Privacy Policy

1. Introduction

Welcome to Whatcom LLC ("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit https://www.welcometowhat.com and all related services (collectively, the "Site").

This policy should be read alongside our Terms of Service and DMCA Notice & Takedown Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Site.

2. Information We Collect

Information You Provide

We collect personal information that you voluntarily provide when you:

• Create an Account: When you sign in using Google or email magic link, we collect your email address, name, and profile photo (if provided by the sign-in provider). You may also upload a custom profile photo, which is stored on a cloud storage provider.
• Submit Contact or Lead Forms: When you request a showing, ask for a home valuation, or contact us through the Site, we collect your name, email address, phone number, and any message you include.
• Use Account Features: If you are a signed-in user, we store your saved searches, favorited listings, personal notes on saved properties, and recently viewed properties.
• Communicate With Us: When you contact us via email or through any form on the Site, we collect the information you provide in those communications.

Information Automatically Collected

When you access the Site, we may automatically collect certain information, including:

• Analytics Data: Page views, search queries, button clicks, and UTM parameters. Our analytics provider operates in a cookieless, privacy-first mode using in-memory persistence only. No persistent identifiers are stored on your device by our analytics provider. Our analytics provider respects the Do Not Track (DNT) browser header; if DNT is enabled, no analytics data is collected.
• Advertising Data (Consent-Gated): If you accept advertising cookies via our CookieYes consent banner, Google Ads and Meta Pixel collect conversion data and browsing behavior for ad targeting and measurement.
• Device and Browser Information: Browser type, operating system, device type, and screen resolution.
• Rate Limiting Data: Hashed IP addresses are temporarily stored by our rate limiting service to prevent abuse. Raw IP addresses are not retained.
• Server Logs: Standard web server logs including IP addresses, request timestamps, and URLs accessed by our hosting provider.

Browser Storage

We use browser storage technologies (such as localStorage and sessionStorage) to store certain browsing preferences, viewing history, and user interface settings locally on your device. This data does not leave your browser and is not transmitted to our servers.

Information from Third Parties

• MLS Grid / NWMLS: Real estate listing data including property details, photos, and agent information. This is publicly available listing data, not personal data about you.
• OAuth Providers (Google): When you sign in via Google, the provider shares your email, name, and profile photo per their own privacy policy.

3. Categories of Personal Information

Under the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), we collect the following categories of personal information:

4. Cookie Consent Management

We use CookieYes to manage your cookie preferences. Cookies on this Site fall into the following categories:

• Essential Cookies: Required for the Site to function properly, including session management, authentication, and security. These cannot be disabled.
• Analytics: Our analytics provider operates in a cookieless mode. No cookies are placed on your device for analytics purposes, and no consent is required.
• Advertising Cookies: Google Ads and Meta Pixel cookies load only after you grant consent via the CookieYes banner. If you do not accept advertising cookies, these services will not collect any data about you.

You can change your cookie preferences at any time by clicking "Cookie Preferences" in the site footer or by adjusting your browser settings.

5. How We Use Your Information

We may use the information we collect for the following purposes:

• To provide real estate search, IDX listing display, and property information services.
• To respond to your inquiries, showing requests, and home valuation requests.
• To maintain your account, saved searches, and favorited listings.
• To send communications related to your real estate interests via our CRM provider.
• To analyze website usage and improve the user experience via our cookieless analytics provider.
• To measure advertising effectiveness (Google Ads, Meta Pixel, consent required).
• To prevent fraud, abuse, and unauthorized access via automated rate limiting.
• To comply with legal obligations and enforce our Terms of Service.
• To fulfill our obligations under our NWMLS/MLS Grid IDX license agreement.

6. MLS/IDX Data and Privacy

Listing data displayed on this Site originates from the Northwest Multiple Listing Service (NWMLS) via MLS Grid. We display listing data under our IDX license for the personal, non-commercial use of visitors.

We do not sell, rent, or share your personal search activity or browsing history with NWMLS, MLS Grid, or listing agents. Your property search behavior is yours.

