Privacy, terms, and legal notices.

1. Who this policy covers

This site, zacharylacorte.com, is operated by Zachary LaCorte, a licensed Massachusetts real estate salesperson (MA License #9589622) affiliated with Chinatti Realty Group. When you use forms on this site, your submission is handled by Zachary LaCortepersonally and, where appropriate, by Chinatti Realty Group staff for transaction support.

This policy covers information collected through this website. The brokerage may maintain separate policies covering information you provide directly (in person, by phone, through MLS paperwork, or through transaction platforms like Dotloop). Ask and we’ll point you to the right policy for your situation.

2. Information you provide directly

When you submit a form on this site we collect the fields you fill in. Nothing is collected silently from form fields you leave blank.

• Contact form: name, email, optional phone, optional neighborhood of interest, and your message.
• Newsletter: email and optional name.
• Home valuation request: property address, neighborhood, property type, bed/bath/square-footage details, year built (optional), condition, and your name, email, and optional phone.
• Listing inquiry: name, email, phone, best time to reach you, buyer/seller role, timeline, financing status, price range, bedroom count, neighborhoods of interest, showing-request details, and your message. We also record which listing you inquired about.

Required fields are marked on each form. Everything else is optional, and leaving it blank does not affect the quality of your response.

3. Information collected automatically

Like most modern websites, some information is collected automatically when you visit.

• Hosting logs. Our host (Vercel) records standard request metadata: IP address, user agent, referring URL, page requested, and timestamp. These logs are used to keep the site reliable and to investigate abuse.
• Analytics. Vercel Analytics and Vercel Speed Insights measure page views and performance. These tools are configured to be cookieless where possible and do not build cross-site advertising profiles.
• Rate-limit tracking. To discourage spam, form endpoints count requests by IP and route within a short fixed window (typically one minute). Most counters live in server memory; the ones that must hold across servers are stored briefly in our database and expire automatically once the window closes. They are not used for any purpose other than rate limiting.
• First-party visit measurement. This site sets a small number of first-party cookies so that visits can be counted, people can be told apart from automated crawlers, and basic analytics can be shown to the site owner. zjl_vid holds a random visitor identifier for one year. zjl_sid holds a random session identifier that expires thirty minutes after your last page view. zjl_ft remembers, once, the page you first arrived on, the site that referred you, and any campaign parameters carried by the link you followed. zjl_known is set after you submit a form or sign in to the client portal and records nothing but the fact that you did, so the site can stop asking. If you arrive on a link from one of our emails or a link sent to you as a client, or choose “don’t show this again”, your browser’s local storage keeps a single flag (zjl_subscribed) so the sign-up prompt does not appear again. If you close that prompt, local storage notes when (zjl_cta_snooze) so it stays away for a month, and it counts pages in the current visit (zjl_cta_visit) so the prompt appears at most once a visit. Each page view records the page, the time, the referring site, campaign parameters from the arriving link, coarse country and region derived from your IP, your browser’s language setting, your viewport size, your time zone, roughly how long the page was in view before you first interacted, and whether your browser reports that it is automated. Those last signals exist to tell people from crawlers; nothing is sent to a third party. If you submit your contact details through a form, what you enter is stored alongside, and linked to, the visitor identifier and the arrival details above. If you later start a form on this site, it may be prefilled from your own earlier submission, in this browser only. None of these cookies are used for advertising or cross-site tracking.
• Client portal sessions ( clients.zacharylacorte.com). When a client signs in to the portal, a session record is created on the portal subdomain capturing a session identifier, IP address, user agent, and timestamps. An append-only audit log records sign-in, sign-out, and revocation events. Portal session cookies are scoped to the portal subdomain only (via the __Host- cookie prefix), so this marketing site cannot read them and the portal cannot read this site’s cookies.
• Client portal activity. Essential activity needed to operate and secure the workspace is recorded, including access changes, publications, first opens or downloads, acknowledgements, submitted tasks or messages, and delivery status. A client may separately choose whether to share detailed reading insights such as time spent in a section, revisits, and reading sequence. Declining detailed insights does not reduce portal functionality. We do not use session replay, keystroke capture, third-party advertising pixels, or unfinished-draft capture in the portal.

4. Cookies and tracking technologies

This site does not set cookies for advertising or cross-site tracking, and we do not use third-party advertising trackers, retargeting pixels, or social-media cookies.

The first-party cookies this site sets are listed in section 3 above. We also rely on a few small pieces of client-side storage, none of which identify you: sessionStorage flags that remember whether you have already seen the site’s intro animation on this visit, when your visit started, and whether you closed the sign-up prompt during this visit; and localStorage flags that remember your sound preference, whether the playlist invitation was shown, when the sign-up prompt was last shown, and whether you subscribed. Clearing your browser data erases all of them; the intro plays again and the prompt may return.

