Loancrate App Privacy Policy

1. Introduction and scope

Effective date: October 19th, 2026

This Privacy Policy explains what information Loan Crate, LLC (“Loancrate,” “we,” “us”) collects through the Loancrate mobile app for iOS and Android (the “App”), how we collect and use it, who we share it with, how long we keep it, and the choices you have. It applies to the App only. Our website, our borrower portals and our other services are covered by our general Privacy Policy.

The App is a tool for employees and contractors of mortgage loan originators that license Loancrate’s loan origination platform (each, a “Lender”). You can use the App only with an account your Lender has provisioned. Borrowers and other members of the public cannot use the App.

Loancrate’s role. We play two roles, and this Policy tells you which one applies to each kind of data.

• For your account, device, usage and diagnostic data, Loancrate decides how the data is used and is responsible for it under this Policy.
• For loan files, borrower information, messages and attachments you work with in the App, Loancrate acts as a service provider (processor) to your Lender. We process that data only on your Lender’s instructions and under our agreement with your Lender. Your Lender’s own privacy notice governs how borrower information is collected and used, and your Lender is responsible for notifying borrowers.

Your license to use the App is governed by Loancrate’s End User License Agreement and by your Lender’s agreement with Loancrate; this Policy governs data. By using the App you acknowledge this Policy. If you do not agree with it, do not use the App; your Lender can tell you how to do your work without it.

2. Information we collect

The App collects the categories below and nothing else. The last column shows how each category appears in the App’s privacy details on the App Store.

What the App does not collect. Precise or approximate location; your contacts, calendar or photo library as a whole (you choose each photo or file); audio or microphone data; biometric data (the App has no Face ID or Touch ID feature); health or fitness data; advertising identifier or Android advertising ID; your browsing or search history outside the App; and any data from other companies’ apps or websites.

Sensitive information. We do not ask you for sensitive information about yourself. Borrower documents you attach may contain Social Security numbers, government ID numbers, financial account numbers and similar data. We process that data only for your Lender, under the safeguards described in Section 12. Attach only what your Lender’s policies permit.

Linked to you. All categories above are linked to your account or device. The App does not collect data in anonymous or de-identified form at the point of collection, though we may de-identify data later as described in Section 4.

3. How we collect information

We collect information in three ways.

From your Lender. Your Lender creates your account in Loancrate and gives us your name, work email address, role and permissions. Your Lender can update or remove your account at any time. We do not let you create an account yourself in the App.

Directly from you. When you sign in, the App opens your device’s system browser to our sign-in page, where our identity provider, WorkOS, verifies you through your Lender’s single sign-on (such as Google Workspace, Microsoft Entra ID or Okta) or another method your Lender has enabled. The App itself never sees your password. When you send a message, take a photo, or choose a photo or file to attach, you provide that content to us. When you email support, you provide what you write.

Automatically from your device. When you use the App, it sends device and app information, usage events, and crash and performance reports to our servers and to the service providers named in Section 6. Our servers also record the IP address, request time and app version of each request the App makes. The App does not use cookies or web beacons; the system browser used for sign-in may set cookies, which is governed by our general Privacy Policy.

The App asks for device permissions only when you use the feature that needs them, and you can decline. Section 7 lists each permission and what it is for.

4. How we use information

We use the information in Section 2 for the purposes below and no others. The right-hand column is the purpose category Apple uses in the App’s privacy details.

What we do not do. We do not use your information to show you advertising, sell it, or build marketing profiles. We do not use data from the App for personalization beyond remembering your settings. We do not use messages, attachments or borrower information for any purpose other than providing and improving the service for your Lender, as permitted by our agreement with your Lender or as your Lender instructs. If we ever want to use your information for a new purpose that is not compatible with the ones above, we will ask for your permission first.

De-identified and aggregated data. We may create statistics from usage and diagnostic data that cannot reasonably be linked to you, such as the share of users on each iOS version, and use those statistics for any purpose. We will not try to re-identify such data.

