← Back

PRIVACY POLICY: UCM PLATFORM (MORTGAGE MECHANIC CRM & REALTOR PLATFORM)

VERSION: 5.0 (UNIFIED)

EFFECTIVE DATE: 2026-09-29

GOVERNING LAW: Delaware

SCOPE: This Privacy Policy describes how the Company collects, uses, shares, retains, and deletes information in connection with the Mortgage Mechanic CRM and the Realtor Platform (the "Platform"). It applies to Business Users (mortgage originators, real estate brokerages, agents, and teams that license the Platform) and to visitors of the Company's websites. It replaces any prior Privacy Policy for the CRM or the Realtor Platform.

NOT LEGAL ADVICE. This is a drafting document prepared by the Company's business and engineering functions. It must be reviewed and finalized by qualified counsel and reconciled with the Data Processing Addendum (the "DPA") and the separate Consumer Terms of Use and Privacy Notice (which governs consumers who use consumer-facing surfaces such as the EMD portal, magic links, the borrower passport, and the wiring-instruction display) before it governs live use. Where this Policy and the DPA conflict as to processing personal information on behalf of a Business User, the DPA controls. Where this Policy and the Consumer Terms conflict as to a consumer, the Consumer Terms control.

1. WHO IS RESPONSIBLE (ROLES)

1. Business Users are the controllers. For the personal information a Business User enters or uploads about its clients, leads, and contacts (its "Business Data"), the Business User is the controller and the Company is a processor/service provider acting on the Business User's instructions, subject to the DPA.

2. Consumers. For consumers who use a consumer-facing surface, the Company may act as a controller for the limited purposes described in the Consumer Terms, and the Business User remains responsible for its own collection and use.

3. The Company as controller. For Business User account and billing data, website visitors, and Platform usage/telemetry, the Company is the controller.

2. INFORMATION WE COLLECT

1. Business User account data: name, business name, email, phone, license/NMLS numbers, billing information, and credentials.

2. Business Data (on behalf of a Business User): contact records (client/lead names, emails, phones), deal records, documents, messages, notes, and related operational data the Business User enters or uploads.

3. Consumer data (consumer-facing surfaces): information a consumer provides directly - identity-verification data via our verification providers, bank-link tokens and masked account data via our payment/identity processor, transfer instructions, and contact details. The Platform orchestrates transfers outbound to a third-party escrow account; it does not take custody of, hold, or control consumer funds.

4. Usage and device data: log data, IP address, device/user-agent, and feature-usage events, used for security, support, and improvement.

5. Communications metadata: delivery records, suppression/opt-out status (e.g., STOP), and quiet-hours decisions, recorded on the Platform's tamper-evident ledger.

We do not intentionally collect special-category data, and Business Users must not upload data the law prohibits them from processing.

3. HOW WE USE INFORMATION

We use information to provide, secure, support, and improve the Platform; to authenticate users; to transmit messages and instructions only on an explicit human action by an authorized Business User; to enforce compliance controls (suppression, quiet hours, consent-basis gating); to prevent fraud and abuse; to bill; and to comply with law. We do not sell personal information.

4. AGGREGATED, DE-IDENTIFIED, AND BENCHMARK DATA (DERIVED DATA)

1. Creation and use. The Company creates Derived Data - aggregated, de-identified, anonymized data such as benchmarks, scoring models, market intelligence, and analytics - from data generated by or in connection with use of the Platform.

2. Perpetual right. As described in the Terms of Service (§9.3), the Business User grants the Company a perpetual, irrevocable license to create and use Derived Data, including after termination, for any lawful business purpose, including the operation, improvement, and commercialization of the Platform. This right survives termination and is unaffected by deletion of Business Data.

