Your data, handled with care.

1.1 What this policy covers. This policy applies to information we collect through the Services, including through our public website, our authenticated platform, our messaging and email integrations, and our communications with you.

1.2 What this policy does not cover. This policy does not apply to the practices of third parties that we do not control, including lenders, brokers, borrowers, and other users of the platform; websites and services we link to; or third party services you access from our Services, including any feature that opens an external artificial intelligence assistant in a new browser tab. Information you provide to those parties is governed by their own policies. We encourage you to review them.

1.3 Business use; not directed to consumers. The Services are offered for business, commercial, and investment purposes in commercial real estate finance. They are not directed to consumers and are not intended for personal, family, or household use.

1.4 United States only. The Services are designed, hosted, and offered for use in the United States. We do not target the Services to individuals located in the European Economic Area, the United Kingdom, Switzerland, or Canada, and we do not offer the rights available under the privacy laws of those jurisdictions. If you access the Services from outside the United States, you do so on your own initiative and you understand that your information will be transferred to, stored in, and processed in the United States.

1.5 Information about people who are not users. Because of the nature of commercial real estate finance, the Services receive information about individuals who never interact with us directly, including guarantors, sponsors, principals, tenants, occupants, and people named in documents or in synchronized email. Section 3.4 describes that information and Section 12 describes how those individuals may exercise rights.

For most information in the platform, our users decide what is collected and where it is sent. A broker or borrower chooses which documents to upload and which lenders receive them. We provide the technology. Where we determine the purposes for which information is used, including for our own operations, security, analytics, marketing, and product development, we are responsible for that use under this policy. Where a user uploads information about another individual, that user is responsible for having the authority and consents necessary to do so, and for any notice owed to that individual.

3.1 Information you provide

Account and contact information, such as your name, business email address, mobile telephone number, mailing address, employer or organization, job title, role on the platform, professional experience, and profile content.

Authentication information, including one time passcodes sent to your mobile number and information used to verify your identity at registration.

Payment information. Subscription payments are processed by our payment processor. We receive confirmation of payment, the last four digits and brand of the payment instrument, and billing metadata. We do not receive or store full payment card numbers.

Deal and transaction information, including the parameters you set when seeking or offering financing, property addresses and characteristics, financial criteria, geographies, asset classes, leverage and pricing preferences, lending criteria, quotes, and transaction status.

Documents you upload. Section 3.4 describes these in detail.

Communications, including messages you exchange with other users through the platform, messages you exchange with us, support requests, survey responses, demonstration and onboarding correspondence, and content you send through connected messaging services.

Contacts you supply. Lists of lender or borrower contacts that you upload, import, paste, or enter manually, including the names, email addresses, telephone numbers, and institutional affiliations of individuals who may not be users of the Services.

3.2 Information collected automatically

Device and connection information, such as IP address, browser type and version, operating system, device identifiers, screen and window characteristics, language, and referring and exit pages.

Usage information, such as pages and screens viewed, features used, searches run, documents opened, deals created and distributed, quotes submitted, response times, clicks, scrolls, form interactions, and the dates, times, and duration of your activity.

Session recordings. We use session recording and replay technology that captures your interactions with the Services, including within the authenticated platform. This is described in Section 4.3.

Approximate location derived from your IP address or, where your browser or device provides it, from your device. You can disable device based location through your browser or device settings.

Cookies and similar technologies, as described in Section 4.

3.3 Information from third parties

Information from other users, including information a broker or borrower submits about you or about a transaction in which you are involved, and contact records added to our lender directory by other users.

Advertising, analytics, and visitor identification partners. As described in Section 4.4, we use services that attempt to identify individuals and companies associated with otherwise anonymous website traffic, and that may provide us with a name, business email address, employer, or professional profile associated with a visit. We may combine that information with information we already hold.

Data providers. We license commercial real estate data, including comparable sales and rent information, operating expense benchmarks, and market metrics, and we obtain rate and public data from governmental and other public sources. This data relates primarily to properties and markets rather than to individuals.

Service providers and integrations, including information returned by identity, fraud prevention, mapping, calendaring, and communications services.

3.4 Documents, deal materials, and sensitive information

Users upload documents to the platform in the ordinary course of a financing. Those documents commonly include personal financial statements, personal and business tax returns, credit reports supplied by the user, loan applications, organizational and operating agreements, rent rolls, leases, operating statements, appraisals, and settlement statements.

These documents can contain sensitive information about individuals, including guarantors, sponsors, principals, tenants, and occupants. That information may include names, contact information, dates of birth, Social Security numbers and other government identifiers appearing within the documents, income, assets, liabilities, credit scores and credit history, and tenancy and payment information.

We also extract structured data fields from uploaded documents, which may include guarantor names, credit scores, income, liabilities, and asset schedules.

