LenderHub ("we," "us," or "our") operates an equipment financing technology platform that connects businesses seeking equipment financing with participating lenders. This Privacy & Security Policy describes how we collect, use, disclose, and protect your personal and financial information.
Our commitment: LenderHub is purpose-built for financial data. Unlike general-purpose CRMs adapted for lending, our platform was architected from the ground up with financial-grade security, privacy-first data handling, and regulatory compliance at every layer.
1. Information We Collect
Information you provide directly: Contact information (name, email, phone), business details (entity name, EIN, years in business, USDOT number), equipment and financing needs, Social Security Number (for credit inquiry purposes only), date of birth, home address, bank account information (for ACH authorization), and uploaded documents including bank statements, tax returns, and equipment quotes.
Information from third parties: Consumer and commercial credit reports obtained via soft inquiry (which does not affect your credit score), FMCSA SAFER carrier data, equipment valuation data, and referral source information from bank or dealer/vendor partners.
Information collected automatically: Device type and browser information, IP address, pages visited and usage patterns, session duration, and cookies necessary for platform functionality.
2. How We Use Your Information
We use the information we collect to: process and evaluate your financing application; perform soft credit inquiries with your authorization; generate AI-powered credit analysis and risk scoring; match your application with lenders whose criteria align with your profile; communicate with you about your application status; generate lease and financing documentation; improve our matching algorithms and platform performance; prevent fraud and unauthorized access; and comply with applicable federal, state, and local laws and regulations.
AI Processing: LenderHub uses artificial intelligence (Claude by Anthropic) to analyze uploaded documents, generate credit assessments, and produce lender-facing credit memoranda. AI processing occurs on Anthropic's SOC 2 certified infrastructure. Your documents are processed in real time and are not used to train AI models. Anthropic's data handling is governed by their enterprise terms of service, which prohibit retention of customer data beyond the processing request.
3. How We Share Your Information
We do not sell, rent, or trade your personal information to any third party for marketing purposes. Period.
With matched lenders (2-4 maximum): When your application matches a lender's criteria, we share a Borrower Intelligence Package containing your credit analysis, financial summary, and equipment details. Lenders receive only the information necessary to evaluate your application. Lenders may not contact you directly unless you explicitly authorize contact through the platform.
With referral partners: Partners who referred your application receive status updates only (application received, matched, under review, funded). Partners never receive your financial details, credit information, SSN, bank statements, or any personally identifiable financial data.
With infrastructure and service providers: We use third-party services to operate our platform, all of which are contractually bound to protect your data: Netlify (hosting and serverless functions), Supabase (database and file storage), Anthropic (AI document analysis), Resend (transactional email), and Clerk (authentication). Each provider maintains their own security certifications and is prohibited from using your data for any purpose other than providing services to LenderHub.
4. Credit Information Handling
Soft inquiry only: LenderHub obtains a soft credit inquiry that does not affect your credit score and is not visible to other creditors. You authorize this inquiry when you submit your application.
SSN protection: Your Social Security Number is encrypted using AES-256 encryption immediately upon submission. It is transmitted exclusively over TLS 1.3 encrypted channels, used solely for the purpose of obtaining the authorized credit inquiry, and is never stored in plaintext at any point in our system. SSN data is purged from our active systems after the credit inquiry is completed and is retained only in encrypted backup archives for the minimum period required by applicable law.
Hard inquiries: If you choose to proceed with a matched lender, that lender may perform their own hard credit inquiry independently and subject to their own privacy policies. LenderHub does not perform hard inquiries.
5. Platform Security Architecture
LenderHub's security architecture is designed to meet or exceed the standards expected of financial technology platforms handling sensitive borrower data. Our security posture is built across six layers:
5.1 Encryption & Data Protection
In transit: All data transmitted between your browser and our servers is protected by TLS 1.3 encryption (256-bit) — the same standard used by major financial institutions. Our domain enforces HTTPS at the registry level (HSTS preloaded), meaning unencrypted connections are physically impossible.
At rest: All stored data — including application records, uploaded documents, credit reports, and database contents — is encrypted using AES-256 encryption at the storage layer. Database encryption is handled by Supabase on AWS infrastructure with automatic key rotation.
Sensitive fields: SSN, bank account numbers, and routing numbers receive an additional layer of application-level encryption beyond the storage encryption, ensuring that even database administrators cannot view these values in plaintext.
5.2 Infrastructure Security
Hosting: LenderHub is hosted on Netlify's enterprise infrastructure, which operates on AWS and Google Cloud with SOC 2 Type II certification. Netlify provides automatic DDoS mitigation, global CDN with edge security, and isolated serverless function execution environments.
Database: Supabase provides our database layer, running on AWS infrastructure in SOC 2 certified data centers. Database access requires authenticated connections over encrypted channels. Point-in-time recovery ensures data can be restored in the event of any incident.
No shared tenancy risk: Unlike platforms built on multi-tenant CRMs (Salesforce, HubSpot) where your financial data shares infrastructure with millions of non-financial users, LenderHub's infrastructure is dedicated to financial data processing. Every component — from the serverless functions that process your application to the database that stores your records — is purpose-built for equipment finance. There is no risk of cross-tenant data leakage from unrelated applications.
5.3 Access Control & Authentication
Role-based access control (RBAC): Every user has a defined role with specific permissions. Borrowers see only their own application and matched offers. Partners see referral status only — never financial details. Lenders see credit memos only for deals matched to their criteria. Internal administrators have tiered access with audit logging.
Authentication: User authentication is managed by Clerk, which provides enterprise-grade identity management including multi-factor authentication (MFA), session management, brute-force protection, and device verification.