When you submit a contact or showing request through the Site, your information is shared with the Welcome to Whatcom LLC team via our CRM provider to facilitate your request. Your information is not shared directly with listing agents.

7. Disclosure of Your Information

We Do Not Sell Your Personal Information

Welcome to Whatcom LLC does not sell your personal information as defined by the CCPA/CPRA.

Sharing for Cross-Context Behavioral Advertising

When you accept advertising cookies, Google Ads and Meta Pixel may collect browsing data for ad targeting purposes. Under the CPRA, this may constitute "sharing" of personal information for cross-context behavioral advertising. This sharing occurs only with your affirmative consent via our CookieYes banner. You may opt out at any time by adjusting your cookie preferences or by sending a Global Privacy Control (GPC) signal (see Section 12).

Service Providers

We share information with trusted third-party service providers who assist us in operating the Site:

• Analytics: Cookieless analytics provider
• CRM: Customer relationship management provider for lead management and communications
• Authentication: Google (OAuth sign-in) and email magic link provider
• Email Delivery: Transactional email provider for magic link delivery and notifications
• Maps and Imagery: Mapping and street-level imagery providers
• Listing Data: MLS Grid / NWMLS
• Infrastructure: Cloud hosting, database, and rate limiting providers
• Content Management: Headless CMS for blog and editorial content
• Error Monitoring: Error monitoring and crash reporting provider
• Consent: CookieYes (cookie preference management)
• Advertising (consent-gated): Google Ads and Meta Pixel

Other Disclosures

• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.
• Protection of Rights: We may disclose information to protect the rights, property, or safety of Welcome to Whatcom LLC, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We would notify you before your data becomes subject to a different privacy policy.

8. Do Not Track and Global Privacy Control

Do Not Track (DNT)

Our analytics provider respects the Do Not Track (DNT) browser header. When DNT is enabled, no analytics data is collected from your session.

Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals. When your browser sends a GPC signal, we treat it as a valid opt-out request for the sale or sharing of your personal information, as required by the CCPA/CPRA and the laws of Colorado, Connecticut, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, Oregon, and Texas.

When a GPC signal is detected: advertising cookies (Google Ads and Meta Pixel) will not load, no personal information will be shared for cross-context behavioral advertising, and your opt-out preference will be honored for the duration of your session.

Advertising Cookies

Google Ads and Meta Pixel do not inherently honor DNT signals, but they are consent-gated via CookieYes on this Site and only load if you affirmatively accept advertising cookies.

We encourage users who prefer not to be tracked to enable GPC or DNT in their browser settings and decline advertising cookies when prompted.

9. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy, unless a longer retention period is required by law.

• Account Data: Retained as long as your account is active. You may request deletion at any time.
• Lead and Contact Form Data: Retained in our CRM for the duration of our client relationship. You may request deletion at any time.
• Analytics Data: In-memory only during your session. No persistent identifiers are stored on your device. Aggregate analytics data is retained on our analytics provider's servers per their data retention policy.
• Advertising Data: Governed by Google's and Meta's respective retention policies. Only collected with your consent.
• Rate Limiting Data: Hashed IP records expire automatically within 60 seconds.
• Server Logs: Retained per our hosting provider's standard log retention policy (typically 30 days).
• MLS Listing Data: Updated approximately every 15 minutes. Stale or withdrawn records are removed per MLS Grid compliance requirements.

10. Your Choices and Rights

• Email Opt-Out: You may opt out of receiving promotional emails at any time by following the unsubscribe instructions included in each email or by contacting us at privacy@welcometowhat.com. We will process your opt-out request within 10 business days as required by the CAN-SPAM Act.
• Cookie Preferences: Adjust your cookie preferences at any time via the CookieYes banner or the "Cookie Preferences" link in the site footer.
• Account Deletion: Delete your account and all associated data (favorites, saved searches, recently viewed properties) by contacting us at privacy@welcometowhat.com.
• Data Deletion: You may request the deletion of your personal information by contacting us at privacy@welcometowhat.com. We will respond within 45 days as required by law.
• Do Not Track / GPC: Enable DNT or GPC in your browser to opt out of tracking and data sharing.

