Privacy Policy

ARTICLE 1: Introduction

1.1 Scope of This Policy

This Privacy Policy describes how Relendi Inc. ("we," "us," or "our") collects, uses, shares, and protects your personal information when you visit our website at relendi.com, use our AI-powered commercial real estate (CRE) lending marketplace, or otherwise interact with our services (collectively, the "Service"). Relendi Inc. is a company based in New York, NY, and operates the Relendi platform, which connects commercial real estate Borrowers, Brokers, and Lenders. This Policy is designed to provide you with a clear understanding of our data practices and to comply with applicable privacy and financial regulations in the United States. By accessing or using our Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this Policy, please do not access or use the Service.

1.2 Our Role and Responsibilities

For the purposes of applicable data protection laws, Relendi Inc. acts as a "business" or "data controller" for the personal information we process. Our Service is a marketplace designed to facilitate transactions and communications between different types of users: Borrowers, who submit loan applications; Brokers, who manage and package deals; and Lenders, who review and fund deals. We are committed to protecting the privacy and security of all our users' data and handling it in a transparent and lawful manner. This Policy applies to all users of the Service, regardless of their role.

ARTICLE 2: Definitions

2.1 Key Terms

To help you understand this Policy, here are some key terms we use:

• "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. This includes the types of data listed in Article 3.
• "Sensitive Personal Information" includes government-issued identifiers like Social Security Numbers (SSN) and Employer Identification Numbers (EIN), precise financial account information, and demographic data such as race or ethnicity.
• "User" means any individual who accesses or uses the Service, including Borrowers, Brokers, and Lenders.
• "Borrower" means a User seeking commercial real estate financing for themselves or an entity they represent.
• "Broker" means a User, typically a commercial mortgage broker or advisor, who uses the Service to manage deals and connect Borrowers with Lenders.
• "Lender" means a User, typically a financial institution or private lender, who uses the Service to review loan applications and provide financing terms.
• "Processing" means any operation performed on Personal Information, such as collection, recording, organization, storage, use, disclosure, or deletion.
• "Service Provider" means a third-party company that we engage to process Personal Information on our behalf to help us operate our Service (e.g., cloud hosting, AI processing).

ARTICLE 3: Information We Collect

3.1 Information You Provide Directly

We collect Personal Information that you voluntarily provide to us when you register for an account, create a profile, submit a loan application, upload documents, or communicate with us or other Users through the Service. The specific information we collect depends on your role and how you use the Service.

Categories of Personal Information Collected:

• Identity Data: Full legal name, date of birth, Social Security Number (for individuals), and Employer Identification Number or Taxpayer Identification Number (for business entities).
• Contact Data: Email address, physical address (personal and business), and phone number.
• Professional Data: For Brokers and Lenders, this may include your company name, job title, and professional credentials.
• Financial Data: This is a critical category for our Service and may include personal financial statements (detailing assets, liabilities, and net worth), credit score or credit score range, annual income, bank account information, and tax returns.
• Property Data: Information related to the commercial property for which financing is sought, including property address, appraisals, rent rolls, operating statements, and property photographs.
• HMDA Data (Sensitive): For compliance with the Home Mortgage Disclosure Act (HMDA), we may collect demographic information from Borrowers, including race, ethnicity, and sex, on a voluntary basis. The use and sharing of this data are strictly limited as described in this Policy.
• Communications: Any information you provide when you contact us for support, provide feedback, or communicate with other Users on the platform.

3.2 Information Within Uploaded Documents

When you upload documents to the Service (e.g., PDFs, spreadsheets, images such as tax returns, bank statements, or property deeds), we collect the information contained within those files. Our AI-powered tools may process these documents to extract relevant data points (e.g., names, addresses, financial figures) to populate application fields and analyze the deal. You are responsible for ensuring you have the right to provide us with all information contained in the documents you upload.

3.3 Information We Collect Automatically

As you navigate and interact with our Service, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns.

