We primarily market and provide our Services to organizations and individuals based in the United States. We do not intentionally collect personal data from residents of the European Union ("EU") or the European Economic Area ("EEA").

14.3.2. If EU/EEA residents' data is incidentally collected through a customer's use of our Services or through marketing channels, such collection is minimal and incidental.

14.3.3. If you are an EU/EEA resident and believe we hold your personal data, you may request access, correction, deletion, or restriction of processing by contacting us at support@NordicRealEstateServices.com with proof of EU/EEA residency. We will process your request in accordance with applicable law, provided that fulfilling the request is technically feasible, does not impair the legitimate business practices of our customers, and does not conflict with our legal obligations.

---

15. CHANGES TO THIS PRIVACY POLICY

15.1. Nordic Real Estate Services may update or modify this Privacy Policy from time to time to reflect changes in our practices, Services, legal requirements, or business operations.

15.2. When we make material changes to this Privacy Policy, we will:

1. Update the "Last Modified" date at the top of this page;
2. Provide notice through the Services, by email, or by other reasonable means; and
3. Where required by law, obtain your consent before the changes take effect.

15.3. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should discontinue use of the Services.

15.4. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

---

16. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Nordic Real Estate Services, LLC
Attn: Data Privacy Team
1919 84th Ave
Greeley, CO 80634

Email: support@NordicRealEstateServices.com

Website: https://nordicrealestateservices.com

---

Nordic Real Estate Services, LLC
A Colorado Limited Liability Company
Operator of the Solsten Platform on behalf of Compass HoldCo LLC