This Privacy Policy describes how 10X Solutions ("we," "us," or "our"), the maker of Chameleon Homes, collects, uses, stores, and shares information when you use the Chameleon Homes platform ("Service"). By accessing or using the Service you agree to this Policy.
1. Who We Are and What Chameleon Homes Does
Chameleon Homes is a mobile mortgage calculator SaaS platform built for licensed Mortgage Loan Officers ("Pros" or "MLOs"). Pros use Chameleon Homes to run real-time purchase scenarios, share interactive calculator sessions with home buyers ("Buyers") via SMS, capture leads, and manage their lending teams. Chameleon Homes is not a lender and does not issue mortgage commitments or financial advice.
Our registered place of business is in California. For privacy inquiries, contact us at support@chameleon.homes.
2. Information We Collect
2.1 Information Collected from Pros (MLO Subscribers)
| Data Element | Purpose |
|---|---|
| Email address | Account creation, authentication, billing, and communications |
| Display name | Shown to Buyers in their shared calculator session |
| NMLS number | Verification of licensed MLO status; displayed to Buyers |
| Phone number | Account management and two-factor authentication |
| Headshot / profile photo | Pro-branded profile shown in the Buyer-facing app |
| Subscription and billing data | Processed by our payment processor; we do not store card numbers |
2.2 Information Collected from Buyers
Buyers are home purchasers whose information is entered into the Service by their MLO. Buyers do not create accounts. The following Buyer data is collected:
- First name and last name — entered by the Pro to personalize the shared session
- Phone number — provided by the Buyer verbally or in person to their MLO, then entered by the Pro for the purpose of sending the Buyer a one-time SMS invite
Buyers do not provide their own data directly to Chameleon Homes; the Pro is responsible for obtaining any necessary consents before entering Buyer information into the platform.
2.3 Calculator Session Data
When a Pro or Buyer uses the calculator, we collect the inputs and outputs of each scenario (purchase price, loan type, interest rate, down payment, estimated payment, etc.). This data is associated with the Pro's account and is used to power the lead dashboard and activity-tracking features.
2.4 Device and Usage Data
We automatically collect the following when you access the Service:
- Device identifiers (device ID, operating system, app version)
- Activity events (screen views, button taps, tab changes, session timestamps, invite timestamp, first Buyer sign-in timestamp)
- IP address and general geographic region (country/state level)
- Crash reports and performance diagnostics
3. How We Use Information
We use the information we collect to:
- Provide, operate, and improve the Service
- Authenticate users and maintain account security
- Send Buyers a one-time SMS invite to access their shared calculator session
- Populate Pro-branded profiles shown to Buyers
- Maintain the My Leads dashboard and real-time Buyer activity features
- Process subscription payments through our payment processor
- Send administrative communications (billing receipts, policy updates, security notices)
- Comply with legal obligations, including TCPA recordkeeping and financial record retention
- Detect and prevent fraud, abuse, and unauthorized access
- Respond to customer support requests
We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.
4. SMS Messaging and TCPA Compliance
When a Pro enters a Buyer's phone number and initiates an invite, Chameleon Homes sends a single SMS to that phone number containing a link to the Buyer's shared calculator session. No further marketing SMS messages are sent to Buyers by Chameleon Homes.
Buyers may reply STOP to opt out of receiving any future SMS from Chameleon Homes. Upon receipt of a STOP message, we will immediately cease any further SMS to that number and record the opt-out in our TCPA compliance log.
SMS messages are transmitted via Twilio, our SMS provider, using a dedicated A2P 10DLC registered phone number. Pros are responsible for ensuring that Buyers have provided their phone number with knowledge that it will be used to send them a session link, consistent with applicable TCPA and state telecommunications law.
We retain TCPA opt-in and opt-out records for a minimum of 24 months from the date of the relevant communication.
5. Information Sharing and Disclosure
We do not sell, rent, or trade personal information. We share data only as described below:
| Recipient | Data Shared | Purpose |
|---|---|---|
| MongoDB Atlas (hosted on AWS) | All application data | Primary database — data stored encrypted at rest |
| Railway | Application logs and runtime data | Application hosting and infrastructure |
| Our payment processor | Billing information (name, email, payment card) | Subscription billing; we never store raw card data |
| Twilio | Buyer phone number, SMS message content | Delivery of one-time Buyer invite SMS |
| Law enforcement / regulators | As required by law | Legal compliance, valid legal process, or protection of rights |
If 10X Solutions undergoes a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will provide notice before such a transfer takes effect.
6. Data Retention
- Active accounts: Data is retained for the life of the account.
- Deletion requests: We will delete or anonymize personal data within 30 days of a verified deletion request, subject to retention requirements below.
- TCPA records: Opt-in and opt-out records are retained for a minimum of 24 months.
- Financial records: Subscription and billing records are retained for 7 years in accordance with applicable tax and financial regulations.
- Aggregated / anonymized data may be retained indefinitely for analytics and product improvement purposes.
7. Your Rights and Choices
7.1 Access and Correction
You may request a copy of the personal data we hold about you, or request corrections to inaccurate information, by emailing support@chameleon.homes. We will respond within 30 days.
7.2 Deletion
You may request deletion of your account and associated personal data at any time. Requests should be submitted to support@chameleon.homes. Deletion will occur within 30 days, subject to mandatory retention periods described in Section 6.
7.3 Opt-Out of SMS
Buyers may reply STOP to any SMS from Chameleon Homes. Pros may contact support@chameleon.homes to update or remove a Buyer's phone number from the platform.
8. California Residents — CCPA/CPRA Notice
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom we share it.
- Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is required.
- Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.
- Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service.
To exercise your California rights, email support@chameleon.homes with the subject "California Privacy Request." We will verify your identity before processing the request and respond within 45 days (extendable by an additional 45 days with notice).
Shine the Light: California Civil Code § 1798.83 permits California residents to request information about personal data shared with third parties for their direct marketing purposes. We do not share personal data with third parties for their direct marketing purposes.
9. Children's Privacy
Chameleon Homes is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us personal information, we will delete it promptly. If you believe we have inadvertently collected such information, please contact support@chameleon.homes.
10. Security
We implement industry-standard technical and organizational safeguards to protect personal information, including:
- TLS 1.2 or higher for all data in transit
- AES-256 encryption for data at rest in MongoDB Atlas
- Hashed passwords — plaintext passwords are never stored
- Role-based access controls limiting employee access to personal data
- Regular security reviews and vulnerability monitoring
No system is completely secure. In the event of a data breach affecting your rights, we will notify affected users as required by applicable law.
11. Policy Changes
We may update this Privacy Policy from time to time. We will provide at least 14 days' notice before material changes take effect, by posting the updated policy at chameleon.homes/privacy and, where appropriate, by emailing registered Pros. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.
12. Contact Us
For privacy questions, requests, or concerns, contact us at:
10X Solutions — Chameleon Homes
Email: support@chameleon.homes
Website: chameleon.homes