This Privacy Policy describes how Opitz Housing Report LLC, an Arizona limited liability company (“Company”, “OHR”, “we”, “us”, or “our”) collects, uses, discloses, and protects information in connection with the website located at opitzhousingreport.com and the related services described in our Terms of Use (collectively, the “Services”). This Privacy Policy is incorporated into, and should be read together with, our Terms of Use. Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms of Use.
This Privacy Policy applies to all visitors to and users of the Services (“Users”, “you”, or “your”), regardless of tier of access (Free Tier or Paid Tier) and regardless of state of residence. Section 14 and Exhibit A describe additional rights that may be available to you depending on your state of residence.
This Privacy Policy applies to information collected through the Site and the Services. It does not apply to information collected by third parties, including the third-party payment processor and identity/authentication provider described in Section 2, except to the extent that information is shared with us as described in this Privacy Policy.
(a) Property Data. Through our property questionnaire, relocation-interest forms, and similar features on the Site, you may provide your name, phone number, property address, and property condition details, such as roof age and HVAC condition (collectively, “Property Data”).
(b) Account and Paid Tier Information. If you register for an account, our third-party identity and authentication service provider collects your login credentials on our behalf, as described in Section 6. If you subscribe to the Paid Tier, we also collect your real estate license number and related licensing information, which we use to verify and maintain a record of your eligibility as described in Section 3. As described in Sections 3 and 6, we also share the identity and license-status information of Paid Tier subscribers with ARMLS on a periodic basis as required under our data license agreement with ARMLS.
(c) Payment Information. If you subscribe to the Paid Tier, our third-party payment processor, Stripe, Inc. (“Stripe”), collects your payment card and billing information directly. We do not collect, transmit to our own servers, or store your payment card information.
(d) Communications. If you contact us directly, including by email, we collect the information you provide in that communication.
When you use the Site, we and our service providers automatically collect certain information through cookies and similar technologies, including your IP address, browser and device type, pages viewed, referring website, and general usage and analytics information (“Usage Data”).
We access certain real estate market data from one or more multiple listing services under our MLS participation agreements. We may also verify, supplement, or analyze property information using public records, county assessor and property databases, and other third-party data sources used to generate reports, as permitted by law. We also receive information from our identity/authentication provider and from Stripe as described in Section 2.1.
We do not intentionally collect precise geolocation from your device; we use only the approximate location inferred from your IP address and the property address you provide. We do not intentionally collect government-issued identification numbers or health information. If you submit any of this information to us in a free-text field or communication without our request, we will use it only as reasonably necessary to respond to you or as otherwise described in this Privacy Policy, and we ask that you not submit this type of information unless we specifically request it.
We use the information described in Section 2 to: (a) operate, maintain, and provide the Services, including generating the Free Tier and Paid Tier analytics, reports, and automated valuation estimates; (b) verify Paid Tier subscriber eligibility and maintain the auditable log of Paid Tier subscribers required under our MLS agreements, including providing ARMLS with a periodic list of Paid Tier subscribers as required under our agreement with ARMLS; (c) process payments through Stripe; (d) respond to inquiries and relocation-interest submissions; (e) maintain, secure, and improve the Site and the Services; (f) detect and prevent fraud, abuse, and security incidents; and (g) comply with applicable law and respond to legal process.
We do not sell, rent, or otherwise disclose your individually identifiable personal information to third parties for those third parties' own independent marketing or advertising purposes, and we do not otherwise “sell” or “share” your personal information as those terms are defined under the state privacy laws described in Section 14 and Exhibit A. The foregoing does not limit the disclosures we make to service providers and to ARMLS as described in Sections 3 and 6. In particular, if you subscribe to the Paid Tier, we are contractually required to provide ARMLS with a periodic list identifying our Paid Tier subscribers and their license status, so that ARMLS can confirm that only current, active ARMLS subscribers access MLS-derived data through the Services. This disclosure is not for ARMLS's own independent marketing or advertising purposes; we do not consider it a “sale” or “share” of personal information for those third parties' own commercial purposes under applicable state privacy law.
