Privacy Policy

What we collect

Account details: your name, email address, and password (stored only as a secure hash). If you choose "Continue with Google," Google shares your name, email address, and profile picture with us.
Documents you upload: Loan Estimates and Closing Disclosures, which stay in your account so you can come back to them. For a Refi Check you upload a mortgage statement, which we read once and then delete (see How long we keep it).
Answers you give us: what you tell us during a report's intake questions (for example income, debts, credit range, home value, location, and loan details), and numbers you enter in the affordability tool, including scenarios you save.
Assistant conversations: messages you send the in-app assistant, and a short profile it remembers (such as your location, loan balance, and rate) so it doesn't have to ask twice.
Purchases: what you bought, the amount, and your Stripe customer ID. Stripe collects your card details. We never see your full card number.
Email preferences and follow-ups: your watchlist settings, your newsletter subscription if you sign up, and the closing results you choose to share with us after a Refi Check.
Agent accounts: your business name, branding (such as a logo and color), the labels you give client files, and the client documents you upload for audits.
Feedback you send us.
Technical data: IP address, browser and device type, pages visited, and timestamps, collected in server logs for security and by our analytics tools (see Analytics and cookies).

What we don't collect

Your Social Security number.
Bank account numbers or full credit card numbers.
Your mortgage statement or its account number. Our reader pulls out only loan details such as your lender, rate, balance, term, payment, escrow, and PMI, never the account number, and we delete the statement file right after reading it.

Loan Estimates and Closing Disclosures are standard federal forms. They show details like your name, the property address, and the lender's loan ID, but not your Social Security number or bank account numbers.

How we use it

To produce the reports you buy and run your account.
To send the emails described in Emails we send.
To help you when you contact us.
To prevent fraud and abuse and keep the service secure.
To improve our reports using de-identified, combined statistics. For example, closing results customers share feed a rate benchmark once we have enough similar loans. Reports use only the combined figures, never anyone's name or address. The results we store stay linked to the customer's account, so they can leave their numbers out at any time: check the box on the follow-up form, or turn on "Leave my closing numbers out of the benchmark" in Settings.

We don't use your documents to train AI models, and our AI provider doesn't use them to train its models either.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We never share it with lenders, brokers, or marketers.

We use these service providers to run Mortgage Lens. Each one gets only what it needs to do its job:

Vercel hosts the site and app, so every request passes through it (including your IP address and browser details). Vercel Web Analytics counts page views.
Neon hosts our database: your account, reports, the details we read from your documents, and chat history.
Cloudflare R2 stores uploaded documents, report PDFs, and agent logos.
Anthropic provides the AI that reads your documents, writes report explanations, powers the assistant, and helps us review reports for quality. It receives document contents, your answers, report text, and chat messages. In the affordability tool, it receives any text you type or paste into "Describe it in your own words" (to fill in the form for you to check) and the calculated results, not the numbers you entered, to write the plain-English read. Under its commercial terms, it doesn't use this data to train its models.
Stripe processes payments. It receives your email address, what you bought, and the payment details you enter at checkout.
Resend sends our emails. It receives your email address and the content of each email.
PostHog provides product analytics. It receives the pages you visit, a few product events (such as signing up or starting checkout), and your device and browser type. When you're signed in, these events are linked to your account ID, not your name or email address. See Analytics and cookies.
Google handles sign-in, only if you choose "Continue with Google."

Agent share links. A real estate agent who subscribes to Mortgage Lens can upload a client's Loan Estimate and Closing Disclosure and share a white-labeled report through a link. Anyone with that link can view the report until the agent turns the link off.

Legal requests and business changes. We may disclose information when the law requires it or to protect the rights and safety of our users or others. If Mortgage Lens is ever sold or merged, your information would transfer under this policy, and we'd tell you before it's used in a different way.

Analytics and cookies

We use two analytics tools to see which pages and features people use, so we can improve them. Neither is used for advertising.

PostHog records the pages you view (the page address and the page you came from) and a few product events, such as signing up or starting checkout. It uses a first-party cookie and an entry in your browser's local storage to recognize a returning browser. When you're signed in, events are linked to your account ID, not your name or email address. It doesn't record your screen, doesn't automatically capture your clicks or typing, and doesn't show surveys.
Vercel Web Analytics counts page views without cookies.

Before anything is sent to either tool, we remove private-link tokens (from share, watchlist, and follow-up links) and secret values in page addresses, such as password-reset tokens, checkout session IDs, and email addresses.

Opting out. Use the "Analytics opt-out" control in the site footer, under Legal. It turns off PostHog and Vercel Web Analytics in that browser and clears the identifiers PostHog stored. The choice is saved in your browser's local storage, so if you clear your browser data or switch devices, you'll need to opt out again. To undo it, use the same control, which then reads "Turn analytics back on."

