Privacy policy

Ferrylend (the "service") is a customer relationship management platform for lending companies, operated by Digital Mundo LLC ("Digital Mundo", "we", "us"). This policy explains how we handle personal information on our website at ferrylend.com and in the service.

We handle personal information in two different roles, and this policy covers both:

• As a controller for information about our own website visitors, prospects and the users of our customers' accounts (for example your name, email and sign-in activity).
• As a processor (service provider) for the information our customers put into the service about their own merchants, business owners, guarantors and contacts ("Customer Data"). Our customer decides what Customer Data to collect and why; we process it only to provide the service under our Terms of service and Data processing addendum.

If you are a merchant or business owner whose information a lending company stores in the service, that company's privacy notice governs how it uses your information. Please contact them first; we will help them respond to you.

Information you give us

• Website forms: when you request access, book a demo, contact us or apply to our partner program, we collect your name, work email, company, phone number (optional), and what you tell us in the message.
• Account information: users' names, email addresses, phone numbers, roles and password hashes (never the password itself).
• Support conversations: what you send us by email or through the contact form.

Customer Data

Customers use the service to manage leads, merchants and deals. Depending on how a customer uses it, Customer Data can include business details (name, address, EIN, industry, revenue), owner and guarantor details (name, contact details, ownership percentage, Social Security number, date of birth, driver's licence number, credit score), bank statements and financial figures, bank routing and account numbers, applications, signed documents, notes, emails and tasks.

Merchants can also submit an application through a customer's application link. We receive that application on the customer's behalf, including the consent text the merchant agreed to.

Information collected automatically

• Logs and audit records: IP address, browser user agent, the time of a request, and the actions taken in the service (for example sign-ins, exports, document downloads and record changes).
• Cookies: only the cookies the service needs to work: a session cookie that keeps you signed in and a security token that protects forms against cross-site request forgery. We also remember your light or dark theme choice in your browser's local storage.

We do not use advertising cookies, third-party analytics, tracking pixels or cross-site tracking on the website or in the service.

• To provide, maintain and secure the service, including authenticating users, enforcing permissions and keeping audit records.
• To set up accounts, respond to requests and give support.
• To send service messages, such as invitations, notifications and important changes to the service or these policies.
• To understand which features are used so we can improve the service, using our own records rather than third-party analytics.
• To detect, investigate and prevent abuse, fraud and security incidents.
• To comply with law and enforce our agreements.

We use Customer Data only to provide the service to the customer that owns it and as that customer instructs. We never use Customer Data to market to your merchants or to compete with you, and we do not combine one customer's data with another's.

AI bank statement parsing is off unless a customer turns it on. When it is on, the statements a user chooses to parse are sent to our AI provider (Anthropic) to extract monthly figures, and the results are stored in that customer's workspace. We do not use Customer Data to train AI models, and we choose AI providers whose commercial terms do not permit them to train on it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only:

• With service providers (subprocessors) that host and run the service for us, under contracts that limit their use of it. The current list is in our Data processing addendum.
• At our customer's direction: for example, when a user sends a submission package to a lender, the service delivers the information that user chose to send.
• When required by law, such as a valid subpoena or court order. Where we can, we will tell the affected customer first.
• To protect the rights, safety and property of our customers, users, the public or us.
• In a business transfer, such as a merger or sale of assets, under a confidentiality commitment and subject to this policy.

Many of our customers are lending companies and may be subject to the Gramm-Leach-Bliley Act (GLBA) and similar state laws. When we process nonpublic personal information for those customers, we act as their service provider: we use it only to perform the service, we do not disclose it except as described in this policy and our agreements, and we maintain the administrative, technical and physical safeguards described on our Security page.

We keep Customer Data for as long as the customer's account is active. After an account ends, the customer can export its data, and we delete Customer Data within a reasonable period afterwards, except where we must keep it to comply with law or resolve disputes. Audit records are kept for as long as the related workspace exists.

We keep website form submissions and support messages for as long as they are useful to answer you and keep a record of our conversations, and we delete them on request where the law allows.

We protect personal information with measures that include field-level encryption of the most sensitive values (such as Social Security and bank account numbers), masked display with audited reveal, role-based access, tenant isolation, HTTPS everywhere and an append-only audit log. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Our Security page describes our measures in detail, including what we have not built yet.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of certain uses. Residents of California and other US states with privacy laws can exercise these rights by contacting us; we will not discriminate against you for doing so.

To make a request about information we control, email support@ferrylend.com. We will verify your request and respond within the time the law requires. If your request concerns Customer Data (for example, you are a merchant whose details a lending company stored), we will pass it to that company and help them respond.

You can stop receiving non-essential emails from us at any time by replying to say so or using the unsubscribe link in the email. Service messages about your account are part of the service.

The service is for businesses. It is not directed to children under 16, and we do not knowingly collect their personal information.

We are based in the United States, and we store and process information in the United States. If you use the service from elsewhere, your information will be transferred to and processed in the United States.

We will update this policy as the service changes. The date at the top shows the latest version. If we make a material change, we will tell customers by email or in the service before it takes effect.

Questions about this policy or your information: support@ferrylend.com, or use our contact form. Digital Mundo LLC operates Ferrylend.