Privacy Policy

1. Introduction

ServeYourNote, LLC (“ServeYourNote,” “we,” “us,” or “our”) operates the ServeYourNote platform (the “Service”), a software-as-a-service technology platform that provides tools for managing seller-financed real estate notes.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

ServeYourNote is a technology platform, not a financial institution, loan servicer, or financial advisor. This distinction affects how we handle your data: we process data to provide software tools, not to make financial decisions or provide financial services.

For questions about this Privacy Policy, contact us at:

ServeYourNote, LLC
Email: support@serveyournote.com
Address: 13320 Morse St, Cedar Lake, IN 46303

2. Information We Collect

2.1 Information You Provide Directly

Account Information (all users):

Organization Information (note holders):

Borrower Information (entered by note holders about their borrowers):

Loan and Financial Data (entered by note holders):

Documents:

2.2 Information Collected Automatically

Server and Access Logs:

Cookies and Similar Technologies:

We do not use third-party advertising cookies or cross-site tracking cookies.

Analytics:

We use privacy-focused analytics tools that collect minimal data. Our analytics approach varies by context:

• Marketing/public pages: Privacy-first, cookieless analytics
• Authenticated app: Product analytics with anonymous identifiers (no PII in events)
• Internal dashboards: Operational monitoring (not user-facing)

2.3 Third-Party Services and Data Sharing

We use the following third-party services. Each is limited to the data necessary for its function:

Payment Processing:

Stripe is PCI DSS Level 1 compliant. We do not store full bank account numbers — Stripe tokenizes payment methods. We store only: Stripe customer IDs, payment method IDs, bank name, and last four digits of the account number.

Email:

Product Analytics (authenticated app only):

PostHog events never contain PII. User identification uses anonymous UUIDs linked to accounts internally. We do not send names, emails, financial data, or loan details to PostHog. PostHog is SOC 2 Type II certified.

Marketing Analytics (public/marketing pages only — never loaded on authenticated dashboard pages where financial data is displayed):

Internal Only (no user data shared externally):

2.4 Information We Do NOT Collect

• We do not collect or store full bank account or routing numbers (Stripe handles this)
• We do not collect credit card numbers
• We do not collect biometric data
• We do not purchase data from data brokers
• We do not collect data from social media profiles
• We do not use advertising cookies or participate in ad networks

3. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your information to:

• Make lending, credit, or financial decisions
• Sell your personal information to third parties
• Build advertising profiles
• Target you with third-party advertisements
• Share your data with data brokers

4. How We Protect Your Information

4.1 Encryption

4.2 Access Controls

• Role-based access: organization owners, admins, and viewers have different permissions
• Multi-tenant isolation: all data is scoped to organizations; users can only access data belonging to organizations they are members of
• Borrower isolation: borrowers can only see their own loan data, not other borrowers within the same organization
• Administrative access to production systems is limited to essential personnel
• All data access is logged in our audit trail (user, action, timestamp, IP address)

4.3 Infrastructure

• Application hosted in containerized environments with network isolation
• Database access restricted to application servers (not publicly accessible)
• Document storage (S3) configured as private — no public access, presigned URLs with 15-minute expiry for downloads
• Regular dependency auditing for known vulnerabilities
• Incident response plan maintained (see internal security documentation)

4.4 Third-Party Security

All third-party services that process personal data are selected based on their security posture:

• Stripe: PCI DSS Level 1 compliant
• PostHog: SOC 2 Type II certified
• Plausible: GDPR-compliant by design (cookieless, no PII)
• Loops: SOC 2

5. Data Retention

We retain your information for as long as necessary to provide the Service and comply with legal obligations:

After account termination:

1. You have 30 days to export all your data (see ToS Section 10.3)
2. After 30 days, we delete your data from active systems
3. Tax-related records and audit logs are retained for 7 years per legal requirements
4. Backups containing your data are purged on a rolling basis (within 90 days)
5. Anonymous/aggregate analytics data is retained indefinitely

Documents under legal hold: If a document has been placed under legal hold (e.g., in connection with litigation or a regulatory inquiry), it will be retained until the hold is released, regardless of account termination or standard retention schedules.

6. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

Important limitations on deletion:

• We cannot delete data that we are required by law to retain (e.g., tax records for 7 years)
• We cannot delete immutable audit log entries (these are required for financial record integrity)
• Deleting your account does not delete data that your borrowers may independently have access to through the borrower portal (borrower accounts are separate)
• If you are a borrower, your note holder controls the loan data — contact them for questions about data entered on their behalf

To exercise your rights: Email us at support@serveyournote.com with the subject line “Privacy Rights Request.” We will respond within 30 days.