Cookies and browser storage. Here's what we keep in your browser:

A sign-in session cookie that keeps you signed in, plus short-lived security cookies while you sign in.
Your light or dark theme choice (local storage).
PostHog's first-party cookie and local storage entry, only while analytics is on.
Your analytics opt-out choice, if you opt out (local storage).
A chat you're in the middle of, so it isn't lost if you reload the page. Signing out clears it.

When you check out, Stripe sets its own cookies on its payment page to prevent fraud. We don't use advertising cookies or cross-site tracking.

Storage and security

Your data is encrypted in transit (HTTPS) and encrypted at rest by our database and storage providers. Your documents and reports open only for your signed-in account, apart from agent share links (described above). A small number of people at Mortgage Lens can access data when it's needed to help you, fix a problem, or keep the service secure.

No system is perfectly secure. If we learn of a breach that affects your information, we'll notify you as the law requires.

Mortgage Lens is for people in the United States. We and our service providers process data primarily in the United States.

How long we keep it

Your account, uploaded Loan Estimates and Closing Disclosures, reports, and chat history: kept while your account is open, so you can come back to them later (for a refinance years from now, a tax question, or a dispute with a lender). We don't delete them on a schedule.
Mortgage statements: deleted right after we read them. We keep only the loan details we pulled out.
Payment records: Stripe keeps its own records of your payments, as payment processors are required to. Deleting your Mortgage Lens account doesn't delete them.
Server logs: kept by our hosting provider for a limited time on its own schedule.
Backups: data you delete can remain in our database and file-storage backups for up to 30 days, until those backups roll off.

Deleting your data

Delete a report: use the Delete option next to the report on your dashboard. It permanently removes the report and its PDF. The documents you uploaded for it stay in your account until you delete them as described below.
Delete an uploaded document: remove it from its workspace before a report uses it. Once a finished report depends on it, email hello@mortgagelens.ai and we'll remove it.
Delete a client audit (Agent Portal): choose Delete next to the audit on your Agent Portal. It permanently deletes the audit, its report PDFs, and the documents you uploaded for it, and its share link stops working. You can't delete an audit while its report is being made or a document is still being read, and deleting one doesn't add an audit back to your plan's allowance.
Delete a saved affordability scenario: open the affordability tool and choose Delete next to it under "Your saved scenarios." It permanently removes that scenario.
Delete your account: go to Settings and choose Delete account. It permanently removes your account, reports, uploaded documents, chat history, saved affordability scenarios, watchlists, and follow-ups. When we know the email address is yours (you sign in with Google, or you have used a password reset link we emailed you), it also unsubscribes that address from the newsletter; otherwise, use the unsubscribe link in any issue. An address we unsubscribe, or one already on our do-not-email list, is kept only so we never email it again. If you pay for an Agent Portal subscription, it is canceled immediately. This can't be undone.
Stop emails: pause or stop watchlist emails from the link in any of them, turn off follow-up emails from the link in the follow-up, and unsubscribe from the newsletter with the link in any issue.

Emails we send

Account emails you need or ask for, such as a password reset.
Watchlist emails. If your Refi Check says to wait or not to refinance, we check rates every day. Once the 30-year average has dropped at least 0.25 points, we re-run your numbers and email you only if refinancing would then save at least $150 a month and earn back closing costs within 3 years (and within half the time you plan to stay), at most once every 30 days. After a Buyer Check, we check in about 3, 6, and 12 months later, and sooner (at most once every 60 days) if rates drop enough to change what you can afford. They run for up to 12 months after your latest Check (a Refi Watchlist ends sooner if you tell us you've refinanced), and every watchlist email has a link to pause or stop it. Unsubscribing stops all watchlist emails, including for Checks you run later.
A follow-up about a month after a Refi Check, asking whether you refinanced and, if you did, your final rate and costs. Answering is optional. The form has a checkbox to keep your numbers out of our rate benchmark (see How we use it), and the email has a link to stop follow-ups.
Our newsletter, only if you sign up for it. Buying a report never signs you up. Every issue has an unsubscribe link.
Bounces and spam reports. If an email to your address bounces permanently or is reported as spam, we keep the address on a do-not-email list so we don't send it our newsletter, watchlist emails, or follow-ups again.

Your privacy rights

You can ask us to show you the personal information we have about you, give you a copy, correct it, or delete it. Email hello@mortgagelens.ai from the address on your account. We'll confirm the request came from you and respond within 45 days. You can also use an authorized agent; we may ask for proof that you authorized them. We won't treat you differently for using these rights.

If you live in California or another state with a consumer privacy law, these rights apply to you under that law. We don't sell or share personal information as those laws define it. We use the financial details you give us only to provide the service you asked for and, once de-identified and combined with others, to improve our reports.

Children

Mortgage Lens is for adults. It isn't meant for anyone under 18, and we don't knowingly collect personal information from children under 13. If you think a child has given us information, email us and we'll delete it.

Changes to this policy

We may update this policy. If we make a material change, we'll email customers with an active account before it takes effect and update the date at the top of this page.

Contact us

Questions or requests about your privacy? Email hello@mortgagelens.ai.