Privacy Notice · Lendingo

Scope

This notice applies to the current Lendingo application and its authentication routes. The current release verifies identity and checks whether approved staff or invited borrowers have eligible access. It does not display borrower, deal, document, or underwriting records.

Our public website has a separate website privacy policy. Financing documents and transaction-specific notices may separately apply to a loan request.

Information we handle

Google identity information for approved staff: the Google Account identifier, email address, name, and profile-image URL that Google and our authentication provider return during sign-in.
Invited-borrower identity information: the email address used to request a secure sign-in link and the resulting authentication record.
Access information: the Lendingo person, organization, role, invitation, activation state, and Supabase user ID used to determine eligible access.
Session and security information: session cookies and request or security logs processed to operate and protect the application.

Google user data

For staff sign-in, the application requests only OpenID, email, and profile permissions. Supabase Auth stores the resulting identity record, which can include the Google Account identifier, email address, name, and profile-image URL. Lending Deck links the Supabase user ID—not a Google access token—to an existing Lendingo person record.

Lendingo uses this data only to authenticate the user, match the user to an approved account, maintain a secure session, and enforce access. The application does not request access to content in Gmail, Google Drive, Contacts, Calendar, or other Google services. Lendingo does not call Google APIs with a provider access token or copy a provider access token into its application database.

Google user data is not used to evaluate creditworthiness, determine loan eligibility, underwrite a loan, set pricing, make a lending decision, serve advertising, or sell personal information.

How we use information

Authenticate approved staff and invited borrowers.
Match a verified identity to an existing Lendingo record.
Check membership, role, invitation, and activation state.
Maintain sessions, prevent misuse, and troubleshoot failures.
Respond to application support and privacy requests.

Storage and service providers

Google performs Google Sign-In. Supabase provides authentication and stores the identity, session, invitation, and access-link records. Vercel hosts the application and may process request and security logs. These providers process information to deliver their services to Lendingo under their applicable agreements and privacy terms.

The current application does not share Google identity information with capital partners for underwriting, credit, pricing, or lending decisions. We may disclose information when required by law or needed to investigate fraud, abuse, or a security incident.

Retention and choices

Identity, invitation, access-link, and security records are retained while needed to provide or protect an authorized account and to meet applicable recordkeeping obligations. Retention can vary by record type and account status.

You can sign out at any time and can revoke Lendingo's connection from your Google Account settings. Revocation prevents future Google Sign-In until you authorize the connection again, but does not itself delete Lendingo or security records.

To request access, correction, or deletion, email notices@lendingo.io. Requests are subject to identity verification and applicable recordkeeping obligations.

Security

The application uses encrypted network connections, server-managed sessions, and role- and relationship-based access checks. No system can guarantee absolute security.

Updates to this notice

We will update this notice when the application's functionality or Google-data practices change and will post the revised date here.

Contact

For privacy questions or requests, email notices@lendingo.io or call (800) 547-9080.