Privacy Policy

Last updated: March 31, 2026

Nymble Digital, LLC ("Company," "we," "us," or "our") operates MortgageeClauses.com ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

1.1 Account Information

When you create an account: name, email address, organization name, and role/title. For paid plans, billing information is collected through Stripe. We do not store full credit card numbers.

1.2 Usage Data

We use Plausible Analytics, a privacy-friendly, cookie-free analytics tool. Plausible collects aggregate data only: page views, referral sources, browser type, device type, and country-level location. This data cannot identify individual users. No personal data is transmitted to Plausible.

1.3 Search & Activity Data

We log search queries, clause views, copy actions, and feature usage to improve the Service and personalize your experience (saved favorites, recent searches). This data is associated with your account.

1.4 Community Submissions

If you submit a clause or correction: lender name, address, clause text, source URL, and your account identity for attribution and verification.

1.5 Communication Data

If you contact us via email or a support form, we retain the content of those communications to respond and improve support.

1.6 Referral Data

If you use the referral program, we track the referral link, the referred user's signup, and the earned rewards for both parties.

2. How We Use Your Information

• Provide, operate, and maintain the Service
• Process transactions and manage your subscription
• Send service-related communications (confirmations, receipts, security alerts)
• Send optional marketing communications (weekly digest — opt out anytime)
• Improve and personalize the Service
• Verify community-submitted clause data
• Detect and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations
• Enforce our Terms of Service

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information with:

• Stripe: Payment processing (PCI-DSS compliant)
• Plausible Analytics: Aggregate, non-personal usage data only
• Cloudflare: Hosting, CDN, and DDoS protection (data processing agreement in place)
• Email service provider: For transactional and marketing emails (weekly digest)
• Legal compliance: When required by law, subpoena, or court order
• Business transfers: In connection with a merger, acquisition, or asset sale, with notice to affected users

4. Cookies & Tracking

We use minimal, strictly necessary cookies:

• Session cookie: Maintains login state (expires at session end or 30 days with "Remember me")
• Preferences cookie: Stores display preferences (billing toggle, theme)

We do not use advertising cookies, tracking pixels, fingerprinting, or any third-party marketing trackers. Our analytics provider (Plausible) is 100% cookie-free and GDPR/CCPA compliant by design.

5. Do Not Track Signals

We honor Do Not Track (DNT) browser signals. Since we do not use tracking cookies or third-party advertising trackers, our Service functions identically regardless of your DNT setting.

6. Data Retention

• Active accounts: Data retained for the life of your account
• Deleted accounts: Personal data removed within 30 days of deletion request, except where retention is required by law
• Billing records: Retained for 7 years per tax and accounting requirements
• Community submissions: Verified clause data remains in the database after account deletion but is anonymized (no attribution)
• Usage logs: Aggregated and anonymized after 90 days

7. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS 1.3 / HTTPS everywhere)
• Encryption at rest for sensitive data
• Cloudflare WAF and DDoS protection
• Access controls restricted to authorized personnel
• Regular security audits and dependency updates
• No storage of full credit card numbers (handled entirely by Stripe)

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your personal data ("right to be forgotten")
• Opt out of marketing communications at any time
• Export your data in a portable format (JSON or CSV)
• Object to certain processing activities
• Restrict processing in certain circumstances

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information
• Right to Opt Out: We do not sell or share personal information for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Right to Correct: You may request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by the CPRA

To make a verifiable consumer request, email [email protected] with "CCPA Request" in the subject line.

10. Other State Privacy Laws

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA)

Residents of Virginia, Colorado, and Connecticut have similar rights to access, correct, delete, and opt out. We honor these rights consistent with applicable law. To exercise your rights, email [email protected].

Nevada

Nevada residents may opt out of the sale of covered personal information. We do not sell personal information as defined by Nevada law. To submit an opt-out request, email [email protected].

11. International Users

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We do not currently offer GDPR-specific data processing agreements, but we apply the same privacy protections to all users regardless of location.

12. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, contact [email protected].

13. Email Communications (CAN-SPAM)

We comply with the CAN-SPAM Act. All marketing emails include an unsubscribe link. We process unsubscribe requests within 10 business days. Transactional emails (account confirmations, billing receipts, security alerts) are not marketing and cannot be opted out of while your account is active.

14. Third-Party Service Providers

We use the following third-party providers that may process your data:

• Cloudflare (Pages, Workers, CDN): Hosting and content delivery — processes IP addresses for request routing
• Stripe: Payment processing — processes billing information under their own privacy policy
• Plausible Analytics: Privacy-friendly analytics — no personal data collected, no cookies

Each provider has their own privacy policy and is bound by data processing agreements where applicable.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on the Service at least 30 days before taking effect. Your continued use constitutes acceptance. We encourage you to review this page periodically.

16. Contact

If you are not satisfied with our response to a privacy concern, you may have the right to lodge a complaint with your local data protection authority.