Automated decisions. The App does not make decisions about you, or about borrowers, that have legal or similarly significant effects without human involvement. Any AI-assisted features in the App operate on your Lender’s instructions and under our agreement with your Lender.

5. How we share information

We share information only with the parties below, and only for the purposes in Section 4.

Your Lender. Your Lender owns the loan data, messages and attachments in its Loancrate workspace and can see your activity in it. Your Lender’s administrators can also see your account details, sign-in history and, if your Lender asks us, usage data about its own users for security and compliance purposes.

Service providers. Companies that process data for us under contract: cloud hosting, identity verification at sign-in, crash reporting, product analytics, logging, app updates, email, and AI models. Section 6 names each one and what it receives. Each may use the data only to provide its service to us, must protect it at least as well as this Policy requires, and may not use it for its own purposes, including advertising.

Affiliates. Loancrate has no subsidiary or affiliated companies.

Legal, safety and compliance. We disclose information when we reasonably believe it is required by law, subpoena, court order or a regulator, including state mortgage regulators and federal banking agencies that examine your Lender; to enforce our agreements; or to protect the rights, property or safety of Loancrate, your Lender, borrowers or others.

Business transfers. If Loancrate is involved in a merger, acquisition, financing, reorganization or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honor this Policy for data collected under it.

At your direction. If you ask us to share information with someone else at your Lender, and the request is in accordance with your Lender’s policies, we will.

No sale, no sharing for advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act and similar state laws. We have not done so in the preceding 12 months. We do not share information with data brokers or advertising networks.

6. Third-party SDKs and service providers

The App contains two third-party SDKs that send data off your device, plus Expo’s update service. The other services below run on our servers, not in the App. Each provider is bound by a written contract that requires it to protect your information, to use it only to provide its service to us, and not to use it for advertising, profiling or any purpose of its own.

The App’s privacy manifests, bundled with each release, list the data each SDK collects and the system APIs it uses, and match the App’s privacy details on the App Store. If we add an SDK or provider that receives personal information, we will update this table and the App Store privacy details before the release that includes it.

Apple, Inc. receives data when you download the App and when you opt in on your device to share diagnostics with developers. The App updates its badge on your device and does not use push notifications. Apple’s handling of that data is governed by Apple’s Privacy Policy.

7. Device permissions and features

The App asks for each permission the first time you use the feature that needs it, explains why in the system prompt, and works without it. You can change any permission in iOS Settings → Apps → Loancrate. On Android, the App requests the equivalent permissions only when you use the related feature; you can change them in Settings → Apps → Loancrate → Permissions. The App stores your session credential in the Android Keystore, and the App’s data practices are also described in its Data safety section on Google Play.

Secure storage. The App stores your session credential in the iOS Keychain so you stay signed in. Nothing else is stored in the Keychain. Signing out removes it.

System browser. Sign-in opens your device’s browser so that your Lender’s identity provider can verify you. The App receives only a signed confirmation and a session credential back through a loancrate:// link.

Microphone. The App does not request microphone access, including when you take a photo.

Features we may add. We will update this Policy and the App Store privacy details before any of the following ships. Until then, the App does not use them.

• Location: Approximate or precise location would be collected only while you use that feature and never in the background.
• Media library (write): to save a photo or document from the App to your device at your request. The App would not read your library.
• Audio and speech: to dictate a message or record a voice note.
• Clipboard: to paste content into a message. The App would read the clipboard only when you paste, and iOS shows a notice each time.
• Haptics: vibration feedback. No data is collected.

8. Tracking and advertising

The App does not track you, as Apple defines tracking. It does not link data collected in the App with data from other companies’ apps, websites or offline sources for advertising or ad measurement, and it does not share data with data brokers. Because it does not track, the App will not show Apple’s App Tracking Transparency prompt and does not access the advertising identifier (IDFA) or Android advertising ID. Any identifier the App uses for analytics is never combined with data from other companies.

The App shows no advertising, first-party or third-party, and we do not use information from the App for marketing. Any product news we send goes to the work email address your Lender gave us, and you can opt out through the link in each email or by writing to privacy@loancrate.com.

Global Privacy Control and Do Not Track. The App has no web content that could receive these browser signals. Our website honors Global Privacy Control as described in our general Privacy Policy.

9. Data retention and deletion

We keep information only as long as needed for the purposes in Section 4, then delete or de-identify it. The periods below are our defaults. For data we hold on your Lender’s behalf, your Lender’s instructions and our agreement with your Lender control, which may mean a shorter or longer period. For other categories, a longer period applies only where the law, a regulator, or our agreement with your Lender requires it.

Deleting your account. Because your Lender provisions your account and is responsible for borrower records, you cannot request deletion from inside the App. Your Lender sends deletion requests to us in accordance with their policies. We then deactivate your account within the period specified by your Lender and delete your account information, sign-in data, usage data and diagnostics within 30 days. We will confirm by email when deletion is complete. You can also send the request to your Lender’s administrator.

What deletion does not remove. Messages and attachments you added to a loan file belong to your Lender and are part of its loan records; they stay in your Lender’s workspace under your Lender’s retention rules, with your name shown as the author where the record requires it. We also keep the minimum needed to meet legal obligations, resolve disputes and enforce our agreements, and we keep de-identified statistics.

Signing out and uninstalling. Signing out removes your session credential from the device’s secure storage. Uninstalling the App removes cached attachments and other locally stored App data. On iOS, the session credential in the Keychain can remain after uninstall; it is removed when you sign out. Uninstalling does not delete your account or the data we hold.

10. Your rights and choices

You can make any of the requests below by emailing privacy@loancrate.com from your work email address, or by asking your Lender’s administrator. We respond within 30 days; if we need longer, we will tell you why.

• Access. Ask what information we hold about you and receive a copy in a portable format.
• Correction. Your name, email and role come from your Lender, so ask your Lender’s administrator to correct them; we will update our records when your Lender does. For anything else, ask us directly.
• Deletion. Ask us to delete your information, subject to the exceptions in Section 9.
• Withdraw consent. Turn off any device permission in your device settings at any time, sign out to end data collection from the App, or delete your account to withdraw entirely. Withdrawing does not affect processing that happened before.
• Marketing. Opt out of product emails through the link in any email or by writing to us. We will still send service and security notices about your account.
• Complaints. Tell us if you believe we have not followed this Policy. If we cannot resolve it, you may complain to your state attorney general or another regulator with authority over us.

Verification. We verify requests by matching them to the work email address on your account, and we may ask your Lender to confirm your identity. An authorized agent may make a request for you if they provide your signed permission.

Requests about borrower data. If a borrower asks you about their information, or you want to exercise rights over information in a loan file, direct the request to your Lender. Loancrate processes that data for your Lender and will help your Lender respond.

No retaliation. We will not treat you differently for exercising any of these rights.

11. U.S. state privacy rights

Gramm-Leach-Bliley Act. Your Lender is a financial institution under the Gramm-Leach-Bliley Act (GLBA). Borrower information in the App is nonpublic personal information that we process for your Lender as its service provider, under a contract that requires us to follow the GLBA Safeguards Rule. Your Lender’s GLBA privacy notice, not this Policy, governs that information, and state privacy laws generally exempt it. The rights below apply to the information we hold about you as a user.

California (CCPA/CPRA). If you are a California resident, this section tells you what we have collected in the past 12 months and the rights you have.

We use each category for the purposes in Section 4 and keep it for the periods in Section 9. We do not sell personal information, do not share it for cross-context behavioral advertising, and have no actual knowledge of selling or sharing information of anyone under 16. We do not collect sensitive personal information about you, so the right to limit its use does not apply.