5. How we use your information

• Respond to your inquiry, offer, or question directly.
• Schedule showings, send neighborhood information, or prepare a comparative market analysis you asked for.
• Follow up about your real-estate goals in the way you indicated (email, phone, or whatever you specified).
• Operate and improve the site , diagnose errors, understand which pages are useful, and maintain performance.
• Comply with legal obligations, including Massachusetts real-estate licensing and Fair Housing requirements.

We do not sell your information. We do not share it with advertisers. We do not use it to train AI models.

6. Service providers we share information with

We share the minimum necessary information with vendors who help us run the site and respond to you. Each is bound by its own terms and privacy commitments.

• Vercel , hosting, analytics, and speed insights.
• Mailjet , transactional email delivery for the replies we send you and the notifications we receive about your submission.
• Chinatti Realty Group , when your inquiry concerns a specific property or transaction, relevant details may be shared with brokerage staff who support the file (administrative, compliance, closing coordination).

7. Data retention

Form submissions are retained as long as an active or prospective client relationship exists, plus the period required by Massachusetts real-estate record-retention rules (generally three years for transaction-related records). Server logs are retained on our host’s standard schedule, typically under 30 days for access logs. Analytics data is retained by Vercel per its default retention policy and is not tied to an individual identity on our side.

If you ask us to delete your information, we will do so except where a specific legal obligation requires us to keep it. We will tell you what we kept and why.

Portal session IP addresses recorded on the client portal subdomain (clients.zacharylacorte.com) are cleared 90 days after the session was created. Cleanup runs automatically as new sign-ins occur. Other portal records, including session identifiers, user agents, sign-in and sign-out timestamps, and the append-only audit log, are retained on the schedule described in the paragraphs above.

Raw optional reading-detail events are kept for up to 30 days. During an active client relationship they may be summarized into practical workspace insights. Those summaries are deleted or de-identified within 90 days after closing, except where a security, legal, or transaction-record obligation requires longer retention. Reading insights are treated as inferences, not proof that a person understood, agreed to, or consented to any document or update.

8. Your rights

You can ask us to do any of the following, regardless of where you live:

• Confirm whether we hold personal information about you, and give you a copy.
• Correct anything that is wrong.
• Delete your information, subject to the retention limits described above.
• Stop contacting you about real estate. Replying “stop” or “unsubscribe” to any message works; emailing privacy at the address below works faster.

To exercise any of these, email zachary.lacorte@chinattirealty.com with enough detail that we can locate your record. We will respond within 30 days and without charge.

9. California residents

Under California law, including the California Online Privacy Protection Act (CalOPPA) and, where applicable, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have additional disclosures and rights.

Categories of personal information collected in the past 12 months: identifiers (name, email, phone, and network identifiers such as IP address as recorded in hosting logs), commercial-intent information (buy/sell/rent preferences), and internet-activity information (pages visited, referrer). We do not resolve IP addresses into city-, region-, or country-level location data ourselves.

Sources: directly from you via forms, and automatically via your browser.

Sale or sharing of personal information: we do not sell personal information and do not share it for cross-context behavioral advertising. Because we do not sell or share in the CCPA/CPRA sense, we do not display a “Do Not Sell or Share My Personal Information” link.

Rights: in addition to the rights listed in Section 8, California residents may request information about the categories of personal information we have disclosed for a business purpose in the past 12 months (California Civil Code § 1798.83, “Shine the Light”). Use the contact address in Section 8 to submit a request. You may designate an authorized agent; we may ask you to verify the designation before acting.

Do Not Track: there is no industry consensus on how to interpret Do Not Track (DNT) signals. We currently do not alter our practices based on DNT signals from your browser.

10. Children

This site is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted information, contact us and we will delete it.

11. Security

Traffic to this site is encrypted in transit (HTTPS). Form submissions are transmitted via a server-side email API (Mailjet) directly to the agent’s inbox and are stored in our website database so requests are not lost if email or an internal service is unavailable. Service inquiries are also transferred to the Zachary LaCorte Client Portal and may be manually sent to Follow Up Boss for follow-up. Address suggestions are processed by Google Places, and transactional email is handled by our email provider. We do not sell this information or automatically enroll service inquiries in marketing email; an inquiry joins the newsletter only if you tick the market-notes box on the form, and every newsletter carries a one-click unsubscribe. We retain inquiry records while needed to respond, operate the business, and meet legal obligations; you may request access or deletion using the contact information below. Passwords and secrets are never logged. No system is perfectly secure; if we ever experience an incident that affects your data, we will notify you consistent with applicable Massachusetts and federal law.

12. Changes to this policy

When we update this policy, we will update the “Last updated” date at the top of the page. Material changes that affect how we use your information will be called out at the top of this page for 30 days and, when we have your email, sent to you directly.

13. Contact

Questions about this policy, or a request to exercise any of the rights above:

Zachary LaCorte , Chinatti Realty Group
zachary.lacorte@chinattirealty.com
Boston, Massachusetts