• Usage Data: Information about how you use the Service, such as the features you use, the pages you visit, the deals you view or create, and the time, frequency, and duration of your activities.
• Technical Data: Information about the device and browser you use to access the Service, including your IP address, device type, operating system, browser type, unique device identifiers, and mobile network information.
• Location Data: We may collect your general geographic location (e.g., city and state) based on your IP address. We do not collect precise geolocation data without your explicit consent.

3.4 Information from Third-Party Sources

We may receive Personal Information about you from other sources, such as:

• Other Users: A Broker may input a Borrower's information to initiate a deal, or a Lender may provide feedback on a submitted application.
• Third-Party Services: If you choose to link or connect to our Service through a third-party service, we may receive information from that service. For example, if you authenticate using a third-party identity provider.
• Public Sources: We may collect information from publicly available sources, such as government records or online directories, to verify information or supplement deal data.

ARTICLE 4: How We Use Your Information

4.1 Primary Purposes for Processing

We use the Personal Information we collect for the following primary purposes:

• To Provide and Manage the Service: To create and manage your account, facilitate the submission and review of loan applications, connect Borrowers, Brokers, and Lenders, and enable communication and transactions on the platform.
• To Power AI-Driven Features: We use artificial intelligence, including the Anthropic Claude API, to process and analyze the information you provide. This includes:
• Extracting key data points from uploaded documents using Optical Character Recognition (OCR) and natural language processing to reduce manual data entry.
• Analyzing deal characteristics to generate summaries and identify potential risks or strengths.
• Recommending suitable Lenders to Brokers and Borrowers based on deal parameters and Lender preferences.
• Assisting Users by drafting communications, such as deal summaries or lender inquiries.
• To Communicate With You: To send you transactional communications, service-related announcements, security alerts, and support messages. We also use your contact information to respond to your inquiries.
• For Security and Fraud Prevention: To verify your identity, protect against fraud, unauthorized access, and other illegal activities, and to enforce our terms and policies.
• For Legal and Regulatory Compliance: To comply with our legal obligations under applicable laws, including financial regulations like the Gramm-Leach-Bliley Act (GLBA), Home Mortgage Disclosure Act (HMDA), Equal Credit Opportunity Act (ECOA), Bank Secrecy Act (BSA), and anti-money laundering (AML) requirements. This may include reporting and record-keeping obligations.
• For Research and Development: To analyze usage trends, improve our AI models, enhance the functionality of our Service, and develop new products and features. When possible, we use de-identified or aggregated data for these purposes.

4.2 Marketing and Advertising

With your consent where required by law, we may use your contact information to send you marketing communications about our products, services, and special offers that may be of interest to you. We will comply with the CAN-SPAM Act for all commercial email communications. You may opt out of receiving marketing emails at any time by following the unsubscribe link in the email or by contacting us directly.

4.3 Specific Use of Sensitive Information

We handle Sensitive Personal Information with the highest level of care and for limited purposes:

• SSN and EIN/TIN: These are collected for identity verification, credit checks (with your explicit consent), and to comply with legal obligations such as tax reporting and AML/KYC (Know Your Customer) requirements. This information is stored with field-level encryption.
• HMDA Demographic Data: This information (race, ethnicity, sex) is collected solely for federal HMDA reporting requirements to monitor for fair lending practices. It is collected on a voluntary basis. This data is never shared with Lenders, is not visible to other Users, is not used in any AI analysis or credit decisioning, and is reported to the government in an aggregated and anonymized format as required by law.

ARTICLE 5: Legal Basis for Processing

5.1 Our Justifications for Data Processing

We process your Personal Information based on the following legal justifications recognized under U.S. law:

• Performance of a Contract: Much of our processing is necessary to provide the Service you have requested and to perform our obligations under our Terms of Service. This includes creating your account, processing your loan applications, and facilitating communications between Users.
• Compliance with a Legal Obligation: We process certain information to comply with our extensive legal and regulatory obligations, particularly in the financial sector. This includes requirements under GLBA, HMDA, ECOA, FCRA, and BSA/AML laws.
• Legitimate Business Interests: We process some information for our legitimate interests, provided that these interests are not overridden by your rights and interests. This includes improving our Service, preventing fraud, ensuring the security of our platform, and for certain marketing activities. We conduct a balancing test to ensure our interests are justified.
• Your Consent: For certain activities, we will rely on your explicit consent. This includes sharing your loan application with specific Lenders, conducting a credit check, or sending you direct marketing materials. Where we rely on consent, you have the right to withdraw it at any time.

