Invest. List. Market. Sell.
Your privacy is important to us. This Privacy Policy explains how Commercial Notes Online collects, uses, stores, and protects your information when you use our platform.
Commercial Notes Online (hereinafter referred to as the “Marketplace” or "Platform") operates a nationwide marketplace that connects buyer/investors seeking to purchase commercial real estate investment properties or commercial properties for their company or organization, with commercial property owners, investors, agents, brokers, real estate wholesalers, and other service parties. We also operate a buyer/investor matchmaking service that, at a buyer/investor's request and with the buyer/investor's consent, introduces that buyer/investor to seller/owners whose trust acqusition, owner-financed, mortgage assumption opportunity, or lease-to-own commercial listings match the buyer's stated preferences. Seller/Owners may pay us for those introductions through verified accounts, paid listing marketing packages or transaction fees.
We collect and use the information described below as a marketplace technology platform, not as a real-estate broker, agent, salesperson, lender, mortgage loan originator, escrow agent, title company, Consumer Reporting Agency, or data broker. We do not represent buyer/investors or seller/owners in any transaction. See our Terms and Disclaimer for the full description of our platform-only role.
This Privacy Policy explains what information we collect from buyer/investors, seller/owners, agents/brokers, wholesalers, service providers, affiliates, and visitors, how we use and share it, and the choices and rights you have. It applies to commercialnotes.online and any related subdomains, emails, SMS, notifications, and phone calls we operate.
We also automatically collect technical data such as IP address, browser type, device information, and usage patterns to improve platform performance and security.
* Name, email address, phone number, mailing address (when provided)
* Username, hashed password, multi-factor authentication phone (all accounts)
* Role (buyer/investor, seller/owner, agent/broker, wholesaler, affiliate, staff, service provider)
* We may also use your information to send important updates, property alerts, marketing communications (if you opt in), and notifications about changes to your account or listings.
* Self-reported monthly income, employment situation, max down payment, credit self-assessment, move-in timing, household size, pets, current housing situation
* Preferred locations (city / county / state) and price range
* Property interest signals (which listings you view, save, apply to)
* Property address, photos, descriptions, pricing, trust acquisiton terms, owner-financing terms, mortgage assumption terms, and lease-to-own terms.
* Listing-owner identity, agent license number and state (if applicable), wholesale assignment documents (if applicable)
* Billing details processed by our payment processor (we do not store full card numbers)
* SMS messages sent to or from numbers we operate (content, timestamps, delivery status)
* Phone calls placed through our dialer or routed to our numbers, including call recordings, transcripts, and AI-generated summaries when call recording is enabled
* Email correspondence and support tickets
* Voicemails left on our greeting system
* UTM parameters and referral source captured on every prequalification, signup, and seller submission (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
* Multi-touch attribution history per contact (first-touch and last-touch)
* Pages visited, features used, time on platform, search filters, click events
* IP address, approximate geolocation, device type, browser, operating system, language
* Cookies, web beacons, and pixels
* Match you with trust acquisitions, owner-financed, mortgage assumption, or lease-to-own properties that fit your preferences and budget
* Share your buyer/investor profile with seller/owners whose listings match you
* Send transactional notifications about applications, listings, calls, and scheduled meetings
* Send marketing emails and SMS about new properties (you can opt out at any time)
* Pre-fill returning-user forms to save you time
* You are responsible for maintaining the confidentiality of your login credentials and ensuring that your account information remains accurate and up to date.
* Publish your listing and route matched buyer/investors to you
* Deliver the paid marketing package you purchased (featured listings, direct property marketing, social media marketing, or full service marketing of your listing)
* Provide messaging, dialer, applicant management, and reporting tools
* Bill and process payments through our payment processor
* Publish your listing and route matched buyer/investors to you
* Deliver the paid marketing package you purchased (featured listings, direct property marketing, social media marketing, or full service marketing of your listing)
* Provide messaging, dialer, applicant management, and reporting tools
* Provide data on listing performance and buyer/investor and visitor interaction with the listings
* Bill and process payments through our payment processor
* Publish your listing and route matched buyer/investors to you
* Deliver the paid marketing package you purchased (featured listings, direct property marketing, social media marketing, or full service marketing of your listing)
* Provide messaging, dialer, applicant management, and reporting tools
* Provide data on listing performance and buyer/investor and visitor interaction with the listings
* Bill and process payments through our payment processor
* Track referrals attributed to your custom url and profile, calculate any payouts, and issue 1099s wherever required
* We will always operate in secure ways, do our best to consistently improve the Platform; and do everything we can to prevent fraud and abuse wherever possible
* We will always comply with any legal obligations, restrictions, regulations, and respond to all lawful requests, while enforcing our Terms of Use and Platform policies
* Work hard to train our staff and partners to improve service quality (including reviews of call recordings, chats, emails and transcripts)
* By creating an account, submitting a pre-qualification, or applying to a listed commercial property, you are asking us to help seller/owners of trust acquisitions, owner-financed properties, assumable mortgages, and lease-to-own properties, to find and contact you. We share your buyer/investor profile, including name, contact information, employment information, preferred locations, ideal budget, confirmed down payment range, rough move-in timing, and prequalification summary, with commercial property seller/owners, their agents, brokers, wholesalers, and other vetted seller/owners whose listings match your criteria, both now and as new inventory becomes available. We also offer seller/owners the ability to become verified on a subscription basis. Seller/Owners may compensate us for these introductions through paid listing marketing packages or transaction fees.
