Privacy Policy

1. Information We Collect

Account Information. When you create an account, we collect your name, email address, password (stored in hashed form), brokerage or company name, business type, and subscription plan selection.

Client Data. Account Users may store information about their clients and prospects in the Services, including names, contact information, property addresses, loan-related details, notes, documents, and communication logs. This data belongs to the Account User’s organization and is processed by us solely to provide the Services.

Documents Uploaded by Clients. When an Account User requests documents from a client, the client may upload files through a secure, expiring link. These files are stored in private, access-controlled storage and are accessible only to the requesting Account User’s organization.

Billing Information. Payments are processed by Stripe, our payment processor. We do not store full payment card numbers. We retain subscription status, plan, and billing history.

Usage and Technical Information. We collect standard technical information such as log data, device and browser type, and error diagnostics (via our error monitoring provider, with personally identifiable information scrubbed).

2. Sensitive Information We Deliberately Do Not Store

Social Security Numbers are never stored. If an imported file (such as an industry-standard loan data file) contains a Social Security Number, it is stripped during import and never written to our systems. Raw import files are parsed against a strict allowlist of fields and are not retained.

We do not read email inboxes. Email integrations are send-and-log only (see Section 4).

3. How We Use Information

We use information to: provide, maintain, and improve the Services; authenticate users and secure accounts; process subscriptions and payments; send service-related communications; provide customer support; and comply with legal obligations. We do not sell personal information. We do not use Client Data for advertising.

4. Third-Party Integrations

The Services allow Account Users to connect third-party accounts. All connections are optional and authorized by the Account User via OAuth or similar mechanisms:

• Google (Calendar and Gmail). If connected, we access Google Calendar to provide two-way calendar synchronization, and Gmail solely to send emails the Account User composes and to log those sent emails. We do not read, retrieve, or analyze inbox contents. Marino Flow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Microsoft (Outlook Calendar and Mail). Same pattern as Google: two-way calendar sync and send-only email. We do not read inbox contents.
• Telecommunications provider. If connected, we synchronize the Account User’s business text-message conversations and enable calling and texting from within the Services. Disconnecting the integration deletes the synchronized messages from our systems.
• Property data providers. Property search and reporting features retrieve publicly available and licensed property information from third-party data providers. Search results may be cached temporarily to improve performance.
• Stripe. Handles payment processing. Stripe’s handling of your payment information is governed by Stripe’s privacy policy.

Disconnecting an integration revokes our access and deletes associated synchronized data from our systems, as described in the product.

5. Data Isolation and Security

Client Data is isolated per organization: each organization’s data is segregated using database-level access controls (row-level security), and users can only access data belonging to their organization. Documents are stored in private storage buckets with short-lived, signed access URLs. Data is encrypted in transit. Access to production systems is restricted.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your information using industry-standard practices.

6. Data Retention and Deletion

Account Users control their Client Data and may delete leads, documents, and other records at any time; deleted leads are recoverable from Trash for 30 days and then permanently purged. When an organization’s account is terminated, we delete or de-identify its data within a commercially reasonable period, except where retention is required by law. Expired or revoked client upload links cease to function immediately.

7. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information. Account Users can exercise most of these directly in the product. Clients of our Account Users should direct requests to the brokerage or professional they work with, as that business controls their data; we will assist our Account Users in fulfilling such requests. You may also contact us directly at privacy@marinoflow.com.

8. Children

The Services are business tools intended for adults and are not directed to children under 18. We do not knowingly collect information from children.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the Services or email. Continued use after changes take effect constitutes acceptance.

10. Contact

Marino Flow LLC · privacy@marinoflow.com · marinoflow.com