ARTICLE 6: Information Sharing and Disclosure

6.1 Sharing Between Users on the Platform

The core function of our Service is to connect parties in a commercial real estate transaction. Therefore, sharing information between Users is essential. This sharing is controlled by you and occurs only with your explicit action or consent. For example:

• A Borrower or their Broker must affirmatively choose to share a loan application and its associated documents with one or more Lenders on the platform.
• Lenders can then view the submitted information to evaluate the deal and respond with a term sheet, which is then shared back with the Borrower and/or Broker.
• Communications between Users are visible to the participants in that specific deal conversation.

6.2 Sharing with Service Providers

We engage trusted third-party Service Providers to perform functions and provide services to us. We share your Personal Information with these providers subject to strict contractual obligations. In compliance with laws like the CCPA/CPRA, our contracts require these Service Providers to keep your information confidential and secure, and prohibit them from selling or sharing your Personal Information, or retaining, using, or disclosing it for any purpose other than for the specific business purpose of performing the services for us. These include:

• Cloud Infrastructure and Storage: We use Amazon Web Services (AWS) for our core infrastructure, including storing user data in MongoDB Atlas and documents in AWS S3. Authentication is managed via AWS Cognito.
• AI Processing: We use the Anthropic Claude API to perform the AI-powered analysis described in Article 4. We have a data processing agreement with Anthropic that prohibits them from using our data to train their models or for any purpose other than providing the service to us.
• Email and Communications: We use Amazon Simple Email Service (AWS SES) to send transactional and marketing emails.
• Analytics and Performance: We may use analytics providers to help us understand usage patterns and improve the Service.
• Credit Reporting Agencies: With your explicit consent, we may share information with credit reporting agencies to obtain a credit report as part of a loan application, in compliance with the Fair Credit Reporting Act (FCRA).

6.3 Disclosures for Legal and Business Purposes

We may disclose your Personal Information to third parties in the following circumstances:

• Legal Compliance and Protection: If we believe in good faith that disclosure is necessary to (a) comply with a law, regulation, legal process, or governmental request (e.g., a subpoena or court order); (b) enforce our Terms of Service or other policies; (c) protect the security or integrity of our Service; or (d) protect the rights, property, or safety of Relendi Inc., our Users, or the public.
• Business Transfers: In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your Personal Information may be sold or transferred as part of that transaction. We will notify you of any such deal and outline your choices in that event.
• Aggregated or De-identified Data: We may share aggregated or de-identified information, which cannot reasonably be used to identify you, with partners for research, marketing, analytics, or other purposes.

ARTICLE 7: Cookies and Tracking Technologies

7.1 Our Use of Cookies

We use cookies and similar tracking technologies (like web beacons and pixels) to operate and improve our Service. A cookie is a small text file stored on your device that helps us recognize you, remember your preferences, and understand how you interact with our Service. You can control the use of cookies at the individual browser level, but if you choose to disable cookies, it may limit your use of certain features or functions on our Service.

7.2 Types of Cookies We Use

We categorize our cookies as follows:

• Strictly Necessary Cookies: These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Without these cookies, services like user authentication and account access cannot be provided. These are always active.
• Performance and Analytics Cookies: These cookies collect information about how you use our Service, such as which pages you visit most often and if you receive error messages. This information helps us improve how our Service works. We use this data in an aggregated form. Examples include cookies from Google Analytics.
• Functionality Cookies: These cookies allow our Service to remember choices you make (such as your username, language, or the region you are in) and provide enhanced, more personal features. For example, they can be used to remember your login details so you don't have to re-enter them each time.
• Marketing and Advertising Cookies: These cookies are used to deliver advertisements that are more relevant to you and your interests. They are also used to limit the number of times you see an advertisement and help measure the effectiveness of advertising campaigns. They are usually placed by advertising networks with our permission. We will obtain your consent before placing these cookies where required by law.