Principle of least privilege: No user — including LenderHub administrators — has access to more data than their role requires. Internal access to production data requires multi-factor authentication and is logged and auditable.
5.4 AI & Document Processing Security
Processing model: When you upload documents (bank statements, tax returns, credit reports), they are processed by Claude AI via Anthropic's enterprise API. Documents are transmitted over encrypted channels, processed in isolated compute environments, and are not retained by Anthropic after processing is complete.
No model training: Your documents and financial data are never used to train, fine-tune, or improve AI models. Anthropic's enterprise terms explicitly prohibit the use of customer data for model training.
Output containment: AI-generated analysis (credit scores, risk assessments, credit memoranda) is stored within LenderHub's encrypted database and shared only according to the access control rules described in this policy.
5.5 Network & Application Security
HTTPS enforcement: The .app top-level domain enforces HTTPS via HSTS preloading at the browser level. Combined with our TLS 1.3 implementation, this eliminates the possibility of man-in-the-middle attacks or data interception.
DDoS protection: Distributed denial-of-service attacks are mitigated automatically at the CDN edge before reaching our application servers.
Input validation: All user inputs are sanitized and validated server-side to prevent SQL injection, cross-site scripting (XSS), and other common web application vulnerabilities.
API security: All API endpoints require authenticated requests with valid session tokens. Rate limiting prevents abuse. CORS policies restrict which domains can interact with our APIs.
5.6 Monitoring, Logging & Incident Response
Audit logging: All access to sensitive data — including application views, document downloads, credit report access, and administrative actions — is logged with timestamps, user identity, and IP address. Logs are retained for a minimum of one year and are available for compliance review.
Monitoring: Infrastructure and application health are monitored continuously. Automated alerts trigger on anomalous access patterns, failed authentication attempts, and system errors.
Incident response: In the event of a confirmed security incident, LenderHub will notify affected users within 72 hours as required by applicable law, provide a description of the incident and data involved, detail remediation steps taken, and offer guidance on protective actions users should take.
6. Why Purpose-Built Security Matters
Many equipment finance platforms are built on top of general-purpose CRM systems (Salesforce, HubSpot, Zoho) that were designed for sales and marketing — not for handling SSNs, credit reports, and bank statements. While these platforms offer their own security features, they introduce additional risk vectors:
Multi-tenant exposure: Your financial data shares the same infrastructure as millions of non-financial tenants. A vulnerability in any tenant's customization can potentially affect the platform. LenderHub's infrastructure handles only financial data for equipment finance transactions.
Third-party app marketplace risk: General CRMs have extensive app marketplaces where third-party plugins can access customer data. Each installed plugin expands the attack surface. LenderHub uses no third-party plugins or marketplace extensions — every component is built and maintained by our team.
Over-permissioned access: Generic CRMs often require broad data access permissions to function, meaning more people have access to more data than necessary. LenderHub's access model was designed specifically for the borrower-partner-lender relationship, ensuring each party sees only what they need.
Data residency control: With a purpose-built platform, we control exactly where your data is stored, how it's processed, and which services can access it. On a shared CRM platform, data flows through the CRM provider's global infrastructure in ways that may not be transparent to the end user.
7. Data Retention & Deletion
Active applications: Application data is retained for the duration of the financing process plus 12 months after the last activity on the deal.
Funded transactions: Records for funded transactions are retained for 7 years from the transaction date as required by applicable financial regulations.
Declined or withdrawn applications: Data from applications that do not result in funding is retained for 25 months (to allow for re-application) and then permanently deleted unless a longer retention period is required by law.
Deletion requests: You may request deletion of your data at any time. We will comply within 30 days, subject to any legal retention requirements. Deletion is irreversible and includes all application data, uploaded documents, and credit analysis results.
8. Your Rights
You have the right to: access all personal information we hold about you; correct any inaccurate information; request deletion of your data (subject to legal retention requirements); opt out of non-essential data sharing; receive a copy of your data in a portable format; and withdraw consent for credit inquiries at any time before they are initiated.
To exercise any of these rights, contact us at privacy@lenderhub.app.
9. Regulatory Compliance
LenderHub is designed to operate in compliance with applicable federal and state regulations governing the handling of consumer financial information, including the Gramm-Leach-Bliley Act (GLBA) safeguards for nonpublic personal information, the Fair Credit Reporting Act (FCRA) requirements for permissible purpose and adverse action, Equal Credit Opportunity Act (ECOA) non-discrimination requirements, and applicable state privacy and data breach notification laws.
LenderHub is not a lender, broker, or financial institution. We operate as a technology marketplace that facilitates connections between borrowers and independent lenders. All lending decisions are made by the individual lenders, not by LenderHub or its AI systems.
10. Text Message (SMS) Communications
If you provide your mobile number and consent — for example, by checking the text-message consent box on our online application — Bulldog Truck Sales and Milton Funding LLC, and their representatives and servicers, may send you text (SMS) messages about your application and account, such as questions about your application, document requests, status updates, payment reminders, payment confirmations, and servicing and collection communications. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time.
We do not sell, rent, or share your mobile phone number or your SMS opt-in / consent information with any third parties for their own marketing purposes. Mobile information is used only to provide the account and servicing messages you have consented to, and is shared only with the service providers (such as our SMS delivery provider) needed to send those messages on our behalf.
11. Changes to This Policy
We may update this Privacy & Security Policy from time to time. Material changes will be communicated via email to registered users and posted on our website with an updated effective date. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.
12. Contact Information
LenderHub
Privacy & Security Inquiries: privacy@lenderhub.app
General: info@lenderhub.app
Phone: (678) 778-4744