Please note the following. We do not require, request, or maintain a dedicated database field for Social Security numbers, but such numbers may appear inside documents that users choose to upload. We do not automatically detect or redact sensitive information at upload. Users, not Finance Lobby, determine what is uploaded and to whom it is distributed. If you are asked to provide a document that contains more information than the recipient needs, consider redacting it before upload.

3.5 Information we do not collect

We do not obtain consumer reports, credit reports, or credit scores from any consumer reporting agency. We do not perform credit inquiries. Any credit information in the Services was supplied by a user. We are not a consumer reporting agency and the Services are not a consumer report.

We do not record or transcribe telephone or video calls, and we do not use an artificial intelligence notetaker on calls or meetings.

We do not knowingly collect information from anyone under the age of eighteen.

4.1 Technologies we use

We and our partners use cookies, local storage, software development kits, web beacons, tracking pixels, and similar technologies to operate the Services, remember preferences, authenticate sessions, measure traffic and performance, diagnose problems, measure and deliver advertising, and identify visitors.

4.2 Advertising and analytics partners

We use analytics and advertising technologies provided by third parties, including major search, social, professional network, content recommendation, audio, and advertising platforms, and general purpose product analytics tools. These technologies may set cookies and collect information about your device, your activity on our Services, and, in some cases, your activity across other websites over time. That information is used to measure the performance of our marketing, to build and target audiences, and to deliver advertising to you on other platforms.

4.3 Session recording and replay

We use session recording and replay tools that capture and reconstruct your interactions with the Services, including mouse movement, clicks, scrolling, keystroke timing, form interactions, and the content displayed on your screen. These tools operate inside the authenticated platform as well as on our public website, which means that screens displaying deal information and document contents may be captured in a recording. We also use co-browsing technology that, when initiated, allows a support representative to view your screen in real time. We use these recordings to diagnose errors, understand how features are used, and improve the product.

4.4 Visitor identification

We use services that attempt to resolve anonymous website traffic to identified individuals or companies, and that may supply us with contact and professional information associated with a visit even where you have not submitted a form or created an account. We use this information for sales and marketing outreach.

4.5 Your choices

Browser controls. Most browsers allow you to refuse or delete cookies and to be notified before a cookie is set. Disabling cookies may affect how parts of the Services function.

Opt out signals. Where required by applicable law, we honor the Global Privacy Control and similar browser or device based opt out preference signals as a request to opt out of the sale or sharing of personal information for the browser or device transmitting the signal.

Platform opt outs. You can opt out of interest based advertising from participating companies through the industry opt out tools operated by the Digital Advertising Alliance at optout.aboutads.info and the Network Advertising Initiative at optout.networkadvertising.org, and through the settings offered by individual advertising platforms.

Do Not Track. We do not currently respond to browser Do Not Track signals, which have no agreed standard.

Opt out request. You may submit a request to opt out of the sale or sharing of your personal information and of targeted advertising through the form at financelobby.com/privacy-request or by emailing [email protected].

We use information for the following purposes:

To provide the Services, including creating and administering accounts, authenticating users, processing documents, generating analyses and memoranda, matching deals with lenders, distributing deals, delivering quotes, enabling messaging, and maintaining deal records.

To process payments and administer subscriptions, renewals, cancellations, and collections.

To communicate with you about your account, your deals, transactions, security, and support, and to send administrative and service messages.

For marketing, including sending promotional email and, where you have opted in, promotional text messages; targeting and measuring advertising; and conducting sales outreach, including outreach informed by the visitor identification services described in Section 4.4. Marketing is subject to your choices as described in Sections 4.5 and 11.

To operate artificial intelligence features, as described in Section 6.

For research, analytics, and product development, including understanding how the Services are used, testing features, and creating de-identified and aggregated data as described in Section 9.

For security, fraud prevention, and abuse detection, including investigating suspected violations of our terms, protecting accounts, and preserving evidence.

For legal and compliance purposes, including responding to legal process, enforcing our agreements, establishing and defending legal claims, and complying with applicable law.

6.1 What is processed. Our artificial intelligence features extract information from uploaded documents, populate deal fields, generate underwriting analyses and deal memoranda, summarize and draft communications, and respond to inquiries. To provide these features, we transmit content to third party artificial intelligence service providers. The content transmitted can include complete uploaded documents, including personal financial statements, tax returns, credit reports, and rent rolls, as well as in-platform messages, content from synchronized email mailboxes, and messages exchanged through connected messaging services.

6.2 Who processes it. We use several third party artificial intelligence providers, including a primary provider and additional providers used for fallback, specialized tasks, and capacity. Those providers process content under their own terms and may retain content for a limited period for purposes such as abuse monitoring and service operation.

6.3 Training. We do not use your content to train or fine tune any artificial intelligence model, and we do not create embeddings or vector representations of your deal content for model development purposes. We do not authorize our artificial intelligence providers to use your content to train their models. If this changes, we will update this policy and provide notice before the change takes effect.