7.3 Managing Your Preferences

Upon your first visit to our website, you may be presented with a cookie banner that allows you to provide consent for non-essential cookies. You can also adjust your browser settings to refuse some or all cookies or to alert you when cookies are being sent. For more information on how to manage cookies, please refer to your browser's help documentation. Please note that our Service does not currently respond to Do Not Track (DNT) signals.

ARTICLE 8: Data Retention

8.1 Our Data Retention Principles

We retain your Personal Information for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements, and for the establishment, exercise, or defense of legal claims. We do not retain Personal Information for longer than is reasonably necessary. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and our applicable legal requirements.

8.2 Specific Retention Periods

Below are our typical retention periods for different categories of data:

• Account and Profile Information: We retain your account information for as long as your account is active. If you close your account, we will retain your information for a period of up to 7 years to resolve disputes, prevent fraud, and comply with our legal and financial record-keeping obligations.
• Transaction and Deal Data: Information related to completed or withdrawn loan applications, including financial and property data, is retained for a minimum of 7 years after the date of the final action on the application. This is necessary to comply with regulations such as the ECOA (Regulation B) and BSA/AML laws.
• HMDA Data: We retain HMDA-related data for at least 3 years after the submission of the relevant HMDA report, as required by law.
• Communications: Correspondence with our support team may be retained for up to 3 years after the issue is resolved to maintain a record of our interactions.
• Usage and Analytics Data: Technical and usage data is typically retained in an identifiable form for up to 24 months, after which it is either deleted or anonymized.

ARTICLE 9: Data Security

9.1 Our Commitment to Security

We have implemented and maintain a comprehensive information security program with administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your Personal Information. We understand the sensitivity of the financial data we handle and take our security obligations very seriously.

9.2 Security Measures

Our security measures include, but are not limited to:

• Encryption: We encrypt Sensitive Personal Information both at rest and in transit. For example, SSNs and TINs are subject to field-level encryption in our database, and all data is transmitted over secure channels using TLS (Transport Layer Security).
• Access Controls: Access to Personal Information is strictly limited to employees, contractors, and Service Providers who have a legitimate business need to access it. We use role-based access controls and secure authentication mechanisms (AWS Cognito) to enforce this. Access to uploaded documents in AWS S3 is managed through time-limited, pre-signed URLs to prevent unauthorized direct access.
• Secure Infrastructure: Our Service is built on the secure and robust infrastructure of Amazon Web Services (AWS), which provides a wide range of security features and compliance certifications.
• Regular Monitoring and Testing: We regularly monitor our systems for potential vulnerabilities and attacks and conduct periodic security assessments and penetration testing.
• Employee Training: We provide regular security and privacy training to our employees to ensure they are aware of their responsibilities in protecting your data.

Despite our efforts, no security measure is perfect or impenetrable. We cannot guarantee the absolute security of your information, but we are committed to taking all reasonable steps to protect it.

ARTICLE 10: International Data Transfers

10.1 Processing in the United States

Relendi Inc. is based in the United States, and our Service is primarily targeted to Users in the United States. All information we collect is processed and stored on servers located in the United States. If you are accessing our Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the U.S., where data protection laws may differ from those in your jurisdiction.

10.2 Use of Global Service Providers

We use Service Providers, such as AWS and Anthropic, that may maintain data centers and process data in various locations around the world. While our primary data storage is in the U.S., it is possible that your information may be processed in a country other than your own. When we transfer your Personal Information internationally, we will take steps to ensure that your information is protected by implementing appropriate safeguards, such as using standard contractual clauses or relying on the provider's binding corporate rules, to ensure an adequate level of data protection.