You have the right to know what we collect and how we use and disclose it; to access it in a portable form; to correct it; to delete it; to opt out of sale or sharing (we do none); and not to be discriminated against for exercising these rights. Make requests as described in Section 10. You may use an authorized agent; we will ask the agent for your written permission and may verify your identity directly. Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct marketing.

Other states. If you live in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another state with a comprehensive privacy law, you may have rights to access, correct, delete and port your information, and to opt out of targeted advertising, sales and profiling (none of which we do). Many of these laws exempt data about employees and business contacts, and data held by GLBA-regulated institutions and their service providers; where they apply, we honor them. If we deny a request, you may appeal by replying to our response. We answer appeals within 45 days, and if we still deny it you may contact your state attorney general.

Nevada. We do not sell covered information as defined in Nevada law.

12. Security

We protect your information with administrative, technical and physical safeguards designed for data that financial institutions entrust to a service provider. Our program is designed to meet the GLBA Safeguards Rule and is audited annually under SOC 2 Type II Framework.

• In transit. All traffic between the App and our servers, and between our servers and the providers in Section 6, uses TLS 1.2 or higher. The App only connects to Loancrate endpoints and the named providers.
• At rest. Databases, file storage and backups are encrypted with AES-256 or stronger. On your device, the App stores only your session credential, in the iOS Keychain or Android Keystore, and attachment caches protected by the operating system’s file encryption.
• Access. Your Lender’s role-based permissions decide what you can see in the App. Loancrate staff access to customer data is limited to named roles, requires multi-factor authentication, is logged, and is reviewed quarterly.
• Sign-in. Authentication runs through WorkOS and your Lender’s single sign-on, so your Lender’s password and multi-factor policies apply. The App never handles your password. Sessions expire after a period set by your Lender and can be revoked by your Lender’s administrator.
• Monitoring and testing. We log and monitor access, run vulnerability scans, and commission annual penetration tests of the platform and the App.
• Vendors. Every provider in Section 6 is assessed before onboarding and bound by a written security and confidentiality agreement.
• Incidents. If a security incident affects your information, we will notify your Lender without undue delay and within the time our agreement and applicable law require, and we will support your Lender’s notifications to you, borrowers and regulators.

No system is completely secure. Keep your device updated and passcode-protected, do not share your sign-in, and tell your Lender and us at security@loancrate.com right away if your device is lost or you suspect unauthorized access.

13. Children’s privacy

The App is a workplace tool for adults employed by or contracting with Lenders. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18 through it. If you believe a minor has an account, email privacy@loancrate.com and we will remove it. Borrower records a Lender holds may describe minors (for example, dependents on a loan application); your Lender is responsible for that data and the App collects nothing from those individuals.

14. International users and data transfers

Loancrate is based in the United States and the App is offered to Lenders operating in the United States. We store and process information in the United States, on Amazon Web Services infrastructure in U.S. regions, and the providers in Section 6 process it there too. If you use the App from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location. Where a Lender’s agreement with us requires specific transfer safeguards, such as standard contractual clauses, we apply them.

15. Changes to this Policy

We will update this Policy when the App’s data practices change, including before any release that adds a data type, a permission, or a provider that receives personal information, and we will update the App’s privacy details on the App Store at the same time. The effective date at the top shows the current version. For material changes we will notify you in the App or by email to your work address before they take effect, and we will keep prior versions available on request. Continuing to use the App after a change takes effect means the updated Policy applies.

16. Contact us

Questions, requests and complaints about this Policy or your information:

• Email: privacy@loancrate.com
• Mail: Loan Crate, LLC, Attn: Privacy, PO Box 1327, Cardiff, CA 92007
• Security concerns: security@loancrate.com
• General support: hello@loancrate.com

If your question is about borrower information or a loan file, contact your Lender; we will help your Lender respond.