6.4 Accuracy. Output generated by these features is produced automatically without human review and may be incorrect. It is not verified by Finance Lobby and must be checked against source documents before it is relied upon or distributed.

If you connect an email account to the Services, you grant us and our integration provider access to that mailbox using the permissions you approve. The access requested is read access to the full contents of the mailbox and to associated contact records. Filtering to messages relevant to your deals occurs after the mailbox has been accessed, not at the permission level. This means we may receive, process, and store messages and attachments unrelated to your deals, and information about the other participants in your correspondence, who are not users of the Services and receive no notice from us.

Content ingested through this feature may be processed by the artificial intelligence features described in Section 6 and may be retained as described in Section 10. You may disconnect the integration at any time through your account settings, which stops further ingestion. Disconnection does not by itself delete content already ingested. You may request deletion of ingested content at [email protected].

If you connect a third party messaging service, messages exchanged through it are also subject to that service provider’s own terms and privacy practices.

SMS and text messaging. If you provide your mobile number and consent to receive text messages from Finance Lobby, we collect your mobile number, your consent status, the date and time of consent, and the method by which consent was given. We use this information solely to send the categories of text messages you consented to receive and to maintain records of that consent.

No mobile information or SMS opt-in consent will be shared with third parties or affiliates for marketing or promotional purposes. We share this information only with service providers who help us deliver messages on our behalf, such as our messaging platform and telecommunications carriers, and only for that purpose. We may disclose it where required by law.

Message frequency varies. Message and data rates may apply. You can withdraw consent at any time by replying STOP to any message, or by contacting us at [email protected]. For full program terms, see the SMS Text Messaging Program Terms in our Website Terms of Use.

Separately from any marketing program, we send transactional and service messages, including verification and authentication codes and security alerts, to the number associated with your account. Where a number is submitted during registration, we may send a notification to that number advising that an account registration was attempted using it.

8.1 To other users. The core function of the Services is to move deal information between brokers, borrowers, and lenders. Information you submit is disclosed to the users you or your broker select, and where you post a deal to the broader network, to lenders matched to that deal. Once information has been delivered to or downloaded by a recipient, we cannot retrieve or recall it. Recipients are subject to confidentiality obligations under our Platform Terms of Service, but we do not monitor or enforce their compliance.

8.2 Publicly. Lender profiles, including institution name, logo, stated lending preferences, and performance metrics such as quote and close rates over a trailing period, may be displayed publicly. Leaderboards displaying names or partial names together with activity metrics are displayed to other users within the same role. Directory listings may include contact records supplied by other users for individuals who are not registered with us.

8.3 To service providers. We disclose information to vendors that perform functions on our behalf, including cloud hosting and infrastructure, data storage, content delivery and security, database monitoring, payment processing, email delivery, text messaging and voice services, in-application messaging and notifications, customer relationship management, scheduling, support and chat, product analytics, session recording, error monitoring, feature management, artificial intelligence processing, mapping, fraud and abuse prevention, and advertising. A current list of the categories of service providers, and of the principal providers in each category, is available on request at [email protected].

8.4 To advertising and identification partners. As described in Section 4, we disclose information, including identifiers, device information, and activity information, to advertising platforms, analytics providers, and visitor identification services. Under California and certain other state privacy laws, some of these disclosures are considered a “sale” or “sharing” of personal information, or processing for targeted advertising. See Section 12.

8.5 For legal reasons. We disclose information where we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Finance Lobby, our users, or others, to enforce our agreements, or to detect, prevent, or address fraud, security, or technical issues.

8.6 In a business transaction. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, including during diligence, subject to reasonable confidentiality protections.

8.7 With your direction. We disclose information at your direction or with your consent.

We create de-identified and aggregated information derived from deal data, property data, quotes, and usage, and we use it for analytics, benchmarking, research, published market reports, and product development. We may also license or otherwise commercialize de-identified and aggregated information. We maintain de-identified information in de-identified form, do not attempt to re-identify it except as permitted by law to test our de-identification processes, and require recipients not to re-identify it. De-identified and aggregated information is not personal information.

We do not sell or license identifiable property level data, financial statements, tax returns, credit information, or tenant level information.

We retain information for as long as needed for the purposes described in this policy. In general:

Account information is retained for the life of the account and for a period afterward to support reactivation, billing records, and legal claims.

Deal materials and documents are retained for the life of the account and are not automatically deleted when a deal is archived, deleted, or a subscription is cancelled. Copies delivered to or downloaded by another user are outside our control and are retained according to that recipient’s own practices.

Email content ingested through mailbox synchronization is retained until deleted at your request.

Messages and support records are retained for the life of the account and for a reasonable period afterward.