ARTICLE 11: Your Privacy Rights and Choices

11.1 Your Rights Regarding Your Information

Depending on where you reside, you may have certain rights regarding your Personal Information under applicable state privacy laws. We are committed to honoring these rights for all our users, regardless of location, subject to legal limitations. These rights may include:

• The Right to Know and Access: You have the right to request information about the categories and specific pieces of Personal Information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we have shared it.
• The Right to Correct: You have the right to request that we correct any inaccurate Personal Information that we maintain about you.
• The Right to Delete: You have the right to request that we delete Personal Information that we have collected from you, subject to certain exceptions. For example, we may need to retain certain information to complete a transaction, comply with our legal obligations (such as financial record-keeping laws), or protect against fraud.
• The Right to Data Portability: You have the right to request a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance.
• The Right to Opt-Out of Sale or Sharing: We do not "sell" your Personal Information in the traditional sense of the word. However, some state laws define "sale" or "sharing" broadly to include activities like sharing data for targeted advertising. You have the right to opt out of such activities. As our platform is primarily for financial transactions and not consumer advertising, our use of such technologies is limited.
• The Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you services, charge you different prices, or provide you with a different level or quality of service.

11.2 How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable request to us by emailing privacy@relendi.com. In your request, please specify which right you are seeking to exercise and provide sufficient information to allow us to verify your identity. We may need to request additional information from you to confirm your identity and ensure the security of your account before processing your request. We will respond to your request within the timeframes required by applicable law, typically within 45 days.

ARTICLE 12: State-Specific Privacy Notices

12.1 Notice to California Residents

This section supplements the information contained in our Privacy Policy and applies solely to residents of California. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA).

Your Rights: You have the rights listed in Article 11, including the right to know, correct, delete, and opt-out of the "sale" or "sharing" of your personal information. You also have the right to limit the use and disclosure of your Sensitive Personal Information. As described in Section 4.3, we already limit the use of your Sensitive Personal Information (like SSN and HMDA data) to specific, necessary purposes.

Information We Collect: In the preceding 12 months, we have collected the categories of personal information listed in Article 3 of this Policy.

Purposes for Collection and Use: We collect and use this information for the business and commercial purposes described in Article 4.

Disclosure of Information: In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose to the categories of third parties listed below:

• Identifiers, Contact Data, Financial Data, Property Data, and Professional Data: Shared with other Users (at your direction), Service Providers (for cloud hosting, AI processing, communications), and for legal compliance.
• Technical and Usage Data: Shared with Service Providers (for analytics and security).

We do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA in the context of cross-context behavioral advertising. Our sharing is primarily to facilitate the financial transactions you initiate on the platform.

How to Exercise Your Rights: California residents may exercise their rights by contacting us at privacy@relendi.com. You may also designate an authorized agent to make a request on your behalf.

ARTICLE 13: Compliance with Financial Regulations

13.1 Gramm-Leach-Bliley Act (GLBA)

As a financial technology platform, Relendi Inc. is subject to the Gramm-Leach-Bliley Act (GLBA). This law requires us to explain our information-sharing practices to our customers and to safeguard sensitive data. This Privacy Policy serves as our GLBA privacy notice. We are committed to protecting the security and confidentiality of your nonpublic personal information (NPI) and have implemented the security measures described in Article 9 to do so.

13.2 Impact on Your Rights

Our obligations under financial regulations like GLBA, ECOA, and BSA/AML may impact your ability to exercise certain privacy rights. For example, we are legally required to retain records of credit applications and transactions for several years. Therefore, even if you request deletion of your data, we may be required to retain certain information to comply with these legal obligations. We will always inform you if a legal requirement prevents us from fulfilling your request.

ARTICLE 14: Children's Privacy

14.1 Not for Minors

Our Service is not intended for or directed at individuals under the age of 18. We do not knowingly collect Personal Information from children under 18. If we become aware that we have inadvertently collected Personal Information from a child under 18, we will take steps to delete such information from our records as soon as possible. If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us at privacy@relendi.com.

ARTICLE 15: Changes to This Privacy Policy

15.1 Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by posting the updated policy on our website and updating the "Effective Date" at the top. In some cases, we may provide more prominent notice, such as by sending you an email notification. We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

ARTICLE 16: Contact Information

16.1 How to Reach Us

If you have any questions, comments, or concerns about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please do not hesitate to contact us. You can reach our privacy team at:

Relendi Inc.

Attn: Privacy Officer

Email: privacy@relendi.com

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy.