Privacy Policy

Last updated: July 24, 2026

This Privacy Policy explains what information NON-QM Nexus ("we," "us") collects when you use our Service, how we use it, and the choices you have.

1. Information We Collect

• Account information: the email address and password you use to sign up (your password is never stored in plain text — authentication is handled by our database provider, Supabase, using industry-standard hashing).
• Scenario data: the borrower/loan scenario details you enter (e.g. FICO range, loan amount, property type, income documentation type) to get lender/program matches. This is used to power the matching feature and is stored under your organization's account.
• Membership/subscription data: which plan tier you're on, assigned by our admin team (or, in the future, chosen via self-serve checkout).
• Uploaded documents: if you (as an admin) upload a lender guideline PDF, the file and any AI-extracted data derived from it are stored to support the review workflow.
• Usage/technical data: standard web request logs (IP address, browser type, timestamps) collected by our hosting provider for security and reliability purposes.

We do not collect Social Security numbers, full loan applications, or other consumer PII through this Service — it is a professional decision-support tool, not a consumer loan application portal.

2. How We Use Information

• To operate the Service — authenticate you, save your scenarios, and show you the lender data your membership tier includes;
• To send transactional email — password resets, account/subscription confirmations, and (for admins) automated alerts when a monitored lender guideline changes;
• To improve and secure the Service — diagnosing bugs, preventing abuse, and enforcing our Terms of Service;
• To extract structured guideline data from lender documents you or we upload, using AI models, always subject to human review before anything becomes part of the live database.

We do not sell your personal information. We do not use your scenario data to train third-party AI models.

3. Third-Party Service Providers

We rely on the following providers to operate the Service, each of which processes data on our behalf under their own security and privacy commitments:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Resend — transactional email delivery (password resets, confirmations, alerts).
• OpenAI / Anthropic — AI-based extraction of structured data from lender guideline documents (admin-uploaded documents only).

4. Data Retention

We retain your account and scenario data for as long as your account is active. If you cancel your subscription, your account and scenario history are retained (so you can resume later) unless you specifically request deletion. Lender guideline documents and their extraction history are retained for audit and change-tracking purposes (see our automated guideline-monitoring feature) even after a program is updated or superseded.

5. Your Rights and Choices

• Access / export: you can request a copy of your account and scenario data by emailing legal@nonqmnexus.com.
• Correction: you can update your own account details at any time from your account settings.
• Deletion: you can request deletion of your account and associated personal data at any time by emailing legal@nonqmnexus.com. We will process deletion requests within a reasonable time, subject to any records we are legally required to retain.
• Marketing email: transactional emails (password resets, subscription confirmations, guideline-change alerts) are necessary to the Service and cannot be opted out of while your account is active; we do not currently send separate marketing email.

6. Security

We use row-level security in our database so that one organization's data is never visible to another, restrict lender/program data uploads to platform administrators only, and use HTTPS/TLS for all traffic to the Service. No system is 100% secure, and we cannot guarantee absolute security of information transmitted to the Service.

7. Children's Privacy

The Service is intended for licensed mortgage professionals and is not directed to children under 18. We do not knowingly collect information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

9. Contact

Questions about this Privacy Policy, or to make a data access/deletion request: legal@nonqmnexus.com.

This policy is a working draft appropriate for the Service's current scope (no consumer PII, no live payment processing). It should be reviewed by a licensed attorney — and updated — before real payment processing, consumer-facing data collection, or operation in jurisdictions with specific privacy statutes (e.g. CCPA, GDPR) is enabled.