Privacy Policy

Last updated: 10/04/2026

Nymble Digital, LLC ("Company," "we," "us," or "our") operates MortgageeClauses.com ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

1.1 Account Information

When you create an account we collect: first name, last name, email address, occupation (role), and employer or agency name. For paid plans, billing is processed by Stripe; we do not store full card numbers. We record when you accept our Terms and Privacy Policy (accepted_terms_at, terms_version).

1.2 Usage Data

We use Plausible Analytics on our public site (production hostnames) to understand aggregate traffic: page views and custom events such as searches. Plausible is cookieless for visitors, does not use personal data for cross-site tracking, and provides EU-hosted aggregate statistics. We do not send your email or other account identifiers to Plausible from the browser.

We also run first-party analytics on our own infrastructure: page views, lender page views, searches (including whether results were empty), clause pulls when you are signed in, favorites, billing funnel steps, and similar product events. We store a random first-party identifier in your browser (mc_anon_id in localStorage) for anonymous traffic unless you send Do Not Track (DNT), in which case we skip anonymous client beacons. We do not use advertising networks or cross-site trackers. For requests through Cloudflare, we may record country and a coarse device class on event records. Signed-in activity is linked to your account ID, not sold or used for ads.

1.2a Sign-in and security logs

When you sign in with a magic link, we append a row to our sign-in log with the time, sign-in method (magic link), and the IP address Cloudflare reports for the request. We do not store a full browser user agent string in that sign-in log. Separately, our first-party events table may store a browser user agent string on some product events (for example to filter automated traffic in internal reporting). Staff with admin access can view recent sign-in times, method, and IP for member accounts. We retain these records while useful to operate the Service, investigate abuse, and protect accounts, and delete or trim them when no longer needed.

1.3 Search & Activity Data

We log search queries, clause views, copy actions, and feature usage to improve the Service and personalize your experience (saved favorites, recent searches). This data is associated with your account.

1.4 Community Submissions

If you submit a clause or correction: lender name, address, clause text, source URL, and your account identity for attribution and verification.

1.5 Communication Data

If you contact us via email or a support form, we retain the content of those communications to respond and improve support.

2. How We Use Your Information

• Provide, operate, and maintain the Service
• Process transactions and manage your subscription
• Send service-related communications (confirmations, receipts, security alerts)
• Send optional marketing communications (weekly digest — opt out anytime)
• Improve and personalize the Service
• Verify community-submitted clause data
• Detect and prevent fraud, abuse, or unauthorized access (including reviewing sign-in logs)
• Notify internal staff of new sign-ups (see sharing below) so we can support and review accounts
• Comply with legal obligations
• Enforce our Terms of Service

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information with:

• Stripe: Payment processing (PCI-DSS compliant)
• Plausible Analytics: Aggregate, cookieless website analytics (EU-hosted)
• First-party analytics: Product usage events on our servers (see above)
• Postmark (ActiveCampaign): Transactional email (magic sign-in links, billing notices)
• Cloudflare Turnstile: Bot protection on sign-in and sign-up (short-lived tokens)
• Cloudflare: Hosting, CDN, and DDoS protection
• Discord Inc.: When you complete sign-up, we may post your name, email, occupation (role), and employer to a private internal channel so our team can review new accounts
• Quo (OpenPhone): When enabled, we may send the same new-member summary (name, email, occupation, employer) as a text message to designated staff phones for sign-up alerts
• Legal compliance: When required by law, subpoena, or court order
• Business transfers: In connection with a merger, acquisition, or asset sale, with notice to affected users

4. Cookies & Tracking

We use strictly necessary cookies only. See our Cookies page for details. In summary:

• Session cookie (mc_session): HttpOnly cookie that keeps you signed in after you use the email magic link (typically up to 30 days). There is no separate “Remember me” control.
• Plausible Analytics: Cookieless aggregate analytics on production pages; no persistent third-party analytics cookies for visitors. See our Cookies page.
• Analytics ID (mc_anon_id in localStorage): Random first-party ID for anonymous usage metrics on our servers. Not set when DNT is enabled.
• Cloudflare Turnstile: May set short-lived cookies or similar storage for bot detection on auth forms.