* Under California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Florida (FDBR), Texas (TDPSA), and similar U.S. state privacy laws, sharing your buyer profile with matched seller/owners in exchange for a fee may be considered a "sale" and/or "sharing" of personal information for monetary or other valuable consideration. We disclose this upfront so you can make an informed choice and exercise the opt-out rights described in this document.
* You can opt out of seller matching and buyer introductions at any time at /do-not-sell, in your account settings, or by emailing privacy@commercialnotes.online. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale and sharing for every visitor whose browser sends it, regardless of state of residence.
We share data with service providers and vendors who help us operate the Platform under written contracts that restrict their use of the data. These include, without limitation:
* Hosting and database: Porkbun / Host Koala
* Telephone, SMS, and call recording: Telenyx
* AI text generation, translation, and image enhancement: Microsoft Copilot, OpenAI, Google Gemini, Replicate, ChatGPT
* Payment processing: Stripe, Woopayments, Woocommerce, PayPal, Affirm, Klarna, CashApp, Venmo, Mercury
* Mapping and geocoding: Google Maps, OpenStreetMaps
* Analytics and advertising pixels: Meta/Facebook, Instagram, TikTok, LinkedIn, Twitter/X, Google Analytics, WordPress, SEO
When required by law, subpoena, court order, governmental request, or to protect the rights, property, or safety of users, the public, or us.
In connection with any merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred to the successor individual or entity, subject to the same protections.
* We do not share your data with advertisers or third-party data brokers outside the owner-financing real-estate ecosystem
* We do not sell or share sensitive identifiers such as full Social Security numbers, government IDs, bank statements, or tax returns; if you ever provide such documents during a specific transaction, we share them only with your explicit per-transaction consent
* We do not use your information to train third-party AI foundation models without your consent
Each of those laws defines a data broker as a business that knowingly collects and sells personal information of consumers with whom the business does not have a direct relationship. We do not meet that definition because:
* We collect personal information directly from you when you create an account, submit a pre-qualification, apply to a listing, or contact us
* We share that information only with seller/owners you have consented to be matched with, for the purpose you asked us to perform (helping you find owner-financed housing)
* We do not buy, scrape, license, or otherwise obtain personal information about consumers from third parties for resale
* We do not operate an anonymous lookup or background-check service
* Because we are not a data broker, we are not required to register with the California Privacy Protection Agency, the Texas Secretary of State, the Oregon Department of Consumer and Business Services, the Vermont Secretary of State, or comparable state agencies, and California consumers cannot use the California DROP (Delete Request and Opt-out Platform) to request deletion from us. You may, however, exercise all of your state-law privacy rights, including deletion, directly with us using any of our support or privacy channels. We will treat any DROP request that is forwarded to us by a consumer or their authorized agent the same as a deletion request submitted directly.
* We monitor our business model continuously. If our practices ever change in a way that brings us inside any state's data-broker definition, we will register, post the required disclosures, and update this policy before that change takes effect.
When you create an account, submit a pre-qualification, apply to a property, submit a Sell Your Property form, or otherwise provide your phone number to us, you give express written consent for Commercial Notes Online and the Seller/Owners we match you with to contact you by:
* Live phone calls
* Pre-recorded or artificial-voice phone calls
* Calls placed using an automatic telephone dialing system (autodialer) or AI dialer
* SMS and MMS text messages, including marketing, transactional, and autoresponder messages
* Email and Chat
Consent is not a condition of purchasing any goods or services. You give this consent so we can help you find a commercial or investment property, deliver applications to seller/owners, and follow up on yours or the seller/owners interests.
