Privacy Policy

Loandock is an AI loan processor. Clara builds and pre-underwrites the file, submits it to the lender, and works the conditions that come back.

This policy covers two kinds of information: what you give this website, and the borrower information Loandock handles on behalf of a lender client. The terms of service are a separate document, at loandock.com/terms.

Information you provide

We collect information you give us directly, such as your name, email address, phone number, and other contact details when you book a walkthrough, contact us, or request security documentation.

Information we collect automatically

We collect information about you automatically when you use this website. That may include your IP address, device type, browser type, operating system, and how you moved through the site.

Information from other sources

We may receive information about you from other sources, including partners, service providers, and publicly available sources, and combine it with what we already hold.

When a lender engages Loandock, Loandock handles borrower documents and loan-file data inside the lender's own system, under the lender's instructions and its own agreements with the borrower. The lender's LOS stays the system of record. Our written information security policy sets the requirements for handling that data. The controls below come from that policy.

• The workflow runs on managed cloud services in United States regions only. No borrower information is stored or processed outside the United States, and no offshore labour touches it.
• Access is least privilege and need to know, tied to a named person, with no shared logins, and multi-factor authentication on every system that reaches borrower information.
• Borrower information is encrypted in transit and encrypted at rest. Credentials for a lender system are held in an encrypted secrets manager, never in plain text.
• Live borrower data is never used in development or testing.
• Commercial providers used for document handling operate under enterprise terms that contractually prohibit training on submitted data, and that processing runs in United States regions. Loandock does not train on client data, and no borrower document is used to train a model.
• Every automated action is logged with a timestamp, the actor, and the loan file it affected, and the log is available to the lender for audit. Borrower messages are logged the same way.
• A current subprocessor list is available to clients on request.

• Information moves over encrypted connections and is encrypted at rest.
• Access is limited to named people with a business need, under least privilege, with multi-factor authentication on every system that holds or reaches restricted data.
• Production is separated from development and test.
• Backups are encrypted and access-controlled the same way production is.
• Staff take security awareness training, including social engineering and wire-fraud recognition, at onboarding and every year.
• If an incident involves a client’s data, that client is notified without unreasonable delay and no later than 72 hours after the incident is confirmed, with a documented root cause and corrective actions within 30 days.

Loandock works to GLBA and the FTC Safeguards Rule, to the TCPA and state quiet-hours rules for messaging, and to the client's own obligations. The written information security policy and supporting due-diligence documentation are available on request. More is on the security page.

Loandock keeps borrower and loan-file information only as long as it needs it to perform the service and to meet the client's own regulatory retention obligations, or as the client directs. The periods below are the ones in the signed information security policy, and retention details are also available on the security page and the SMS policy.

Marketing attribution data stored in your browser expires after 90 days. The Analytics and cookies section explains what we store and which details are shared with analytics and scheduling providers.

• Email support@loandock.com with a deletion request.
• We verify your identity and process the request within 30 days.
• Some information is kept where the law, or a client’s own regulatory retention obligation, requires it.

If Loandock holds your information as a borrower on a lender's file, that lender directs what is kept and what is deleted. A request you make to Loandock is passed to the lender whose file it is.

California residents may exercise additional rights under the CCPA, including the right to know what personal information is collected and the right to opt out of the sale of personal information. We do not sell personal information.

• Service providers: with vendors who perform services on our behalf, such as hosting, analytics, and support.
• Legal compliance: when required by law, legal process, or a government request.
• Business transfers: in connection with a merger, acquisition, or sale of assets.
• With your consent: when you have given us explicit permission to share it.

We do not sell your personal information. We do not share mobile information with third parties for promotional or marketing purposes.

Loandock sends transactional follow-up messages about an active loan file: the documents a condition needs, a follow-up on a document that has not arrived, and the status of what was received. Loandock does not send marketing or promotional texts, and Loandock does not place phone calls.

Your mobile information will not be sold or shared with third parties for promotional or marketing purposes. All the categories above exclude text messaging originator opt-in data and consent; that information is not shared with any third party.

We will not share your opt-in with any third party for purposes unrelated to providing the messages you consented to. We share consent status only with the providers that deliver those messages, including phone carriers and messaging vendors.

Message frequency varies. Standard message and data rates may apply. Reply STOP to opt out. Reply HELP for help. Consent is not a condition of purchase. The full detail is on the SMS policy.

Google Analytics

This website uses Google Analytics to analyse how visitors interact with it. Google Analytics uses cookies to collect page activity, device information, and website events, including confirmed walkthrough bookings. You can opt out by installing the Google Analytics opt-out browser add-on.

LinkedIn Insight Tag

On our marketing pages we use the LinkedIn Insight Tag to measure advertising performance and understand which campaigns lead to a booked walkthrough. It uses cookies and similar technologies and may collect your IP address, page activity, and device information. It runs only on our public marketing pages, never on any borrower or loan-file screen. You can control LinkedIn ad tracking in your LinkedIn advertising settings.

Marketing attribution

To understand which marketing channels bring visitors to us, we store campaign tags, a LinkedIn click identifier when present, landing page, referring domain, and visit timestamps in your browser for up to 90 days. Selected campaign and visit details are sent to Google Analytics when a booking is confirmed. Campaign tags are also passed to our scheduling provider. The confirmation event does not include booking form answers, names, email addresses, phone numbers, or borrower information. You can clear this stored data through your browser settings.

PostHog product analytics and session replay

We use PostHog to understand how the public site is used. It records the pages you visit, clicks, scrolling, the device and browser you use, your approximate location from your IP address (country, region and city), the site that referred you and any campaign tags, under a random visitor identifier stored in a cookie. It can also record a replay of your visit to the public site so we can see where pages are confusing. Anything you type into a form or into Ask Clara is masked in replays, and replay never runs on borrower or loan file screens. If you give us your email through the site, your earlier visits are linked to it so we can follow up. PostHog is hosted in the United States. See the PostHog privacy policy. Visitors in the European Economic Area and the United Kingdom are asked before any of this runs, and can decline.

Ask Clara

Questions you type into Ask Clara, and the answers, are sent to our AI provider to generate a reply and are kept with your visit record so we can improve the answers and follow up if you ask us to. Do not enter borrower information or loan file details into Ask Clara. Nothing you type there is used to train AI models.

Server logs

Our hosting provider keeps request logs for 30 days. Our own event log stores a hashed form of your IP address, not the address itself, together with the page, event name, approximate location and device type.

Your choices

You can clear or block cookies in your browser at any time. To opt out of analytics, session replay and advertising measurement on this site, or to ask what we hold about you and have it deleted, email privacy@loandock.com with the subject line "Do not share my information". We do not sell personal information. Sharing site activity with LinkedIn for advertising measurement may count as sharing under some state laws; the same email opts you out of it.

Scheduling

We use Cal.com to schedule walkthroughs. Contact details and answers you enter in the booking form are shared with us to arrange your meeting. See the Cal.com privacy policy for how the scheduling service handles that information.

We update this policy as the service changes. The date at the top of the page is the date of the version you are reading.

Questions about this policy, or about the information we hold, go to support@loandock.com. The terms of service are at loandock.com/terms.