Legal

Privacy Policy

Last updated: October 7, 2026

This Privacy Policy describes how LendEC (“LendEC,” “we,” “us”) collects, uses, and protects information when you use the LendEC website and services (the “Service”).

Information we collect

Account information. When you create an account, we collect your email address, an optional name, and a password. Passwords are never stored in plain text — we store only a bcrypt hash. Account records are kept in a PostgreSQL database hosted on Render.

Authentication data. To keep you signed in, a short-lived JWT access token is stored in your browser's localStorage, and a refresh token is stored in an httpOnly cookie. Email verification and password-reset links use single-use tokens; we store only a SHA-256 hash of those tokens server-side, never the token itself.

Usage & activity analytics. We record first-party product analytics to understand how the Service is used and to improve it. We do not use third-party advertising trackers. A lendec_event record may capture events such as page, market, and ZIP views, searches, watch actions, signup-funnel steps, and encounters with locked capabilities, along with optional market or ZIP context. These events are associated with a per-browser session identifier stored in your browser's localStorage (lendec_session_id).

Marketing attribution. If you arrive via a campaign link, we store first-touch campaign and UTM parameters in your browser's localStorage (lendec_campaign) and may link that attribution to your account when you sign up, so we can understand how people discover LendEC.

IP address. We use your IP address transiently for security purposes — rate-limiting and anti-harvesting protections — and it may appear in request logs. We do not use it to build an advertising profile.

Communications. If you email us or submit a request (for example, a privacy or access request), we collect the information you choose to provide so we can respond.

About public-record & property data

Separately from the information above, LendEC aggregates public and open records about properties — including parcels, recorded owners and entities, transactions, and filings. This property data is about real estate and the public record, not about website visitors, and it is not collected from your use of the Service. See our Data & Investment Disclosures for how we treat it.

Service providers

We rely on a small set of providers to operate the Service:

• Render — application hosting and our PostgreSQL database.
• A transactional email provider (such as Resend or an SMTP service), when configured, to send verification and account emails.
• AI providers (Anthropic and/or OpenAI) used to generate market-intelligence summaries. We do not send these providers your password or authentication tokens.

How we use information

We use the information above to provide and secure the Service, authenticate you, respond to your requests, measure and improve product usage, understand how people discover LendEC, and protect against abuse and automated harvesting. We do not sell your personal data, and we make no formal compliance certification claims.

Data retention

We retain account and activity information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify associated personal information within a reasonable period, except where retention is required.

Security

We protect information using measures appropriate to its sensitivity, including bcrypt password hashing, hashed (never plaintext) verification and reset tokens, and encrypted transport (HTTPS). No system is perfectly secure, so we cannot guarantee absolute security.

Your choices & privacy rights

You can review and update your account details and manage watches and preferences from within the product. You may request access to, or deletion of, your personal information by emailing privacy@lendec.com or via our Contact page. Residents of certain U.S. states may have rights to access or delete personal information; we honor reasonable requests regardless of where you live. This is a general description and not a claim of compliance with any specific statute.

Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time; when we do, we will revise the “Last updated” date above. Material changes may be communicated through the Service.

Contact

Privacy questions and requests: privacy@lendec.com. See also our Contact & Support page.

This document is a draft provided for transparency and is not legal advice. See our Terms of Use and Disclosures.