Privacy Policy

Last updated: July 24, 2026

This Privacy Policy explains what information NON-QM Nexus ("we," "us") collects when you use our Service, how we use it, and the choices you have.

1. Information We Collect

• Account information: the email address and password you use to sign up (your password is never stored in plain text — authentication is handled by our database provider, Supabase, using industry-standard hashing).
• Scenario data: the borrower/loan scenario details you enter (e.g. FICO range, loan amount, property type, income documentation type) to get lender/program matches. This is used to power the matching feature and is stored under your organization's account.
• Membership/subscription data: which plan tier you're on, assigned by our admin team (or, in the future, chosen via self-serve checkout).
• Uploaded documents: if you (as an admin) upload a lender guideline PDF, the file and any AI-extracted data derived from it are stored to support the review workflow.
• Usage/technical data: standard web request logs (IP address, browser type, timestamps) collected by our hosting provider for security and reliability purposes.

We do not collect Social Security numbers, full loan applications, or other consumer PII through this Service — it is a professional decision-support tool, not a consumer loan application portal.

2. How We Use Information

• To operate the Service — authenticate you, save your scenarios, and show you the lender data your membership tier includes;
• To send transactional email — password resets, account/subscription confirmations, and (for admins) automated alerts when a monitored lender guideline changes;
• To improve and secure the Service — diagnosing bugs, preventing abuse, and enforcing our Terms of Service;
• To extract structured guideline data from lender documents you or we upload, using AI models, always subject to human review before anything becomes part of the live database.

We do not sell your personal information. We do not use your scenario data to train third-party AI models.

3. Third-Party Service Providers

We rely on the following providers to operate the Service, each of which processes data on our behalf under their own security and privacy commitments:

• Stripe — payment processing and subscription billing. Payment card data is transmitted directly to Stripe and never touches our servers; Stripe is a PCI-DSS Level 1 certified processor.
• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Resend — transactional email delivery (password resets, confirmations, alerts).
• Sentry — error and crash monitoring. Diagnostic data (stack traces, device/browser metadata) is scrubbed of personal identifiers on-device before transmission.
• OpenAI / Anthropic — AI-based extraction of structured data from lender guideline documents (admin-uploaded documents only).

4. Data Retention

We retain your account and scenario data for as long as your account is active. If you cancel your subscription, your account and scenario history are retained (so you can resume later) unless you specifically request deletion. Lender guideline documents and their extraction history are retained for audit and change-tracking purposes (see our automated guideline-monitoring feature) even after a program is updated or superseded.

5. Your Rights and Choices

• Access / export: you can request a copy of your account and scenario data by emailing admin@nonqmnexus.com.
• Correction: you can update your own account details at any time from your account settings.
• Deletion: you can request deletion of your account and associated personal data at any time by emailing admin@nonqmnexus.com. We will process deletion requests within a reasonable time, subject to any records we are legally required to retain.
• Marketing email: transactional emails (password resets, subscription confirmations, guideline-change alerts) are necessary to the Service and cannot be opted out of while your account is active. Separately, business contact outreach to lender Account Executives (see Section 10 below) is commercial email you can unsubscribe from at any time with one click, no account required.

6. Security

We use row-level security in our database so that one organization's data is never visible to another, restrict lender/program data uploads to platform administrators only, and use HTTPS/TLS for all traffic to the Service. No system is 100% secure, and we cannot guarantee absolute security of information transmitted to the Service.

7. Children's Privacy

The Service is intended for licensed mortgage professionals and is not directed to children under 18. We do not knowingly collect information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

9. Contact

Questions about this Privacy Policy, or to make a data access/deletion request: admin@nonqmnexus.com.

10. AE Directory & Business Contact Outreach

The Service maintains a directory of lender Account Executive (AE) business contact information — name, title, business email, business phone, licensed states, and NMLS ID where applicable. Sources for this information include: the AE's own free-form claim of their listing, admin-entered records compiled from a lender's own public wholesale/website materials, and, in limited cases, business contact information sourced from third-party business-contact research for the purpose of inviting an AE to claim their free listing.

• Directory visibility: a non-hidden AE profile's name, title, licensed states, and contact methods are visible to any user browsing the corresponding lender's page. We record aggregate, anonymous view/click counts on AE profiles (never who viewed or clicked) to power the AE's own stats dashboard.
• Sponsored placement: an AE may pay a flat monthly subscription for featured placement. This is advertising placement only — it never influences, and has zero effect on, any lender or program matching, eligibility determination, or ranking shown to a broker.
• Commercial email to AE contacts: we may email a lender AE contact (whether or not they have created an account) inviting them to claim their free directory listing, or, once claimed, sharing their own real usage statistics and the option of paid featured placement. Every such email includes a working one-click unsubscribe link and our business postal address, consistent with the CAN-SPAM Act. An unsubscribed address is permanently suppressed from all future commercial email from us.
• Removal on request: any AE (or someone acting on their behalf) may request removal of their business contact information from the directory, or correction of any inaccurate detail, at any time by emailing admin@nonqmnexus.com or clicking the unsubscribe link in any email we've sent them.

This policy is a working draft appropriate for the Service's current scope (no consumer PII, no live payment processing). It should be reviewed by a licensed attorney — and updated — before real payment processing, consumer-facing data collection, or operation in jurisdictions with specific privacy statutes (e.g. CCPA, GDPR) is enabled.