This Privacy Policy explains how Cleared2Close collects, uses, shares, protects, and retains information when you visit our website, create an account, use the lending CRM, invite team members, communicate with borrowers, referral partners, leads, or clients, upload files, connect integrations, or use public and embedded product features.
Information We Collect
We collect account information, lending team and business details, billing details, user profile data, CRM records, contacts, leads, referral partner records, notes, activities, tasks, loan pipeline records, campaign content, scheduling data, booking details, uploaded files, documents, signer data, signature audit events, videos, video view events, support messages, device and log data, integration settings, API keys or key hashes, security events, and other information you submit or authorize us to access.
Borrower, Lead, Referral Partner, Signer, and Viewer Data
Customer workspaces may contain personal information about borrowers, applicants, prospects, website leads, referral partners, real estate agents, document signers, email recipients, video viewers, and booking invitees. Customers are responsible for having a lawful basis to collect, upload, process, and communicate with those people through the service.
Loan Documents and Nonpublic Personal Information
Loan files and borrower portal uploads may include nonpublic personal information such as identity documents, income documents, asset statements, credit-consent records, mortgage statements, insurance records, underwriting conditions, and closing documents. We process this information to provide the requested CRM, portal, document, support, security, and audit functions. Customers are responsible for requesting only the documents they need, using appropriate notices and permissions, and avoiding unnecessary sensitive information.
How We Use Information
We use information to provide the service, authenticate users, provision workspaces, route leads, send requested communications, process billing, create reports and marketing assets, support e-signatures, host videos, process website and lead capture integrations, provide support, improve reliability, monitor usage and system health, detect abuse, secure accounts, investigate incidents, enforce terms, and comply with legal obligations.
AI Processing
When you use AI features, prompts, CRM context, report inputs, contact notes, borrower or referral partner context, uploaded text, draft outputs, and related metadata may be sent to the AI provider selected or configured for that feature. We do not sell customer CRM data, and we do not use customer pipeline, contact, report, or document content to train Cleared2Close's own generalized AI models. Third-party AI providers process data under their own API or business terms and data practices.
Google User Data
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
If you connect Google services, Cleared2Close uses Google user data only to provide the features you authorize. Gmail access is limited to sending email from your connected account. Calendar access is used to create events, check availability, and support Google Meet scheduling when requested. YouTube access is used to upload videos when you request it.
Microsoft User Data
If you connect Microsoft Outlook or Microsoft 365 services, Cleared2Close uses Microsoft user data only to provide the features you authorize. Microsoft Graph access is used to send email from your connected account, create and manage calendar events, check availability, support Microsoft Teams scheduling when requested, and maintain the connection through refresh tokens. We do not sell Microsoft user data or use it for advertising.
Sharing
We do not sell customer data. We share information with service providers only as needed to operate, secure, support, and improve the product, including hosting, database and storage providers, email delivery, payment processing, AI providers, analytics or aggregate usage tooling, support, security, monitoring, connected integrations authorized by you, and professional advisers. We may also disclose information if required by law, to enforce agreements, or to protect rights, safety, security, and service integrity.
Tracking, Email, and Video Events
The service can track email sends, opens, clicks, replies, lead page visits, video landing-page visits, video playback events, booking activity, and website return visits. These events help customers understand engagement and operate their CRM. Customers are responsible for providing notices and obtaining consent where required for tracking, marketing, or communications.
Data Retention
We retain information while your account is active and as needed for product operation, security, legal, billing, backup, audit, abuse-prevention, and dispute purposes. Account admins may request export or deletion of workspace data from Data & Privacy settings. Deletion requests are reviewed for billing, legal, security, signed-document, transaction, audit-log, and backup-retention requirements. Production backups may retain deleted data until the backup expires under the applicable backup schedule.
Security
We use administrative, technical, and organizational safeguards designed to protect customer data, including HTTPS, access controls, team scoping, application-level encryption for new borrower/contact document uploads, encryption for selected secrets and OAuth tokens, hashed new API keys, upload restrictions, audit logging, security headers, backups, and optional MFA. No system is perfectly secure, so you should use strong passwords, limit team access, enable MFA where appropriate, and promptly report suspected unauthorized access.
Your Choices
You can update account information, manage team members, disconnect integrations, rotate API keys, manage suppression lists, revoke public share links where available, export contacts or workspace data, and request deletion review. You can revoke Google access from your Google Account permissions page and Microsoft access from your Microsoft account permissions page at any time.
Regional Privacy Rights
Depending on your location, you may have rights to access, correct, delete, or receive a copy of certain personal information. Because customer workspace records often belong to the customer who collected them, requests from a customer's borrower, applicant, client, lead, referral partner, signer, or recipient may need to be directed to that customer first. We will assist customers with reasonable data requests as required by applicable law.
Children
Cleared2Close is intended for business use and is not directed to children under 13. Customers should not knowingly submit children's personal information unless they have authority and a lawful basis to do so.
Contact
Privacy questions and data requests can be sent to support@cleared2close.app.