Privacy Policy

LeadSharq is a customer relationship management (CRM) service for mortgage companies, operated by LeadSharq LLC (“we”, “us”). This policy explains what information the service holds, why, and how it's protected.

Who is responsible for borrower information

Each mortgage company that uses LeadSharq (our “customer”) decides what borrower information it puts into the service and how it's used. The customer is the financial institution responsible for that information under the Gramm-Leach-Bliley Act (GLBA) and other laws that apply to it. We process borrower information only on the customer's behalf and under its instructions, as a service provider. Borrowers with questions about their information should contact the mortgage company they worked with.

What the service stores

• Borrower lead information entered or sent by the customer: name, phone, email, city, state, ZIP, loan purpose and type, a rough loan amount, price range, down payment, a self-reported credit range, timeline, veteran or military status, and notes. With each lead: where it came from, the borrower's consent to be contacted (when and how it was given), and whether the borrower asked not to be contacted. Phones and emails that asked not to be contacted are kept on the customer's do-not-contact list.
• Pre-application answers: current address, marital status, a co-borrower's name, phone and email, the property's type, use, city and state, its price or value, the current mortgage rate, employment type and employer, monthly income, assets, a yes-or-no for a recent bankruptcy or foreclosure, and VA service details (branch, prior VA use, and whether there is a current VA loan).
• Work history: contacts logged, follow-ups, rate watches, assignments, the history of changes, and the loan number from the customer's loan origination system once an application is submitted.
• Users' account information: the customer's staff names, work emails, phone numbers, roles, NMLS IDs and licensed states; sign-in and availability history, with device type and browser; and security settings such as two-factor authentication.

The CRM's own sign-in history doesn't record IP addresses. Our sign-in and hosting providers log IP addresses for security, and to stop password guessing we keep failed sign-in attempts for up to one day as a one-way keyed code made from the email and IP address, never the address itself.

What the service never stores

• Social Security numbers, dates of birth, or bank, card or other financial account numbers.
• The property's street address.
• Any information about a disability or health condition.

The database refuses any field outside the lists above. Free-text notes can't be checked automatically, so our Terms of Service require users never to enter this information there. Because the service never holds a Social Security number or the property address, it cannot hold a complete mortgage application; applications are taken in the customer's loan origination system.

How information is used

Only to provide the service to the customer: routing leads to its licensed loan officers, reminders and follow-up, reporting to its managers, and keeping the service secure and working. We don't sell borrower information, use it for our own marketing, or share it with other customers.

Service providers we use

• Supabase (database and sign-in), hosted in the United States (US East).
• Vercel (application hosting), with the application running in the United States (US East).
• Resend (sending account emails: invitations, password resets, account-change notices, and optional follow-up reminders). Reminder emails give only counts and never name a borrower.
• Sentry (error reports). Before a report leaves our servers or a user's browser, we remove request contents, cookies and headers, mask email addresses and phone numbers anywhere in it, and filter fields such as names, addresses and notes; a report identifies a user only by an internal ID. Sentry is set not to store IP addresses.

Each processes information only to provide its part of the service.

Security

• Two-factor authentication: always required for administrators and for anyone who has set it up, and on by default for every user of a new company (a company administrator can change that setting).
• Encryption in transit (HTTPS) and at rest.
• Strict separation between customers: every record belongs to one company, and the database itself prevents one company's users from seeing another company's data. Our own platform administrators can reach every company's data, only to operate and support the service.
• Access by role: loan officers see the leads assigned to them, plus a limited view of unclaimed leads they can claim (without phone, email or address); managers see their team's leads, or the whole company's if they lead no team; administrators see their company's.
• An audit history of administrative changes, and daily backups.

These measures are designed to support customers' obligations under the FTC Safeguards Rule.

Retention and deletion

• Customer data is kept while the customer uses the service.
• Sign-in and availability history: for a period the customer sets, 12 months by default (1 to 36 months).
• In-app notifications: 30 days. Failed sign-in attempts and lead-delivery receipts: one day.
• Daily backups: 7 days.

When a customer's subscription ends, we provide an export of its data on request within 30 days, then delete its data within 30 days after that. Copies in backups roll off within 7 days after deletion.

If something goes wrong

If we learn of unauthorized access to information in the service, we will notify the affected customer without undue delay, and no later than 72 hours after we confirm a breach affecting its data, and help it meet its own notification duties.

Changes to this policy

We email customers at least 30 days before a material change to this policy. Every change updates the “Last updated” date above.

Contact

Privacy questions: hello@leadsharq.com.