Session recordings and analytics data are retained for the periods set by the applicable tools, which are generally measured in months rather than years.

Records required for legal, tax, audit, accounting, and compliance purposes, including records of your acceptance of our terms and of certifications you make, are retained for the applicable limitation or retention period.

When information is no longer needed, we delete it or de-identify it. Residual copies may persist in backups for a limited period before expiring on our backup cycle.

Account information. You may review and update most account and profile information in your account settings.

Marketing email. Every marketing email includes an unsubscribe link. You may also email [email protected]. We will continue to send transactional and service messages relating to your account.

Text messages. Transactional and service messages, including verification and authentication codes and security alerts, are part of the Services and are sent to the number you provide. Where we offer a marketing text program, participation is optional, consent is not a condition of using the Services, and you may opt out at any time by following the instructions in the message or by contacting us.

Integrations. You may disconnect an email or messaging integration at any time in your account settings.

Leaderboards and profile display. Where an option to suppress or limit display of your name or metrics is available, you may exercise it in your account settings or by contacting us.

Cookies, advertising, and session recording. See Section 4.5.

12.1 Rights. Depending on where you live, you may have the right to (a) know what personal information we collect, use, and disclose about you and to obtain a copy of it; (b) correct inaccurate personal information; (c) delete personal information; (d) opt out of the sale or sharing of personal information and of targeted advertising; (e) limit the use of sensitive personal information in certain circumstances; (f) obtain your information in a portable format; and (g) not be discriminated or retaliated against for exercising these rights. We do not use personal information to make decisions that produce legal or similarly significant effects about you without human involvement.

12.2 Sale and sharing. We do not sell personal information for money. As described in Sections 4 and 8.4, our use of advertising, analytics, and visitor identification technologies may constitute a “sale” or “sharing” of personal information, or processing for targeted advertising, under California and certain other state privacy laws. You may opt out as described in Sections 4.5 and 12.3. We do not knowingly sell or share the personal information of individuals under sixteen years of age.

12.3 How to submit a request. Submit a request through the form at financelobby.com/privacy-request or by emailing [email protected]. You may also write to us at the address in Section 15. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and may require you to verify your own identity directly.

12.4 How we handle requests. We acknowledge requests promptly, generally within seventy-two hours, and we respond within the period required by applicable law, generally forty-five days, with an extension where permitted. To protect your information, we do not confirm at intake whether a given email address appears in our records, and we verify identity before acting on a request to access, correct, or delete. If we cannot verify your identity, we may decline the request.

12.5 Appeals. If we decline your request, you may appeal by emailing [email protected] with the subject line “Privacy Appeal” and a description of your request and our response. We will respond to an appeal within the period required by applicable law. If your appeal is denied, you may contact your state attorney general.

12.6 Individuals who are not users. If you believe a user has submitted your personal information to the Services, for example as a guarantor named in a financial statement, as a tenant named in a rent roll, or as a contact in a directory listing, you may contact us at [email protected] and we will respond in accordance with applicable law. Because documents are uploaded and controlled by our users, we may need to direct you to the user that submitted the information, and we may be limited in our ability to modify the contents of a document a user has uploaded.

12.7 Directory listings. Any individual or institution appearing in our lender directory may request correction or removal by emailing [email protected] or [email protected].

12.8 Notice of financial incentive. We do not offer financial incentives in exchange for personal information.

We use administrative, technical, and physical safeguards designed to protect information. These currently include encryption of data in transit using transport layer security with strict transport security enforced, a security header baseline on our web application, authentication through established identity providers, mandatory one time passcode verification of a mobile telephone number at registration, antivirus scanning of uploaded files, automated abuse and bot prevention controls, encrypted storage of third party credentials, scrubbing of sensitive values from application logs, and automated testing and static analysis in our development pipeline.

We do not represent that these safeguards are comprehensive, that they conform to any particular security standard or framework, or that they have been certified or attested to by any third party. Our security program continues to develop and the controls described above may change over time.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials, for controlling who you invite to a deal, and for considering what information you upload. If you believe your account has been compromised, contact us immediately at [email protected].

We may update this Privacy Policy from time to time. We will revise the last updated date above and post the updated policy. If we make a material change, we will provide notice by email to the address associated with your account, by prominent notice within the Services, or by both, before the change takes effect. Your continued use of the Services after the effective date means you accept the updated policy. We will maintain prior versions of this policy available on request.

The following table summarizes the categories of personal information we have collected in the preceding twelve months, the sources, the purposes, and the categories of recipients. It is provided to satisfy disclosure requirements under California and other state privacy laws.

Sensitive personal information. Certain information described above, including government identifiers and financial account or credit information appearing within uploaded documents, is treated as sensitive personal information under some state laws. We use and disclose it only to provide the Services, to secure them, and for the other purposes permitted by applicable law, and not for the purpose of inferring characteristics about any individual.