We do not use advertising cookies or third-party marketing trackers.

5. Do Not Track Signals

We honor Do Not Track (DNT) browser signals by skipping anonymous client-side analytics beacons. Signed-in product features still work the same.

6. Data Retention

• Active accounts: Data retained for the life of your account
• Deleted accounts: Personal data removed within 30 days of deletion request, except where retention is required by law
• Billing records: Retained for 7 years per tax and accounting requirements
• Community submissions: Verified clause data remains in the database after account deletion but is anonymized (no attribution)
• Usage and event logs: Retained while useful to operate, secure, and improve the Service; deleted or anonymized when no longer needed
• Sign-in log: Retained while useful for security and support; we trim older entries over time (staff tools show recent sign-ins per account)

7. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS / HTTPS)
• Application data stored in Cloudflare D1 and related Cloudflare infrastructure, which encrypts data at rest per Cloudflare’s platform documentation
• Cloudflare WAF and DDoS protection
• Access controls restricted to authorized personnel
• Dependency updates and monitoring as part of normal engineering operations
• No storage of full credit card numbers (handled entirely by Stripe)

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your personal data — use Account → Delete account or email us
• Export your data — email support@mortgageeclauses.com with “Data export”
• Object to certain processing activities
• Restrict processing in certain circumstances

To exercise any of these rights, email support@mortgageeclauses.com. We will respond within 30 days.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information
• Right to Opt Out: We do not sell or share personal information for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Right to Correct: You may request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by the CPRA

To make a verifiable consumer request, email support@mortgageeclauses.com with "CCPA Request" in the subject line.

10. Other State Privacy Laws

Texas (TDPSA), Oregon (OCPA), Florida (FDBR)

Residents of Texas, Oregon, and Florida may have rights to access, delete, correct, and obtain a copy of personal data, and to opt out of certain processing. We do not sell personal data. Contact support@mortgageeclauses.com to exercise applicable rights.

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA)

Residents of Virginia, Colorado, and Connecticut have similar rights. We honor these rights consistent with applicable law. Email support@mortgageeclauses.com.

Nevada

Nevada residents may opt out of the sale of covered personal information. We do not sell personal information as defined by Nevada law. Email support@mortgageeclauses.com.

11. International Users

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We do not currently offer GDPR-specific data processing agreements, but we apply the same privacy protections to all users regardless of location.

12. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, contact support@mortgageeclauses.com.

13. Email Communications (CAN-SPAM)

We comply with the CAN-SPAM Act. All marketing emails include an unsubscribe link. We process unsubscribe requests within 10 business days. Transactional emails (account confirmations, billing receipts, security alerts) are not marketing and cannot be opted out of while your account is active.

14. Third-Party Service Providers

We use the following third-party providers that may process your data:

• Cloudflare (Pages, Workers, D1, CDN): Hosting, application database, and content delivery — processes IP addresses for request routing and security
• Plausible Analytics: Aggregate website analytics — cookieless, EU-hosted statistics
• Stripe: Payment processing — processes billing information under their own privacy policy
• Postmark: Transactional email delivery
• Cloudflare Turnstile: Bot protection on authentication flows
• Discord Inc.: Internal staff notifications for new sign-ups (name, email, occupation, employer)
• Quo (OpenPhone): Optional SMS alerts to staff for new sign-ups (same fields as Discord alerts)

Each provider has their own privacy policy and is bound by data processing agreements where applicable.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on the Service at least 30 days before taking effect. Your continued use constitutes acceptance. We encourage you to review this page periodically.

16. Contact

If you are not satisfied with our response to a privacy concern, you may have the right to lodge a complaint with your local data protection authority.