6.1 Colorado Privacy Act (CPA)

If you are a Colorado resident, the CPA (C.R.S. § 6-1-1301 et seq., effective July 1, 2023) provides you with additional rights, including the right to opt out of targeted advertising and the right to appeal our decisions regarding your privacy requests.

Current applicability: The CPA applies to entities that control or process personal data of 100,000 or more Colorado residents per year, or 25,000 or more Colorado residents if the entity derives revenue from the sale of personal data. We do not currently meet these thresholds, but we voluntarily extend CPA-equivalent rights to all users regardless of jurisdiction.

To appeal a privacy decision: If we deny a privacy rights request, you may appeal by emailing support@serveyournote.com with the subject line “Privacy Appeal.” We will respond within 45 days.

6.2 California Consumer Privacy Act (CCPA/CPRA)

The CCPA applies to businesses with annual gross revenue exceeding $25 million, that buy or sell personal information of 100,000+ consumers, or that derive 50%+ of revenue from selling personal information. We do not currently meet these thresholds.

Regardless, we do not sell personal information and do not share personal information for cross-context behavioral advertising. We voluntarily extend the right to know and the right to delete to all users.

7. Cookies and Tracking Technologies

7.1 Cookies We Use

We also store JWT tokens in browser localStorage for API authentication. These are not cookies but function similarly for session management.

7.2 Analytics Scripts

Privacy boundary: Plausible, Clarity, and HubSpot are loaded only on marketing and authentication pages. They are never loaded on authenticated dashboard pages where financial data is displayed. This architectural boundary protects your financial data from third-party analytics scripts.

7.3 Do Not Track

We respect the Do Not Track (DNT) browser signal for optional analytics (Clarity, HubSpot). Essential cookies and PostHog product analytics (which use no PII) are not affected by DNT.

8. Special Categories of Data

8.1 Social Security Numbers (SSNs)

We collect SSNs only for the purpose of generating IRS Form 1098 (Mortgage Interest Statement) and only when a note holder enters a borrower's SSN for that purpose. SSNs are:

• Encrypted at the application level using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256) before storage in the database
• Stored as ciphertext — the database never contains plaintext SSNs
• Decrypted only when generating 1098 forms or when the note holder explicitly requests to view the full SSN
• Displayed in masked form (last four digits only) in all other contexts
• Included in data exports in decrypted form (the export is treated as a sensitive file)
• Retained for 7 years from the applicable tax year per IRS requirements, even after account termination

Note holders are responsible for obtaining their borrowers' consent before entering SSNs into the Service. We process SSNs solely at the note holder's direction for tax form generation.

8.2 Financial Information

Loan terms, payment histories, escrow balances, and other financial data are entered by note holders and processed by the Service to provide calculation and tracking tools. This data is:

• Stored in encrypted database volumes
• Accessible only to authorized members of the note holder's organization and (where applicable) the borrower through the borrower portal
• Never shared with third parties except Stripe (for payment processing) and as required by law
• Never used for credit decisions, lending, or financial advisory purposes by ServeYourNote

9. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

1. Investigate promptly to determine the scope and nature of the breach
2. Contain the breach and take steps to prevent further unauthorized access
3. Notify affected users by email within the timeframes required by applicable law:
   • Colorado: within 30 days of determining the breach occurred (C.R.S. § 6-1-716)
   • Indiana: without unreasonable delay (IC 24-4.9-3-3)
   • Other states: per applicable state breach notification law
4. Notify the Colorado Attorney General if the breach affects 500 or more Colorado residents (C.R.S. § 6-1-716(2)(b))
5. Provide details including: nature of the breach, types of information affected, steps we are taking, and steps you can take to protect yourself

Our incident response procedures are documented internally in our security policy.

10. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete that information.

If you believe a child under 18 has provided us with personal information, please contact us at support@serveyournote.com.

11. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, you understand that your data will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a revised “Last Updated” date
• Sending an email notification to the address associated with your account

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after a change constitutes acceptance of the updated policy.

13. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at:

ServeYourNote, LLC
Email: support@serveyournote.com
Address: 13320 Morse St, Cedar Lake, IN 46303

For privacy rights requests specifically, email support@serveyournote.com with the subject line “Privacy Rights Request.”