1. Introduction
Rexford AI, owned and operated by Rexford Insurance Solutions LLC ("Rexford," "we," "us," or "our"), provides a risk management platform built for owners and operators of real estate with complex operations. This Privacy Policy explains how we collect, use, share, and protect information when you use our website at rexford.ai, our application at app.rexford.ai, and any related services (collectively, the "Services").
Rexford is a business-to-business service. Most individuals interact with the Services as employees or representatives of an organization that has a subscription to Rexford (a "Customer"). When we process information on behalf of a Customer, we do so as a service provider/processor under that Customer's instructions, and that Customer's privacy policies — not this one — govern how the information was originally collected from end users.
2. Information we collect
2.1 Information you provide to us
- Account information. When you register, we collect your name, work email address, employer/Customer organization, role, and a password (or SSO identifier).
- Customer Data. Information your organization uploads, submits, or generates through the Services — for example, complaint records, incident reports, training and compliance records, vendor/COI records, property metadata, and the actions, alerts, and audit-trail entries Rexford produces from that data. Customer Data is processed under our Terms of Service and the Customer's instructions.
- Communications. When you contact us (e.g., support requests, sales inquiries), we collect the contents of those communications and any attachments.
- Payment and billing. Billing contact, billing address, and the last four digits and expiration of any payment card. Full payment card numbers are processed by our payment processor (Stripe) and are not stored by Rexford.
2.2 Information we collect automatically
- Usage data. Pages and features accessed, actions taken, timestamps, referring URLs, and similar telemetry.
- Device and log data. IP address, browser type and version, operating system, device identifiers, language preference, and access times.
- Cookies and similar technologies. See Section 5.
2.3 Information from third parties
- Single sign-on (SSO) providers. If you sign in via Google, Microsoft, Okta, or another SSO provider, we receive your name, email, and a unique identifier from that provider.
- Integrated systems. If your organization connects Rexford to its property management, work-order, training, HR, or vendor systems, we receive data from those systems as configured by your organization.
- Marketing partners. Names, emails, and firmographic data from publicly available sources or business contact databases for prospecting purposes.
3. How we use your information
We use the information we collect to:
- Provide, maintain, secure, and improve the Services;
- Authenticate users and protect against fraud, abuse, and unauthorized access;
- Process transactions and send transactional communications (receipts, billing, security alerts, service notices);
- Surface risk patterns, recommended actions, and audit-ready documentation as part of the core product functionality;
- Provide customer support and respond to your requests;
- Develop new features and improve existing ones, including by training and improving our predictive and analytic models using aggregated and de-identified data (we do not train models on identifiable Customer Data without explicit, written Customer authorization);
- Send relevant product updates, marketing communications, and event invitations (you can opt out at any time);
- Comply with legal obligations, enforce our terms, and protect our rights and the rights of others.
4. How we share your information
We do not sell personal information. We share information only as described below:
- With your organization (the Customer). Rexford is a multi-user platform. Account administrators at your organization may have access to information about how you use the Services within your organization's workspace.
- Sub-processors and service providers. Our primary infrastructure provider is Amazon Web Services (AWS). Additional sub-processors for monitoring, customer support, analytics, and email delivery operate on our behalf under contractual confidentiality and security obligations. A current sub-processor list is available on request from hello@rexford.ai.
- Payment processors. Stripe processes payments on our behalf.
- Legal and safety. We may disclose information when we believe in good faith that disclosure is required by law, regulation, court order, or other legal process; to protect the rights, property, or safety of Rexford, our Customers, or the public; or in connection with a fraud or abuse investigation.
- Business transfers. If Rexford is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will provide notice and choices where required by law.
- With your consent. We share information for any other purpose disclosed to you with your consent.
5. Cookies and tracking technologies
We use cookies, local storage, and similar technologies to operate the Services, remember your preferences, analyze usage, and (on our marketing site) measure the performance of marketing campaigns. Categories we use:
- Strictly necessary — required for the Services to function (authentication, security, load balancing).
- Functional — remember your preferences (e.g., language, UI settings).
- Analytics — measure usage and improve performance.
- Marketing — measure marketing-campaign performance on rexford.ai (not on app.rexford.ai).
You can manage cookie preferences through your browser settings or via our cookie consent banner where required. Disabling strictly necessary cookies will impair the Services.
6. Data retention
We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Customer Data is retained according to the retention terms in the Customer's contract and the Customer's instructions, and is deleted or returned upon termination of the contract subject to any legal-hold requirements.
7. Your privacy rights
Depending on where you live, you may have rights with respect to your personal information, including the right to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information;
- Delete your personal information, subject to certain exceptions;
- Port your personal information to another service;
- Restrict or object to certain processing;
- Withdraw consent where processing is based on consent;
- Opt out of marketing communications at any time.
To exercise these rights, contact us at privacy@rexford.ai. If you're an end user of a Customer's workspace, please direct your request to your organization's account administrator first; we will assist as a service provider where applicable.
7.1 California residents (CCPA/CPRA)
California residents have additional rights, including the right to know what categories and specific pieces of personal information we collect; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising); and the right not to be discriminated against for exercising your rights. To exercise these rights, contact privacy@rexford.ai.
8. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Rexford follows industry-standard security practices and can pursue SOC 2 Type II certification during customer implementation and onboarding for customers who require it. Security details are available under NDA. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
9. Children's privacy
The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.
10. International data transfers
Rexford is operated from the United States (Beverly Hills, California). If you access the Services from outside the United States, your information will be transferred to and processed in the United States, which has different data protection laws than your home country. By using the Services, you consent to that transfer.
11. Updates to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated through the Services or by email to account holders before they take effect.
12. Contact us
For questions about this Privacy Policy or our privacy practices:
Rexford AI — owned and operated by Rexford Insurance Solutions LLC
Email: privacy@rexford.ai
Mail: 325 N Maple Drive #286, Beverly Hills, CA 90210