Privacy Policy

We collect only what the service needs to work:

• Your account email and password (the password is stored hashed by our auth provider, never in plain text).
• Your brand profile, which you enter: your name, title, NMLS number, company, phone, email, brand color, logo, and headshot.
• The loan scenarios you type into the tools (loan amounts, rates, terms, prices, and any borrower name you choose to enter). These are processed to render your documents but are saved in your browser, not in our database.
• Your theme preference and basic session state.

Your account and brand profile are stored in our database (hosted on Supabase). Access is restricted so your data is tied to your account. The loan scenarios you build stay in your browser's local storage on your device; they are sent to our servers only to render a document and are not stored there.

Payments are handled entirely by Stripe. Your card number and payment details go directly to Stripe and never touch Lendcraft's servers. We store only a customer and subscription identifier so we know whether your plan is active.

The scenarios you build may include a borrower's name. Any borrower information you enter stays in your browser on your device, is used only to render your documents, and is never shared with or sold to anyone. Lendcraft is a tool for you; we do not contact your borrowers and we are not the borrower's data controller. Enter only what you need, and follow your own obligations for handling client information.

Lead-capture submissions are delivered to the loan officer you configure, via email and/or their webhook, and a copy is stored in Lendcraft so the loan officer can retrieve the lead from their account even if a delivery attempt fails. Lead data is visible only to the loan officer who owns the intake link, and is never sold or shared with third parties. Borrowers also affirm consent to be contacted at submission, which is recorded with the lead.

Tracked links are opt-in. Nothing is stored on our servers for a document unless you click "Create tracked link" yourself. When you do, we store the scenario figures, a snapshot of your brand, and an optional first name you enter for your own notification. We store only a first name, never a full name, an SSN, or a date of birth.

When a borrower opens or downloads a tracked link, we log only the kind of event and a timestamp. We do not collect an IP address, device, or browser information from that view, and we do not know who the borrower is beyond a first name you may have entered yourself.

Tracked links expire automatically after 30 days. You can revoke a link at any time, which shows anyone who opens it a message that the link has expired, or delete it permanently, which removes the stored scenario and brand snapshot along with its event history.

We use your browser's local storage to remember your theme choice, to keep your session so you stay signed in, and to save the scenario inputs you type into the tools so they are still there when you come back. For trial use before you create an account, a brand you enter may be cached locally on your device until you sign in. We do not use advertising or third-party tracking cookies.

We keep lightweight, first-party usage analytics, anonymous counts of events such as a page view or a document download, to understand how the product is used and what to improve. These counts do not include your identity, your account, your borrowers, or your scenario data, and they are never shared with advertisers or third parties.

We do not sell your data. We do not share it with advertisers. We do not run ad-tracking pixels. We do not use your borrowers' information for anything beyond rendering the documents you build.

We share data only with the providers that run the service on our behalf, our database host (Supabase), our payment processor (Stripe), and our email delivery provider (Resend, which sends transactional email such as lead notifications), and only as needed to operate Lendcraft, or when required by law.

We keep your data while your account is active. You can request deletion of your account and its data at any time by emailing us, and we will delete it within a reasonable period, except for records we are required to keep (for example, billing records).

If we change this policy, we will update the date at the top of this page. Material changes will be reflected here.

To ask a question or request deletion, email hello@lendcraft.app.