Know What You Share.

Information You Provide

Account profiles contain your name, sign-in email, phone, company, city, state, experience, property focus and capital information. Listings contain general project or lending criteria, funding terms and timelines. Deal Rooms store preset responses and numeric proposals. When you acknowledge signup disclosures, your profile stores the summary version, acknowledgment text and server-recorded date.

Lender applications can include legal identity, entity ownership and authority, date of birth, tax identification, funding information, government identification, tax documents and distribution instructions. Uploaded documents may contain additional personal information. Provide only the requested information and redact unrelated data where appropriate.

Bank Information & Your Authorization

When you authorize Plaid linking, the application retrieves supported account details, ownership names, balances and account/routing information. It retains connection tokens to support authorized refreshes and verification. Balances may be refreshed when you request a refresh, submit an application or an authorized commitment review requires it. The application does not request your online banking password.

Read Plaid’s End User Privacy Policy and the permissions presented during linking. Connecting an account is separate from authorizing a payment or a consumer credit report.

Use & Visibility

Information supports account access, listing publication, matching, participant communications, application review, funding verification, transaction records and security. Public listings show aliases and approved criteria, including general location; they do not publish profile contact details or application documents. The two Deal Room participants can access their structured conversation. Executed contract uploads are private to the uploader and authorized platform reviewers; their contents and addresses are not published. Support case messages are encrypted and visible to the requester and authorized platform reviewers. Optional workflow emails contain a generic sign-in notice, not transaction details or attachments.

Application access is restricted to the account holder and designated platform reviewer through the application. Hosting, storage, authentication and bank-linking providers also process information to deliver their services. Current infrastructure includes OpenAI, Cloudflare, Supabase, Resend and Plaid; those providers’ applicable privacy notices and agreements govern their own processing. Required disclosures to authorized closing parties or authorities must be handled as part of the applicable transaction process.

Storage, Retention & Account Controls

Sensitive application packages and stored bank connection data use application-level encryption. Basic profiles, listings and workflow records are stored separately. Encryption and access restrictions reduce risk but do not guarantee security. Member sign-in requires a verified password and a one-time email code or linked passkey. Administrator access additionally requires the configured privileged-access factors. Access checks are enforced on protected requests.

You can edit basic profile details and replace documents through account settings. Disconnect Bank requests revocation of that Plaid connection and clears the active connection’s stored credentials and data from the application. It does not automatically delete previously saved application snapshots, review records, audit history or copies retained by service providers.

Account Settings → Account Access offers Deactivate Account and Delete Account. Deactivation preserves your profile, preferences, linked banks, and deal history while pausing listings and normal account access. Log in and explicitly reactivate to resume. Deactivation does not cancel existing commitments or authorized verification. Deletion removes your active profile, preferences, current lender application setup, and linked-bank records after revoking access, and archives listings. A later login requires fresh onboarding, disclosures, verification, and bank linking. Deletion is blocked while any borrower or lender commitment lacks a documented resolution by the platform reviewer. Funding, closing, and recording alone do not count as resolution. Previously saved application packages and documents, deal conversations, commitments, transaction and review records, and audit history are retained separately; a minimal sign-in identity is retained to associate historical records correctly. An automated retention schedule and a formal privacy-request process are not yet available. Additional applicable rights notices and retention policies must be established before regulated production onboarding.

Cookies & Sign-In

Synedaro requires an email and password plus a one-time email code or a linked passkey. Supabase processes email and password authentication, and Resend delivers one-time email codes for sign-in, setup, and recovery. Passkeys use device verification such as Face ID, Touch ID, or a screen-lock PIN; biometric data stays on your device. Synedaro stores passkey public credentials and encrypted verification records. Codes expire, are limited to one use, and are subject to request and attempt limits. Session cookies are necessary for account access; session credentials stored by the application are encrypted. Signing out revokes this device’s application session. Deactivation and deletion revoke existing application sessions. Earlier sign-in sessions may establish account ownership during restoration, but do not bypass password and second-step verification. Basic identity mappings are retained so existing deal records stay connected to their owners.

Before Sharing Sensitive Information

Review the current controls and Platform Disclosures & Risks. Never put passwords, one-time codes, full tax IDs, account numbers or identity documents in public listings or Deal Rooms. Bank linking and platform review do not guarantee funding, repayment or regulatory compliance.