Instead, we compile and de-identify Property Data, and where applicable other information we collect, into aggregated data sets that reflect trends by zip code, neighborhood, or similar geography, without identifying any specific individual or property address. We use these aggregated, de-identified data sets both internally, to operate and improve the Services and to prepare Free Tier and Paid Tier reports and analytics, and externally, including by licensing or providing them to third parties such as insurance carriers, researchers, and other market participants, in each case only in aggregate, de-identified form.
Before disclosing an aggregated data set to a third party, we take commercially reasonable steps designed to ensure the data cannot reasonably be used to identify a specific individual, we publicly commit through this Privacy Policy to maintaining that data in de-identified form and not attempting to reidentify it, and we contractually require any third party that receives the aggregated data to maintain its de-identified form and not attempt to reidentify it. Because this aggregated, de-identified data does not identify you and is not linked or reasonably linkable to you, its use and disclosure as described in this Section 4 does not constitute a sale or share of your personal information under applicable state privacy law.
We and our service providers use cookies, web beacons, and similar technologies to operate the Site, remember your preferences, understand how the Site is used, and support security and fraud prevention. You can control cookies through your browser settings; disabling cookies may limit your ability to use certain features of the Site. We do not use your personal information for targeted advertising, as that term is defined under applicable state privacy laws, and we do not use cross-site or cross-app retargeting pixels for advertising purposes. If our practices change, we will update this Privacy Policy and provide any choices required by law. Where required by applicable law, we honor opt-out preference signals, including Global Privacy Control, as described in Section 14 and Exhibit A.
We share information as follows: (a) with service providers who perform functions on our behalf, including Stripe (payment processing) and our identity/authentication provider (account credentials), and hosting, analytics, and similar technical service providers, each of which is restricted from using your information for its own independent purposes; (a-1) with ARMLS, for Paid Tier subscribers, in the form of a periodic list of subscribers and their license status, as required under our data license agreement with ARMLS and solely for verification and compliance purposes; (b) in aggregated, de-identified form, as described in Section 4; (c) to comply with law, respond to legal process, or protect the rights, property, or safety of Company, our Users, or others; (d) in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections; and (e) with your consent or at your direction. We do not otherwise share your individually identifiable personal information with third parties.
Our retention periods vary depending on the category of information, the nature of our relationship with you, the sensitivity of the information, legal requirements, and business needs. As a general matter, we retain personal information for at least five (5) years from the date of collection or from the end of your relationship with us, whichever is later, after which we delete, de-identify, or archive it as described below, unless a longer retention period is required or permitted by law or by the specific obligations described in this Section 7.
| Category | Retention Criteria |
|---|---|
| Account and contact information | While your account is active, and for a reasonable period afterward for legal, support, and business-record purposes. |
| Property Data and generated reports | For as long as needed to provide the Services, support Users, improve report quality, and maintain business records, unless earlier deletion is required by law. |
| Paid Tier license-verification records | For as long as you maintain a Paid Tier subscription and for a reasonable period afterward, to satisfy our recordkeeping obligations under our MLS agreements (including our obligation to maintain an auditable log of Paid Tier subscribers), which may exceed the five (5) year general retention period described above. |
| Payment and billing records | As required for tax, accounting, audit, fraud-prevention, and legal purposes. |
| Marketing records | Until you unsubscribe or opt out, plus a reasonable period to maintain suppression lists and compliance records. |
| Cookie and analytics data | For the period set in our cookie and analytics tools, subject to applicable law. |
| Security and fraud-prevention records | For as long as necessary to protect our Services, investigate activity, and comply with legal obligations. |
We define “archived” information as information that is subject to access controls limiting it to legal, audit, security, dispute-resolution, or similar compliance purposes, that is not used for any new or incompatible purpose, and that remains subject to our data security obligations under Section 8 and our deletion obligations under applicable law. Backup copies of information are deleted or overwritten in the ordinary course of our backup cycle, consistent with our data security practices.
We maintain reasonable administrative, technical, and physical safeguards designed to protect the information described in this Privacy Policy against unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your information, we will notify you as and to the extent required by applicable law.
The Services are not directed to, and are not intended for use by, individuals under the age of eighteen (18). Consistent with the foregoing, we do not knowingly collect personal information from any individual under the age of eighteen (18) (or, where a lower age applies under applicable law, under that age). If we learn that we have collected personal information from a child in violation of applicable law, we will take reasonable steps to delete that information.
Regardless of your state of residence, we offer all Users the following rights with respect to their personal information, subject to certain exceptions permitted by law:
Access/Right to Know. The right to confirm whether we process your personal information and to receive a copy of it and information about our processing of it.
Correction. The right to correct inaccurate personal information we maintain about you.
Deletion. The right to request that we delete personal information we have collected from or about you.
Opt-Out. The right to opt out of any future sale or sharing of your personal information, and of the use of your personal information for targeted advertising, to the extent we engage in either practice.
Portability. The right to receive a copy of the personal information you have provided to us in a portable, readily usable format.
Non-Discrimination. We will not discriminate against you for exercising any of these rights.
Additional rights, procedures, and thresholds that may apply based on your state of residence are described in Section 14 and Exhibit A.
11.1 Submitting a Request. To exercise any of the rights described in Section 10 or Exhibit A, submit a request using the contact information in Section 16. We may need to verify your identity before responding to your request, which may require matching information you provide with information we maintain. You may designate an authorized agent to submit a request on your behalf where permitted by law; we may ask the agent to provide proof of authorization and may also ask you to verify your identity directly with us.
11.2 Response Time. We will respond to verified requests within the time period required by applicable law, generally forty-five (45) days, subject to one permitted extension.
11.3 Appeals. If we decline to take action on your request, you may appeal that decision within a reasonable time by contacting us using the appeals contact in Section 16 and stating that you are appealing our decision. We will respond to your appeal within the time period required by applicable law and, where applicable law requires, will explain our reasons for upholding or reversing our initial decision. If we uphold our decision on appeal and applicable law provides a further right to submit a complaint to your state attorney general or another regulator, we will provide information about that process as required by law.
Our Free Tier and Paid Tier reports and analytics are not intended to provide mortgage, credit, insurance, tax, legal, or financial advice unless expressly stated in a separate written agreement. We do not currently offer mortgage, refinancing, home-equity, insurance, or credit products, and we are not currently a lender, mortgage broker, insurance producer, or other financial institution for purposes of the Gramm-Leach-Bliley Act (“GLBA”). If we later offer financial products or services, assist with loan or insurance applications, obtain nonpublic personal financial information in connection with a covered financial activity, or otherwise become subject to financial privacy laws, we will provide additional privacy notices and safeguards as required by law.
The Services are intended for use within the United States. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local law. Your information will be processed and stored in the United States.
A number of states have enacted comprehensive consumer privacy laws that grant their residents specific statutory rights, in addition to the baseline rights we extend to all Users under Section 10. Exhibit A to this Privacy Policy identifies, by state, the comprehensive privacy laws enacted as of the Effective Date of this Privacy Policy, a general description of the rights those laws grant, and how those rights may be exercised.
Because these laws' applicability thresholds (for example, the number of consumers' personal information a business processes annually) can change over time as our business grows, Exhibit A describes the rights potentially available under each law rather than representing that every listed right is currently legally required of us at every point in time; regardless of applicability, we extend the baseline rights in Section 10 to all Users nationwide as a matter of Company policy. Exhibit A also separately identifies certain state laws that apply to operators of commercial websites without regard to business size, with which this Privacy Policy is intended to comply.
We may update this Privacy Policy from time to time by posting a revised version on the Site. The “Last Updated” date at the top of this Privacy Policy indicates when it was last revised. Your continued use of the Services after a revised Privacy Policy is posted constitutes your acceptance of the changes, to the extent permitted by applicable law. If a change materially affects your rights, we will provide additional notice as required by applicable law, which may include posting a notice on the Site, sending an email, or obtaining consent where required.
