Privacy Policy

1. Information We Collect

• Account information: Name, email address, and credentials you provide when registering.
• Loan and pipeline data: Borrower names, loan types, amounts, credit tiers, and related mortgage application details.
• Financial data via Plaid: When a borrower connects a bank account through Plaid Link, we receive account information, transaction history, income data, and asset data as permitted by explicit consent.
• Usage data: Pages visited and features used, collected automatically for service improvement.
• Email you forward to us (optional): If you set up your private FundShift forwarding address, we keep only messages to or from contacts already in your FundShift account (borrowers, realtors, past clients) and attach them to the right conversation. Every other forwarded message is discarded on arrival and never stored. You can stop at any time by turning off forwarding in your email settings.

2. How We Use Your Information

• To provide, operate, and improve the FundShift platform.
• To perform income and asset verification for mortgage pre-qualification purposes.
• To generate AI-powered lead scores, drafts, and insights for loan officers.
• To send transactional emails and platform notifications.
• To comply with legal obligations and enforce our Terms of Service.

3. Consent

We obtain explicit consent before collecting, processing, or storing financial data. Plaid Link is only presented to authenticated users who have agreed to our Terms of Service. You may withdraw consent at any time by contacting us at t.allman@allshiftai.com.

4. Data Sharing

We do not sell, rent, or license your personal information or financial data to third parties. We share data only with:

• Plaid Technologies, Inc.: To facilitate financial account connections.
• Service providers: Supabase (database), Vercel (hosting), Resend (email), Stripe (payments), Twilio (calls and messaging), and Google (calendar sync, only if you connect it).
• Legal authorities: When required by law or to protect user rights and safety.

5. Google User Data

Connecting your Google account is optional, and every other FundShift feature works without it. If you choose to connect it, FundShift requests these permissions and uses each one only for the purpose listed:

• Google Calendar (calendar.events): to create, update and cancel the borrower consultations you schedule from a deal, and to keep meetings you change in Google in sync with your FundShift pipeline, including rate-lock and closing dates.
• Send email as you (gmail.send): only when you press Send on a reply you wrote in the FundShift inbox, so the borrower receives it from your own address. FundShift never sends email from your account on its own.
• Google Contacts (contacts.readonly): to import your existing contacts as past clients so you can recognise returning borrowers. Imported contacts are never emailed or marketed to unless you separately record their consent.
• Your email address (userinfo.email): to show which Google account is connected.

• What we store: an encrypted Google refresh token, the event identifiers and meeting details needed to keep the calendars in sync, the messages you send from FundShift, and the name and email of imported contacts. We do not copy your wider calendar history, and we do not read your Gmail inbox.
• What we never do: we do not sell or rent Google user data, do not use it for advertising, do not let people read it except with your permission, for security, or to comply with law, and do not use it to train generative AI or machine-learning models.
• Revoking access: disconnect at any time under Settings → Connections, or revoke access directly at myaccount.google.com/permissions. Disconnecting deletes the stored refresh token immediately.

FundShift's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Security

All data in transit is encrypted using TLS 1.3. All data at rest is encrypted using AES-256. Access to production systems is restricted to authorized personnel and protected by multi-factor authentication.

7. Data Retention and Deletion

We retain personal and financial data only as long as necessary. You may request deletion of your data at any time by emailing t.allman@allshiftai.com. We will process deletion requests within 30 days. This policy is reviewed annually for compliance with CCPA and GLBA.

8. Your Rights

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your data.
• Portability: Request your data in a portable format.
• Opt-out: Opt out of non-essential communications at any time.

Contact: t.allman@allshiftai.com

9. Cookies

We use session cookies necessary to maintain authenticated sessions. We do not use third-party advertising trackers.

10. Contact

AllShift AI, Inc.
t.allman@allshiftai.com