* Message frequency varies based on your activity and interaction with the platform, listings and other users
* Message and data rates may apply (your carrier's standard charges)
* Reply STOP to any SMS to opt out of further marketing messages from that number; reply HELP for help
* Email: use the unsubscribe link in any marketing email, or email messages@commercialnotes.online
* You may revoke voice-call consent at any time by telling the caller, by emailing us, or through your account settings
Opting out of marketing does not stop transactional service messages (e.g., account security, scheduled-call reminders, billing)
After you submit a pre-qualification, we may automatically send you a single welcome SMS during normal hours (typically 8am–7pm Eastern Time, Monday through Friday, queued and addressed the following business day if outside that window). You can opt out by replying STOP.
* Recordings and transcripts are stored encrypted and access is limited to authorized staff and contracted vendors
* AI summaries are generated by third-party services (e.g., Microsoft Copilot, ChatGPT, OpenAI, and any other AI services) under contractual data-protection terms
* You may request deletion of recordings of your own calls by emailing calls@commercialnotes.online (subject to legal retention requirements)
* If you do not consent to recording, please tell the caller and we will end the call or switch to an unrecorded channel where feasible
* Strictly necessary (authentication, security, fraud prevention)
* Analytics (Meta/Facebook, Instagram, TikTok, LinkedIn, Twitter/X, Google Analytics, WordPress, SEO, AwStats) — how visitors use the site
* Advertising / measurement pixels — Meta Pixel (Facebook/Instagram), TikTok Pixel, LinkedIn Insight Tag — to measure ad effectiveness and build audiences
* Affiliate attribution — first-party cookie that records the last qualifying referral click for a default window of 30 days so that affiliate payouts can be properly attributed
* Preference — remembers your language, filters, and settings
You can manage cookies through your browser settings. Disabling cookies may break Platform functionality. We honor the Global Privacy Control (GPC) browser signal as an opt-out of "sale" and "sharing" for users in states that recognize it, and we apply that opt-out site-wide for the browser that sent the signal.
* Right to know / access the personal information we have about you
* Right to correct inaccurate personal information
* Right to delete your personal information
* Right to data portability, to receive your data in a usable format
* Preference — remembers your language, filters, and settings
* Right to opt out of sale, sharing, or targeted advertising (including seller introductions)
* Right to opt out of profiling that produces legal or similarly significant effects
* Right to limit use of sensitive personal information
* Right to non-discrimination for exercising your rights
* Right to appeal a denial of your request (where applicable)
We honor the privacy rights granted by comprehensive state consumer-privacy laws in California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa (ICDPA), Indiana (ICDPA), Tennessee (TIPA), Montana (MCDPA), Oregon (OCPA), Texas (TDPSA), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA), Kentucky (KCDPA), Rhode Island (RIDTPPA), Maryland (MODPA), Minnesota (MCDPA), Nebraska (NDPA), and Florida (FDBR). Where state law conflicts, the law of your state of residence controls.
* Visit /do-not-sell for the simplest opt-out (also honors the Global Privacy Control browser signal)
* Manage your matching, marketing, and sharing preferences in your account settings
* Email privacy@commercialnotes.online for access, correction, deletion, portability, or appeals
* Authorized agents/brokers may submit requests on your behalf with signed permission and verification
We will verify your identity before fulfilling requests and respond within the timeframe required by your state's law (typically 45 days, extendable once by an additional 45 days where permitted). If we deny your request, you may appeal by replying to our denial, and we will respond within 45 days of receiving the appeal.
Categories of personal information we have collected in the past 12 months: identifiers (name, email, phone, IP); commercial information (budget, down payment, move-in timing); geolocation (city/state/county); internet activity (browsing on our site); audio (call recordings); inferences (estimated affordability, match fit); employment information (self-reported).
Categories disclosed for monetary or other valuable consideration (treated as a "sale" or "sharing" under CCPA/CPRA): identifiers; commercial information; geolocation; inferences.
Categories of recipients: property owners and their authorized representatives selling owner-financed real estate in the United States, including self-serve seller/owners who have purchased buyer-introduction access; service providers under contract.
Retention: see Section . No financial incentive program. No sale of sensitive personal information. Right to limit use of SPI: see Section .
California's Delete Request and Opt-out Platform (DROP) went live for registered data brokers on August 1, 2026. As explained in Section 4a, we are not a data broker and therefore do not register with DROP. If you are a California resident and submit a DROP request that is forwarded to us, we will honor it as a standard deletion request under CCPA/CPRA using the channels above.
* We do not run credit checks, pull credit reports, or evaluate creditworthiness
* We do not make credit decisions, lending decisions, or employment decisions
* Seller/Owners who use our information for any FCRA-permissible purpose (credit, employment, insurance, tenancy) must obtain their own consumer reports from a licensed Consumer Reporting Agency
* We are not a financial institution under the Gramm-Leach-Bliley Act (GLBA), and information you share is not protected as "nonpublic personal information" under GLBA
* Encryption of data in transit (TLS) and at rest where supported
* Role-based access control with least-privilege principles
* Multi-factor authentication for staff and administrative accounts, and available to deploy on user accounts as well
* Audit logging of sensitive operations
* Vendor and service provider due diligence and contractual data-protection terms
No security program is perfect. If we determine that a security incident has compromised your personal information, we will notify you and the appropriate authorities as required by applicable state and federal breach-notification laws.
