Privacy Policy

This policy explains what LenderCap collects when you use our website and platform, why we collect it, who else processes it, and what you can do about it. It applies to lendercap.io and the services we provide through it.

It does not cover what a lender or broker does with information after you contact them through the platform. Once you send an enquiry to a lending company, that company handles your information under its own privacy policy.

Account information. Your name, email address, password (stored only as a hash), role, and optionally your company, phone number, job title, and profile photo. If you sign in with Google we receive your name, email address, and profile picture from Google — not your Google password.

Company and program information. If you list a lending company: the company profile, its loan programs and criteria, licensing details, logo, and any underwriting guideline documents you upload.

Scenario and search information. The loan scenarios you run — amount, property type, location, credit profile, experience, and similar underwriting inputs — along with your saved searches and match history.

Enquiry information. When an enquiry is sent to a lender, the details in that enquiry: name, email, phone, company, loan amount, purpose, property type, state, and message. If you submit an enquiry on behalf of a borrower, you are responsible for having their permission to do so.

Billing information. Your plan, subscription status, and renewal dates. Card details are entered directly with Stripe and are never sent to or stored on our servers; we hold only Stripe’s customer and subscription identifiers.

Technical information. IP address, browser and device type, pages viewed, and timestamps. We use IP addresses for rate limiting and abuse prevention, and we keep audit records of significant actions such as admin approvals.

• To run the service — authenticate you, generate matches, deliver enquiries to lenders, publish directory listings, and process subscriptions.
• To extract program criteria from guideline documents you upload, using automated systems including third-party AI providers.
• To communicate — verification and password emails, enquiry notifications, receipts, and service announcements. Marketing email is separate and optional, and every marketing message has an unsubscribe link.
• To keep the platform safe — rate limiting, fraud and abuse detection, and enforcing our Terms of Service.
• To improve the product — aggregate, non-identifying analysis of how the platform is used.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Lenders you contact. When you send an enquiry, its contents go to that lending company so they can respond. That is the point of the enquiry, and it happens only when you choose to send one.

Other users, where you have published. A lender company profile, a broker directory listing, and a review you write are public by design. Your account email address is not shown on any public page.

Service providers who process data on our behalf under contract:

• Supabase — database, authentication, and file storage (United States).
• Vercel — application hosting and privacy-friendly, cookieless analytics.
• Stripe — subscription payments.
• Resend — transactional email delivery.
• AI providers (currently Z.ai, Google, OpenRouter, and Anthropic, depending on configuration) — extracting structured criteria from guideline documents and generating match explanations. We send program and scenario data for this; we do not send borrower enquiry contact details.

Legal and business transfers. We may disclose information if required by law, valid legal process, or to protect our rights or someone’s safety; and, if LenderCap is involved in a merger or acquisition, information may transfer as part of that transaction, subject to this policy.

We use a small number of cookies and similar browser storage, all of them functional:

• Session cookies that keep you signed in. Without these the platform cannot work.
• Preference storage for things like your light or dark theme choice.

We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural profiling. Our analytics provider does not use cookies and does not build a profile of individual visitors.

• Account and profile data — while your account is open, then deleted or anonymised within 90 days of closure.
• Scenarios and saved searches — while your account is open, or until you delete them.
• Enquiries — retained by us for two years so both sides have a record of the introduction. The receiving lender keeps its own copy under its own policy.
• Guideline documents — until you or the listing company removes them.
• Billing records — as long as tax and accounting law requires, typically seven years.
• Security and audit logs — up to 12 months.

Traffic is encrypted in transit with TLS, and data is encrypted at rest by our hosting provider. Passwords are stored only as salted hashes. Access to records is enforced at the database level by row-level security policies, so the rules about who may read or change a record hold regardless of how a request arrives. Administrative access is limited to staff who need it and is logged. No system is perfectly secure, but if a breach affects your personal information we will notify you and the relevant regulators as the law requires.

You can view and edit most of your information from your dashboard, and you can close your account at any time. Depending on where you live — including under the GDPR and the CCPA/CPRA — you may also have the right to:

• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your information, subject to records we must keep by law.
• Receive your information in a portable, machine-readable format.
• Object to or restrict certain processing, and withdraw consent you have given.
• Not be discriminated against for exercising any of these rights. We do not sell or share personal information for cross-context behavioural advertising.

To make a request, email privacy@lendercap.io. We will verify your identity and respond within the time the applicable law allows — generally 30 days. If you are in the EEA or UK and are unhappy with our response, you may complain to your local data protection authority.

LenderCap is operated from the United States, and our service providers are principally located there. If you use the platform from outside the US, your information will be transferred to and processed in the US, where data protection law differs from your own. Where required, we rely on the European Commission’s Standard Contractual Clauses with our processors to safeguard those transfers.

LenderCap is a professional tool and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

If we change this policy we will update the date above, and for material changes we will notify you through the platform or by email before they take effect. Questions, requests, or complaints go to privacy@lendercap.io or through our contact page.