Privacy Policy

Pecos Brands LLC ("Xpressforms", "we") operates Xpressforms.ai. We are the data controller for information you submit through the Service. You can reach our privacy team at privacy@xpressforms.ai.

• Licensee data — name, email, phone, TREC license number, sponsoring broker, MLS ID, and TAR / local association membership ID.
• Transaction data — property addresses, deal type, key dates, sales price, and form completion status.
• Client and counter-party data — names, contact details, and any field you enter into a form (e.g., buyer, seller, landlord, tenant, co-agent).
• Document data — drafted, signed, and audit-trail copies of every form executed through the Service.
• Technical data — IP address, device, browser, and usage logs collected to operate and secure the Service.

We use this information to provide and improve the Service, verify your TREC license and association membership, prevent fraud, comply with our legal and regulatory obligations, and produce audit trails for executed documents. We do not sell your client data, and we do not use client data to train third-party AI models.

We share your license number and association membership ID with the relevant regulator (TREC) and association (TAR or local board) for the limited purpose of verifying your eligibility to use the form libraries. We may publish aggregate, de-identified usage statistics.

We rely on vetted sub-processors for hosting, database, e-signature delivery, email, and analytics. Each sub-processor is bound by a data-processing agreement and may only use your data on our instructions. A current list is available on request.

Executed documents and their audit trails are retained for at least four years from the closing date or last contact, consistent with TREC record-retention rules. You and your sponsoring broker may export records at any time from the dashboard.

Depending on your jurisdiction you may have rights to access, correct, delete, or port your personal data. Email privacy@xpressforms.ai and we will respond within 30 days. Note that requests to delete data tied to a closed transaction may be limited by our retention obligations.

We encrypt data in transit (TLS 1.2+) and at rest (AES-256), enforce least-privilege access, and maintain an incident-response program. No system is perfectly secure; report any suspected vulnerability to security@xpressforms.ai.

We will post material changes here and notify you by email or in-app banner at least 14 days before they take effect.