* Active account data — for the life of your account and as long as needed to provide the services
* Pre-qualification records, buyer profile, and related communications — typically retained for the life of the buyer-platform relationship and up to 7 years after last activity to support analytics, audit, fraud prevention, dispute resolution, and legal-hold needs
* Call recordings, transcripts, and AI summaries — typically retained for as long as needed for QA, training, dispute resolution, and compliance, subject to applicable state laws
* SMS conversation history — retained for the life of the conversation and for a commercially reasonable period thereafter to support service quality, dispute resolution, and carrier-rule compliance
* Email delivery logs and engagement data — retained for a commercially reasonable period to support deliverability, suppression, and compliance
* Affiliate attribution cookies — typically 30 days from last qualifying click
* Server access logs and security event logs — typically 12 months unless a longer period is required
* Marketing pixel and ad-measurement data — per each provider's default retention
* Closed or sold deal records, invoices, payment records, and tax records — retained for the period required by applicable tax, accounting, and audit law (generally 7 years)
* Marketing-suppression lists (opt-outs, STOP requests, do-not-call/do-not-text) — retained indefinitely so we can continue to honor your choices
* Legal-hold data — retained for the duration of the hold, regardless of any other period
When personal information is no longer needed for the purposes above, we delete, anonymize, or de-identify it. If full deletion is not commercially feasible (for example, data residing in backups), we will isolate it from further processing until it is overwritten in the ordinary course.
The Platform is intended only for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and we do not knowingly "sell" or "share" personal information of minors under 16 (or under 18 where state law requires affirmative opt-in for that age). If you believe we have collected information from a child, please contact privacy@commercialnotes.online and we will delete it.
* Self-reported financial information — monthly income, employment status, and maximum down payment provided during pre-qualification
* Precise geolocation that may be derived when we geocode property addresses or capture IP-based location
* Account credentials — username and hashed password (used solely to authenticate you)
* Government identifiers — only if you voluntarily provide them in connection with a specific transaction or dispute (e.g., a driver's license for identity verification at closing)
We do not use SPI to infer characteristics about you, to build profiles for advertising, or for any purpose other than (i) providing the services you requested, (ii) preventing fraud, (iii) ensuring security and integrity, and (iv) complying with law. Where applicable state law grants a Right to Limit Use of Sensitive Personal Information, you may exercise it at /do-not-sell or by emailing privacy@commercialnotes.online.
* First name, last name, and contact information (email, phone) so the seller can reach you
* City, county, and state preferences and price range
* Monthly income range and maximum down payment (as you reported them)
* Move-in readiness / desired move-in timing
* Pre-qualification notes and summary
* Property-specific application data, if you applied to a specific listing
We do not share your full Social Security number, government ID, bank statements, tax returns, or credit-report data with seller/owners, except with your explicit per-transaction consent (e.g., at closing). You can revoke seller-match consent at any time at /do-not-sell, in your account settings, or by emailing privacy@commercialnotes.online; revocation stops future matching and introductions but does not recall data already lawfully shared.
* Call transcription and summarization (Telenyx) for recorded calls (see Section )
* Listing description generation and Spanish translation (OpenAI, ChatGPT, Micorosoft Copilot, Google Gemini, etc.), reviewed by Seller/Owners before publishing
* Listing photo enhancement
* Match scoring that ranks how closely a Buyer/Investor profile fits a property's criteria so that Seller/Owners and Buyer/Investors see the most relevant matches first
No decision that produces a legal or similarly significant effect on you is made solely by automated processing. A match score does not approve, deny, or qualify you for any property; only the seller (or the seller's lender) makes any approval, credit, or pricing decision, and only after a human reviews the file. You may opt out of profiling for targeted advertising and from being included in match scoring at any time at /do-not-sell or by emailing privacy@commercialnotes.online.
The Platform may contain links to third-party websites and services we do not control. Their privacy practices are governed by their own policies. We are not responsible for their handling of your information.
We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy with a new "Last Updated" date and, where appropriate, by email or in-app notice. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.
Spanish-language versions of this Privacy Policy and our other legal pages are provided for convenience only. In the event of any conflict or ambiguity between the English version and any translation, the English version controls.
Questions, requests, or complaints regarding this policy or our data practices: privacy@commercialnotes.online. For legal notices: legal@commercialnotes.online.