Under Contract Back to home

Privacy Policy

Last updated October 22, 2026

This Privacy Policy explains how Under Contract LLC, a Florida limited liability company ("Under Contract," "we," "us," or "our"), collects, uses, shares, and protects information through undercontractllc.com (the "Website") and the Under Contract software platform, including the loan officer, processor, and realtor workspaces (the "Platform").

1. Who is responsible for what

  1. Business Users control their client data. Loan officers, processors, brokerages, real estate agents, transaction coordinators, and teams that use the Platform ("Business Users") decide what information about their clients and contacts goes into the Platform. For that information ("Business Data"), the Business User is the controller, and Under Contract acts as its service provider, processing the data only on the Business User's instructions and under our Data Processing Addendum.
  2. Consumers. If you are a borrower, buyer, seller, or other consumer, your loan officer or agent is usually the business responsible for your information. When you use a consumer-facing screen, such as a status link or an earnest money screen, the separate Consumer Terms and Privacy Notice shown on that screen also apply, and they control if they conflict with this Policy.
  3. Under Contract as controller. We are responsible for Business User account and billing data, Website visitor data, and Platform usage and security data.

2. Information we collect

  1. Website visitors. The public Website does not use advertising cookies, analytics trackers, or tracking pixels. Our hosting provider processes standard connection data, such as IP address, browser type, and the pages requested, to deliver the Website and protect it from abuse. The "Track My Loan" demo on the Website runs entirely in your browser; codes you type there are not sent to us or stored.
  2. Business User account data. Name, business name, email, phone, license and NMLS numbers, billing details, and sign-in credentials.
  3. Business Data. Contact, client, and lead records, deal and loan milestones, documents, messages, notes, and related records a Business User enters or uploads.
  4. Consumer data on consumer-facing screens. Information a consumer provides directly, such as contact details, identity-verification results from our verification providers, bank-link tokens and masked account details from our payment and identity processors, and payment instructions. We do not take custody of, hold, or control consumer funds.
  5. Usage and device data. Log data, IP address, device and browser details, and feature-usage events, used for security, support, and improving the Platform.
  6. Messaging records. Delivery records, consent records, opt-out (STOP) status, and quiet-hours decisions.

We do not intentionally collect sensitive categories of information that the Platform does not need, and Business Users must not upload information they are not permitted to process.

3. How we use information

We use information to provide, secure, support, and improve the Platform; to authenticate users; to send messages and instructions only when an authorized Business User takes an explicit action; to apply compliance controls such as suppression lists, quiet hours, and consent records; to prevent fraud and abuse; to bill; and to comply with law. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Nonpublic personal information (GLBA)

Much of the information in the Platform is "nonpublic personal information" under the Gramm-Leach-Bliley Act (GLBA) that our Business Users, as financial institutions, receive from their customers.

  1. Service-provider limits. We use and disclose nonpublic personal information we receive from a financial institution only to perform services for that institution and as otherwise permitted by the reuse and redisclosure limits of the GLBA privacy rules (Regulation P, 12 C.F.R. § 1016.11). We do not use it for our own marketing.
  2. Safeguards. We maintain a written information security program with administrative, technical, and physical safeguards designed to meet the FTC Safeguards Rule (16 C.F.R. Part 314) and applicable state law. Section 8 describes key controls.
  3. Your institution's notice. Your loan officer's company provides its own GLBA privacy notice, which explains how it shares your information.

5. Consumer reports (FCRA)

  1. Permissible purpose. Where consumer report information passes through the Platform, it is used only for the permissible purpose of the Business User that obtained it under Section 604 of the Fair Credit Reporting Act (15 U.S.C. § 1681b). We do not resell consumer reports or furnish information to consumer reporting agencies.
  2. Opting out of prescreened offers. Consumers can stop credit bureaus from using their files for prescreened ("firm") offers of credit and insurance by visiting optoutprescreen.com or calling 1-888-5-OPT-OUT (1-888-567-8688). Under the Homebuyers Privacy Protection Act, effective March 5, 2026, most mortgage "trigger leads" are already restricted, but creditors with an existing relationship with you may still receive them.

6. Mobile messaging (SMS)

  1. Consent. If you give your mobile number through an Under Contract deal portal, open house sign-in, or milestone notification request, you authorize Under Contract LLC and your assigned loan officer or real estate agent to send automated transactional text messages about your transaction milestones, contingencies, and closing documents. Consent is not a condition of any purchase or loan.
  2. Frequency and cost. Message frequency varies with loan and transaction activity. Message and data rates may apply.
  3. Opting out and help. Reply STOP at any time to stop messages; you will receive one confirmation and no further messages from that program. Reply HELP for help, or email support@undercontractllc.com. A STOP is recorded against your phone number and the Platform is designed to block further messages to it.
  4. Quiet hours. The Platform is designed to block messages outside 8:00 a.m. to 8:00 p.m. in the recipient's local time.
  5. Carriers. Mobile carriers are not liable for delayed or undelivered messages.
  6. No sharing of mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing in this Policy and will not be shared with any third parties, except the messaging providers that deliver the messages for us.

7. How we share information

We share information only as needed:

We do not share one Business User's data with another Business User except where both are working on the same transaction and a Business User directs it. Customer separation is enforced in the application and by database row-level security.

8. Security

Our controls include encryption in transit (TLS) for connections to the Website and Platform; encryption at rest for stored credentials and per-customer secrets; customer isolation enforced by PostgreSQL row-level security; role-based access controls; and audit logs for compliance events. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected Business Users of a security incident involving their data without undue delay, consistent with Fla. Stat. § 501.171 and other applicable law.

9. Aggregated and de-identified data

We create aggregated, de-identified data, such as benchmarks and analytics, from Platform use ("Derived Data"), as described in Section 9.3 of the Platform Terms. Derived Data excludes individual-level personal information. Any Derived Data output must describe at least five people or records (a k-anonymity floor of k = 5), we do not attempt to re-identify anyone, and we contractually bar recipients from trying. Derived Data is never sold or priced per consumer or per referral.

10. Retention and deletion

We keep Business Data for the term of the Business User's agreement and as needed for the purposes in this Policy, and we keep compliance and audit records for the periods the law requires. Where a record must stay in a tamper-evident audit ledger, we delete personal information by overwriting it with a placeholder while keeping the ledger intact.

An honest limitation: deletion takes effect in the live system right away, and a deleted record is never restored into live use. A copy may remain in an archival backup until that backup ages out of its retention window and is overwritten. We do not promise more than this.

11. Your choices and rights

  1. Business Users can access, correct, export, and request deletion of their Business Data through the Platform or by contacting us.
  2. Consumers can ask their loan officer or agent, or contact us, to access, correct, or delete their information, or to exercise any other right available under applicable law, such as the California Consumer Privacy Act where it applies. Some information is exempt from these rights because it is covered by the GLBA or must be retained by law. We will verify requests before acting on them, and we will not discriminate against you for exercising a privacy right.

12. Children

The Website and Platform are business tools and are not directed to children. We do not knowingly collect personal information from children under 13.

13. Changes

We may update this Policy. We will post the new version here with a new "Last updated" date and give notice of material changes where the law requires.

14. Contact

Privacy questions or requests: privacy@undercontractllc.com. Under Contract LLC, a Florida limited liability company, Document No. L26000533516.