Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, password (hashed — never stored in plain text), and your selected role (borrower or lender).

Review Content

When you submit a review, we collect your written review, star rating, loan type, loan amount, and any proof documents you upload to verify your loan relationship.

Lender Claim Information

When a lender submits a claim, we collect business name, business email, phone number, business address, job title, LinkedIn profile (optional), NMLS number, and NMLS license documents.

Automatically Collected Information

We automatically collect IP addresses, browser type, device information, pages visited, and timestamps for security, fraud prevention, and analytics purposes.

Terms Acceptance Records

We record when you accepted our Terms of Service and Privacy Policy, including the document version and timestamp, to maintain a legal record of your agreement.

2. How We Use Your Information

• To create and manage your account
• To verify the authenticity of reviews through proof document review
• To process and verify lender claims and listing ownership
• To send transactional emails (account confirmation, review status, claim status)
• To detect and prevent fraud, fake reviews, and platform abuse
• To improve the platform through aggregated, anonymized analytics
• To comply with legal obligations and enforce our Terms of Service
• To maintain records of Terms of Service acceptance for legal protection

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes.

3. Proof Documents

Proof documents you upload (loan statements, closing disclosures, approval letters, NMLS certificates) are stored securely in encrypted cloud storage. They are:

• Never displayed publicly on the platform
• Accessible only to LenderBureau staff for verification purposes
• Retained for up to 3 years after account closure for fraud prevention
• Not shared with lenders, third parties, or government agencies unless required by law

We encourage you to redact sensitive information (Social Security numbers, full account numbers) before uploading. Only the last 4 digits of account numbers are needed for verification.

4. Data Sharing

We share data only in the following limited circumstances:

• Service Providers: We use Supabase (database and authentication), Vercel (hosting), Stripe (payment processing), and Resend (transactional email). Each provider is bound by a data processing agreement.
• Legal Requirements: We may disclose information if required by valid legal process (court order, subpoena, or government request), or to protect our rights, users' safety, or the public.
• Business Transfer: In the event of a merger, acquisition, or asset sale, user data may be transferred. You will be notified in advance.

5. Data Retention

• Active accounts: Data retained for the life of your account
• Deleted accounts: Account and personal data deleted within 30 days; verified reviews remain on the platform attributed to your display name to preserve their credibility
• Proof documents: Retained for 3 years after account closure for fraud prevention
• Terms acceptance records: Retained indefinitely as a legal record
• Login logs: Retained for 12 months

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your account and personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities

To exercise these rights, email info@lenderbureau.net. We will respond within 30 days.

7. Cookies & Tracking

We use only essential cookies required for authentication and session management. We do not use advertising cookies or cross-site tracking technologies. If this changes, we will update this policy and notify users.

8. Security

We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Bcrypt password hashing
• Row-level security on all database tables
• Optional two-factor authentication (TOTP)
• Regular security audits and access reviews

No system is perfectly secure. If you discover a security vulnerability, please report it to info@lenderbureau.net.

9. Children's Privacy

LenderBureau is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us immediately at info@lenderbureau.net.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions, data requests, or concerns: