Privacy Policy

Omaha Real Estate Investors Association • REIChapter app

Effective date: October 9, 2026

1. Who we are and what this policy covers

This Privacy Policy explains how Kaasch Money Investing LLC, operating the Omaha Real Estate Investors Association ("Omaha REIA," "REIA," "we," "us," or "our"), collects, uses, and shares information through the REIChapter mobile app, the omahareia.com website, and the chapter services we operate. These services include member accounts, directories, event registration and tickets, memberships, applications, referrals, sponsor content, the Member Exchange, and support. Features and information collected depend on how you use the services.

Privacy contact: admin@omahareia.com. Mailing address: 2420 N 147th St, Omaha, NE 68116. If a chapter or event organizer operates separately from us, its own privacy notice also applies to information it receives and uses independently.

2. Information you provide

Account and contact information. We collect your name, email address, and account information. Depending on the feature, you may also provide a phone number, physical address, company, website, social links, city and state, business category, public biography, and directory visibility preferences.

Registrations and transactions. We collect membership and event registration details, applications and answers, referral information, ticket and registration identifiers, purchase amounts, currency, coupons, subscription details, payment processor references, and transaction status.

Content and support. We collect information you submit in profiles, speaker or sponsor materials, Member Exchange listings, contact forms, messages, proof documents, notes, deletion requests, and support correspondence. Photos and videos are collected when you choose to upload them. Do not submit sensitive information or another person's private information unless necessary and you have authority to do so.

Payments. Stripe processes payments through hosted Checkout or Stripe Elements. Card numbers, security codes, and payment or billing information you enter into Stripe are handled by Stripe. We do not store full card numbers or card security codes. We retain transaction references, amounts, status, and relevant business metadata.

3. Information collected automatically

Identifiers and notifications. We collect application user IDs, authentication identifiers, membership numbers, registration IDs, and signed ticket identifiers. If you register for push notifications, we collect an Expo push token, which may be linked to your signed-in account.

Usage and diagnostics. We collect page URLs and titles, referrers, language and screen information, sponsor interactions, aggregate legacy-link visits, and service status or error records. These may include runtime, server, webhook, network, email, SMS, or push delivery information. Our current Umami analytics implementation does not use its identity-link function and is used for aggregate analytics, rather than attaching those analytics to your member profile.

Network information and approximate location. Hosting, authentication, payment, messaging, analytics, and embedded-content providers may receive IP addresses and other request metadata. Depending on the provider, this can indicate approximate location or be associated with an account, device, or request. We do not intentionally collect precise GPS location through the app.

Security records. We use keyed hashes of IP or email values to help prevent abuse. In these abuse-control records, we store hashes instead of raw IP addresses or email addresses. We also use short-lived hashes to protect against reuse of deleted identities. Hashing does not mean that all information across our systems or providers is anonymous.

Our current application does not intentionally collect health or fitness data, sensitive personal categories, address-book contacts, advertising identifiers, device mailbox or SMS contents, microphone or audio uploads, or browsing and search histories for profiling. Information you voluntarily include in free-text fields or uploaded documents may contain additional details.

4. How we use information

We use information to authenticate users and link accounts; manage profiles, directory visibility, memberships and applications; process registrations, payments, tickets, receipts and subscriptions; administer referrals and listings; deliver event and attendee communications; respond to support and deletion requests; maintain preferences and consent records; prevent fraud and abuse; troubleshoot service issues; and understand aggregate usage and improve the services.

We send optional newsletters and marketing communications according to your preferences and applicable consent requirements. SMS messaging is optional and based on your consent. We may display sponsor content and measure interactions within our services.

5. Tracking and advertising

We do not use information collected through the application to track you across other companies' apps or websites for targeted advertising or advertising measurement, and we do not share it with data brokers. We do not sell personal information or share it for cross-company behavioral advertising. Aggregate usage measurement and sponsor interactions within our services do not change this commitment.

6. Directory and shared content

Directory information is displayed according to your visibility settings and the audience available in the relevant feature. Content you submit for publication, including biographies, listings, and event, speaker or sponsor materials, may be visible to other members or the public. Information you send through a message, application, referral, or registration is available to the intended recipient and authorized administrators who manage it.

Information made public may be copied, saved, or indexed by others. Changing visibility or deleting content cannot remove copies already obtained by other people. Contact us if you need help understanding who can see a particular item.

7. How we share information

Authorized chapter administrators and event organizers receive information needed to manage memberships, applications, registrations, tickets, attendee communications, referrals, listings, and support. A sponsor does not receive your private contact details merely because its content appears in the services; a submission or referral to a sponsor or other business may share the information you choose to send.