3. K-anonymity floor. Derived Data is bound by a k-anonymity floor of k = 5 (a minimum cohort of five) to prevent subtraction attacks and re-identification. The Company may suppress, obscure, or deny any output that falls below the threshold, and performs and documents periodic re-identification testing against the floor. The Company does not attempt to re-identify any individual from Derived Data and binds its sublicensees to the same covenant. Derived Data excludes any individual-level personal information and any data from which a reasonable recipient could re-identify a person, and "usage signals" excludes identifiable client identifiers.

4. No per-referral sale. Aggregated, de-identified outputs are never sold or priced on a per-referral or per-consumer basis. Derived Data is the Company's property; see Terms of Service §9.4.

5. De-identified data is not personal information under applicable privacy law to the extent permitted by law, and is not subject to the DPA's restrictions on the Company's use.

5. HOW WE SHARE INFORMATION

We share information only as needed:

We do not share Business Data with other tenants. Multi-tenancy is enforced by per-organization scoping and database row-level security as a backstop.

6. MESSAGING AND CONSENT

The Platform's messaging features are controlled by the Business User, which is the sender and initiator and is solely responsible for obtaining TCPA-compliant consent (see Terms of Service §5). The Company does not obtain or verify consumer consent to messaging on a Business User's behalf. Consumers may reply STOP to opt out or HELP for help; STOP is recorded as a per-number suppression and is blocked. The Platform applies quiet-hours and suppression controls as commercially reasonable software controls; a message the controls block is not auto-released when the permitted window next opens - re-sending requires a deliberate new human action by the Business User during approved hours. Every decision is recorded on the tamper-evident ledger.

7. SECURITY

The Company maintains an information-security program with administrative, technical, and physical safeguards designed to meet the GLBA Safeguards Rule and applicable state law, including encryption of per-tenant secrets at rest, tenant isolation, access controls, and tamper-evident ledgers. No method of transmission or storage is completely secure.

8. RETENTION

We retain Business Data for the term of the Business User's agreement and as needed for the purposes described here. We retain:

9. YOUR RIGHTS (ACCESS, CORRECTION, DELETION)

1. Business Users. A Business User may access, correct, export, and request deletion of its Business Data as described in the Terms of Service and the DPA. On termination, the export boundary and any exclusions are defined in Terms of Service §10.2.

2. Consumers. A consumer may exercise rights (access, correction, deletion, and, where applicable, the right to know and to opt out of sharing) through the Consumer Portal or by contacting the Company. Consumer requests are processed under the GLBA, the CCPA/CPRA, and other applicable law.

3. Deletion and chain integrity. Where the Company must preserve a record in a tamper-evident ledger, it effects deletion by cryptographic erasure or equivalent means designed to render the underlying personal information irrecoverable from the live system and from the ledger while preserving chain integrity. In the current implementation, this is performed by tombstoning - overwriting the identifying fields with a sentinel marker (the Platform writes the literal sentinel `[erased]` over direct identifiers such as name, email, and phone, and stamps an erasure reference and timestamp). The Company applies the same standard to replicas and backups on a rolling basis consistent with its backup-retention window.

Honest limitation (stated deliberately): the current implementation performs a tombstone/overwrite in the live system; a per-subject-key crypto-shred that also renders archival backups irrecoverable is a planned enhancement. Until it lands, deletion is reliable in the live system, a deleted record will not be restored into live use, and a copy in an archival backup is overwritten on the next cycle - but a copy may persist in a backup until it ages out of the retention window. The Company does not represent a stronger deletion guarantee than stated here, and the Terms of Service (§4.1) expressly defers to this Policy on the strength of that guarantee.

4. Non-waiver. Nothing in the Terms of Service waives any right of a consumer who is not a party to it.

10. CHILDREN

The Platform is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13.

11. CHANGES

We may update this Policy. Material changes will be notified as required by law and the DPA. The version and effective date are shown above.

12. CONTACT

Privacy inquiries: UCM Platform, Attn: Privacy, [email protected] (a physical address is available on request).

*Companion documents: Terms of Service (v5.0, unified), the Data Processing Addendum, and the Consumer Terms of Use and Privacy Notice. This Policy must be reviewed by counsel before live use.*