11. Data Security

We use reasonable administrative, technical, and physical security measures to protect your personal information. These include encrypted connections (HTTPS) for all data in transit, token-based session management, hashed identifiers for rate limiting, and OAuth-based authentication through Google (we never store or have access to your password).

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

12. State Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: Request that we disclose what personal information we collect, use, disclose, and share about you (see Section 3 for categories).
• Right to Delete: Request the deletion of your personal information, subject to certain legal exceptions.
• Right to Correct: Request the correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information. Advertising cookies (which may constitute "sharing" under CPRA) are consent-gated and can be declined via our cookie banner or by sending a GPC signal.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information to purposes necessary to provide the services you request.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

How to Exercise Your Rights

You may submit a verifiable consumer request by contacting us at privacy@welcometowhat.com. We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf by providing written authorization.

We will respond to verifiable requests within 45 days. If we need additional time, we will notify you of the extension (up to an additional 45 days) and the reason for the delay.

California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents may request information regarding the disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

Other State Privacy Laws

Residents of Colorado, Connecticut, Virginia, Montana, Oregon, Texas, and other states with consumer privacy laws may have similar rights to access, correct, delete, and opt out of data sharing. We honor Global Privacy Control (GPC) signals as a universal opt-out mechanism as required by these laws. To exercise your rights, contact us at privacy@welcometowhat.com.

Washington Residents

Washington state has not yet enacted a comprehensive consumer data privacy law, but your data is protected under the Washington Consumer Protection Act (RCW 19.86). If Washington enacts additional privacy legislation, we will update this policy accordingly. If our data practices ever involve consumer health data, we will comply with the Washington My Health My Data Act (RCW 19.373).

All Other Residents

Regardless of where you live, Welcome to Whatcom LLC believes everyone deserves strong privacy protections. Even if your state or country does not legally require it, we extend the same privacy rights described above to all visitors and users of our Site as a matter of principle. This includes the right to:

• Know what personal information we collect about you.
• Request deletion of your personal information.
• Request correction of inaccurate personal information.
• Opt out of data sharing for advertising purposes.
• Exercise these rights without discrimination or penalty.

To exercise any of these rights, contact us at privacy@welcometowhat.com. We will respond to your request within 45 days.

13. Email Communications

In compliance with the CAN-SPAM Act, all commercial emails sent by Welcome to Whatcom LLC will:

• Clearly identify Welcome to Whatcom LLC as the sender.
• Include our physical mailing address.
• Include a clear and conspicuous unsubscribe mechanism.
• Honor unsubscribe requests within 10 business days.

You may opt out of promotional emails at any time. Please note that even if you opt out of promotional emails, we may still send you transactional or relationship-based communications (such as responses to your inquiries or account-related notifications).

14. International Data Transfers

Welcome to Whatcom LLC is based in Bellingham, Washington, USA. Your data is processed primarily in the United States. Some of our third-party service providers may process data in various jurisdictions.

If you are accessing the Site from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Site, you consent to the transfer of your information to the United States.

We use appropriate safeguards, including encrypted connections (HTTPS) and contracts with service providers that include data protection obligations, to protect your information during transfer.

15. Children's Privacy

Our Site is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information as soon as possible. If you believe we have inadvertently collected information from a child under 13, please contact us at privacy@welcometowhat.com.

As stated in Section 7, we do not sell or share any user's personal information. This applies equally to users of all ages.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

17. Contact Us

If you have questions or concerns about this Privacy Policy or wish to exercise your privacy rights, please contact us:

• Privacy inquiries: privacy@welcometowhat.com
• Legal / DMCA: legal@welcometowhat.com
• General inquiries: austin@welcometowhat.com
• Phone: (360) 812-2080
• Mailing address: 3410 Woburn St, Bellingham, WA 98226