We use the following service providers to operate the services. The information each receives depends on the feature you use:

• Supabase Auth receives email addresses, authentication and one-time-code requests, and session or network metadata. We retain account linkage identifiers and email information in our application.
• Stripe receives payment and billing information entered into its interfaces, email addresses, amounts, currencies, and payment metadata to process payments and subscriptions.
• Our Postmark-compatible SMTP email delivery service receives recipient and reply-to addresses, names, message subjects and bodies, ticket or QR information, calendar invitations, and relevant application, contact or registration details.
• Twilio receives phone numbers, SMS message bodies, our sending number, and delivery or carrier metadata for consented messaging.
• Expo Push Service receives push tokens, notification payloads, and deep links to deliver app notifications.
• Manus hosting and its MySQL, S3 and Forge infrastructure process application database information, uploaded files, storage references, and HTTP or network metadata to operate the application.
• Our Umami analytics service receives website and hostname identifiers, page URLs, referrers, titles, language and screen dimensions, and aggregate event information.
• Google Fonts, Maps and Places may receive browser or network metadata and map or place requests when those features load. Buzzsprout may receive podcast show or player identifiers and browser or player interaction metadata when you use an embedded podcast player.

Providers receive information needed for their services. We require providers processing information on our behalf to protect it consistently with this policy and use it for authorized purposes. Providers may also process certain information under their own privacy notices, including payment, fraud prevention, and legal compliance information.

We may disclose information when required by law or legal process, to protect users or our services, investigate fraud or abuse, enforce our terms, or protect legal rights. If our business or services are involved in a merger, acquisition, financing, or asset transfer, information may be transferred subject to appropriate safeguards. We may also share information at your direction or with your consent.

8. Cookies and embedded services

Our websites and web-based app features may use cookies, local storage, or similar technologies for sign-in, sessions, preferences, and functionality. Analytics and embedded services may receive network or usage information when loaded. Browser controls may let you limit storage, but doing so can affect sign-in or other features. A third-party website you visit through a link is governed by its own privacy notice.

9. Your choices and privacy requests

You can update available profile fields and directory visibility preferences through your account. You can unsubscribe from optional marketing emails using the unsubscribe instructions or contact us. We may continue sending service messages, such as authentication emails, receipts, tickets, account notices, and responses to your requests.

You can withdraw SMS consent by replying STOP to the sending number or contacting us. Message and data rates may apply. You can disable push notifications through your device settings. Disabling notifications does not delete your account or transaction records.

You can delete your account directly in the REIChapter app or on the website: go to your Profile, scroll to the Account Deletion section, and select "Delete my account." This permanently removes your account and personal data from the website and app, subject to the lawful retention exceptions described in section 10.

To request access, correction, a copy of your information, or deletion of your account or personal information, you may also contact admin@omahareia.com. We may ask for information needed to verify your identity or authority. Where applicable law grants additional privacy rights, including appeal rights or rights to opt out of certain processing, you may exercise those rights through the same contact. We handle requests within applicable legal timeframes and will explain any privacy limitations or denial. We do not discriminate against you for exercising applicable privacy rights.

10. Retention and deletion

We retain account and profile information while needed to provide your account and services. We retain registration, transaction, support, consent, security, and operational records for the periods needed to fulfill their purposes, meet legal and accounting obligations, resolve disputes, and protect the services. Retention depends on the type of record, applicable obligations, and security needs.

When an account or deletion request is completed, we delete or de-identify information that is no longer needed, subject to lawful exceptions. Limited transaction, consent, legal, fraud-prevention, and security records may remain where necessary. Short-lived deleted-identity protection hashes may also remain for abuse prevention. Backup copies may persist until their normal rotation and are not used to restore a deleted account for ordinary service use.

Deleting your account does not itself guarantee cancellation of a paid subscription or a refund; contact us about any active subscription. Service providers may retain information they must keep for their own legal, payment, or security obligations. We cannot delete copies that other users or independent organizers have already obtained, but you may contact those recipients about their records.

11. Security and processing locations

We use safeguards intended to protect personal information, including authentication and abuse-prevention controls. No storage or transmission system is completely secure. Information may be processed where we and our service providers operate, including outside your state or country, where privacy laws may differ.

12. Children and policy changes

Our services are intended for real estate and business communities and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate.

We may update this policy as the services or our practices change. We will post the revised policy with an updated effective date and provide additional notice or request consent when required. Contact admin@omahareia.com with privacy questions.