Questions about this Privacy Policy, requests to exercise your privacy rights, and appeals of a denied request may be directed to:
Opitz Housing Report, LLC
Attn: Privacy Officer
Address: P.O. Box 1071, Scottsdale, AZ 85252
Email: bradley@opitzhousingreport.com
Appeals Email: bradley@opitzhousingreport.com
Phone: 602-677-1299
This Exhibit A reflects the comprehensive state consumer privacy law landscape as of the Effective Date of this Privacy Policy. State privacy law is an actively developing area; additional states may enact, and existing states may amend, comprehensive privacy laws after that date. We will update this Exhibit A from time to time to reflect material developments, consistent with Section 15 of this Privacy Policy.
The following states have enacted comprehensive consumer privacy laws as of the Effective Date of this Privacy Policy. Some of these laws are not yet in effect as of that date (as indicated below), and some apply only to businesses that meet a statutory applicability threshold (for example, a minimum number of consumers' personal information processed annually or a minimum percentage of revenue derived from data sales) that Company may or may not meet at a given time. Regardless of applicability, Company extends the baseline rights described in Section 10 of this Privacy Policy to residents of all states.
| State | Law & Citation | Effective Date | Rights Potentially Available |
|---|---|---|---|
| California | California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA); Cal. Civ. Code § 1798.100 et seq.; regulations at Cal. Code Regs. tit. 11, § 7000 et seq. | 1/1/2020 (CPRA amendments 1/1/2023) | Access, Correct, Delete, Portability, Opt-Out (Sale/Share/Targeted Ads), Limit Use of Sensitive Information, Appeal. Recognizes Global Privacy Control. |
| Virginia | Virginia Consumer Data Protection Act (VCDPA); Va. Code Ann. § 59.1-575 et seq. | 1/1/2023 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. |
| Colorado | Colorado Privacy Act (CPA); Colo. Rev. Stat. § 6-1-1301 et seq. | 7/1/2023 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control. |
| Connecticut | Connecticut Data Privacy Act (CTDPA); Conn. Gen. Stat. § 42-515 to 42-525 | 7/1/2023 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control (since 1/1/2025). |
| Utah | Utah Consumer Privacy Act (UCPA); Utah Code Ann. § 13-61-101 et seq. | 12/31/2023 | Access, Delete, Portability, Opt-Out (Sale/Targeted Ads only). No right to correct; no appeal process. |
| Texas | Texas Data Privacy and Security Act (TDPSA); Tex. Bus. & Com. Code § 541.001 et seq. | 7/1/2024 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control (since 1/1/2025). |
| Oregon | Oregon Consumer Privacy Act (OCPA); Or. Rev. Stat. § 646A.570-646A.589 | 7/1/2024 (nonprofits 7/1/2025) | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal, plus a right to a list of specific third parties data was disclosed to. Recognizes Global Privacy Control (since 1/1/2026). |
| Montana | Montana Consumer Data Privacy Act (MCDPA), as amended; Mont. Code Ann. § 30-14-2801 et seq. | 10/1/2024 (amendments effective later in 2025) | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal; enhanced protections for minors' data. Recognizes Global Privacy Control. |
| Florida | Florida Digital Bill of Rights (FDBR); Fla. Stat. § 501.701 et seq. | 7/1/2024 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Certain Profiling). Applies only to very large businesses (generally $1 billion+ global revenue meeting additional criteria); not expected to apply to Company. |
| Delaware | Delaware Personal Data Privacy Act (DPDPA); Del. Code Ann. tit. 6, § 12D-101 et seq. | 1/1/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control (since 1/1/2026). |
| Iowa | Iowa Consumer Data Protection Act (ICDPA); Iowa Code § 715D.1 et seq. | 1/1/2025 | Access, Delete, Portability, Opt-Out (Sale only). No right to correct; no opt-out of targeted advertising or profiling; no appeal process. |
| Nebraska | Nebraska Data Privacy Act (NDPA); Neb. Rev. Stat. § 87-1101 et seq. | 1/1/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control. |
| New Hampshire | New Hampshire Privacy Act; N.H. Rev. Stat. Ann. § 507-H:1 et seq. | 1/1/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control. |
