How we handle information from an order.

Information handled

The order process records the order contact, subject property details, intended use, optional organization or partner code, server calculated price, payment provider identifiers and status, limited payment classification facts, email events, uploaded photos, and security or audit metadata. Payment classification facts can include the payment method, a credit, debit, prepaid, or unknown funding category, the card brand, and whether Stripe identified a wallet. Security metadata can include the IP address, browser and device characteristics, language and time zone, request and network details, encrypted connection details, approximate location based on the IP address, and automated submission checks. Do not submit Social Security numbers, full payment credentials, government identifiers, or confidential information about another person.

How it is used

The information is used to create and verify the order, document checkout acceptance, process and reconcile payment, investigate fraud or payment disputes, deliver email, provide private photo upload and review, prepare the appraisal, support the customer, administer the service, prevent abuse, and maintain security and audit controls.

Services involved

Cloudflare provides the application, access control, database, object storage, image processing, queues, verification, and email delivery. Stripe Payment Element collects payment details. Stripe receives the order and payment information needed to process and reconcile the payment. Xpress Reports stores the limited payment classification facts described above to verify credit card surcharge treatment and maintain payment records. Xpress Reports does not receive or store full card numbers, security codes, expiration dates, or full bank credentials.

Recipients and disclosure

Transactional messages may be sent to the email address entered on the order. Authorized Xpress Reports appraisal and administrative staff may access order and photo records to operate, verify, secure, support, and complete the service. Detailed order-placement evidence is restricted to authorized administrators handling payment disputes, fraud review, or related support. Service providers may process information only to provide the services described here.

Retention

Uploaded photos are scheduled for deletion three years after upload, subject to the separate photo upload privacy notice. We retain order, payment, email, security, and audit records for the periods needed to provide the service, prevent abuse, reconcile payments, protect the professional workfile, and meet accounting or legal obligations.

Marketing email

If you select the optional marketing checkbox, we record your name, email address, consent date, consent wording version, and the order through which consent was provided. We may provide the minimum information needed to an email-marketing service that sends messages and manages subscriptions for us.

You may withdraw your marketing consent at any time by using the unsubscribe option in a marketing email or by replying to a marketing email with “unsubscribe.” We keep opt-in and opt-out records so we can document and honor your choice.

Questions

Use the Xpress Reports support page for privacy questions or requests. Include the order reference when it helps us locate a record, but do not include the private order key in an ordinary message.