| New Jersey | New Jersey Data Privacy Act (NJDPA); N.J. Stat. Ann. § 56:8-166.4 et seq. | 1/15/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Recognizes Global Privacy Control. |
| Tennessee | Tennessee Information Protection Act (TIPA); Tenn. Code Ann. § 47-18-3201 et seq. | 7/1/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. |
| Minnesota | Minnesota Consumer Data Privacy Act (MCDPA); Minn. Stat. § 325M.10-325M.21 | 7/31/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal, plus a right to question and challenge profiling results. Recognizes Global Privacy Control. |
| Maryland | Maryland Online Data Privacy Act (MODPA); Md. Code Ann., Com. Law § 14-4701-14-4714 | 10/1/2025 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. Bans sale of sensitive data and of minors' data, and targeted advertising to known minors, and requires data minimization. Recognizes Global Privacy Control. |
| Indiana | Indiana Consumer Data Protection Act (INCDPA); Ind. Code § 24-15-1-1 et seq. | 1/1/2026 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. |
| Kentucky | Kentucky Consumer Data Protection Act (KCDPA); Ky. Rev. Stat. Ann. § 367.3611-367.3629 | 1/1/2026 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA); R.I. Gen. Laws § 6-48.1-1 et seq. | 1/1/2026 | Full regime (Access, Correct, Delete, Portability, Opt-Out, Appeal) for larger businesses; separately imposes a baseline privacy-notice duty on any commercial website that collects, stores, and sells Rhode Island residents' data, regardless of size. |
| Oklahoma | Oklahoma Consumer Data Privacy Act; 2025-26 Okla. Sess. Laws, S.B. 546 (Okla. Stat. tit. 15 section to be assigned upon codification) | 1/1/2027 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal (via AG online portal). |
| Alabama | Alabama Personal Data Protection Act (APDPA); 2026 Ala. Acts, H.B. 351 (Code of Ala. section to be assigned upon codification) | 5/1/2027 | Access, Correct, Delete, Opt-Out (Sale/Targeted Ads/Certain Profiling). No appeal process. |
| Louisiana | Louisiana Data Privacy Act (LDPA); La. Rev. Stat. § 51:1780.1-51:1780.5 (2025 Acts, No. 502, S.B. 386) | 1/1/2027 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal. |
| Vermont | Vermont Data Privacy and Online Surveillance Act (VDPOSA); 9 V.S.A. ch. 61A, subch. 1, § 2415 et seq. (2026 Acts, S.71; final section numbers to be confirmed upon codification) | 1/1/2028 | Access, Correct, Delete, Portability, Opt-Out (Sale/Targeted Ads/Profiling), Appeal, plus named third-party recipient disclosure and enhanced profiling-decision rights. Recognizes Global Privacy Control. |
The following laws are not gated by a revenue or consumer-volume threshold and are intended to apply to any operator of a commercial website that collects personal information from residents of the relevant state, regardless of the size of the business. This Privacy Policy is intended to satisfy the disclosure requirements of each of these laws.
California Online Privacy Protection Act (“CalOPPA”), Cal. Bus. & Prof. Code §§ 22575–22579, requires operators of commercial websites that collect personally identifiable information from California residents to conspicuously post a compliant privacy policy describing, among other things, the categories of information collected, the categories of third parties with whom it may be shared, and the process for reviewing and requesting changes to that information.
Delaware Online Privacy and Protection Act (“DelOPPA”), Del. Code Ann. tit. 6, §§ 1201C–1206C, imposes a substantially similar privacy-policy posting requirement on operators of websites that collect personal information from individual Delaware residents.
Nevada Revised Statutes Chapter 603A, Nev. Rev. Stat. §§ 603A.300–603A.360 (opt-out mechanism at § 603A.340), requires operators of websites or online services that collect covered information from Nevada consumers to post a notice and provide a designated means for those consumers to opt out of the sale of their covered information for monetary consideration. As stated in Section 4 of this Privacy Policy, we do not sell personal information for monetary consideration, and Nevada residents may still submit a request using the contact information in Section 11 to confirm this or to opt out of any future sale.