Privacy policy

Who this covers

This policy covers 37Lend: the website at www.37lend.com, the borrower portal and mobile app, and the messages we send you. It applies to visitors, to the people who apply for financing on behalf of a business, and to the owners and guarantors named on an application.

37Lend is a marketplace, not a lender. When you apply, your application goes to lenders in our network, and each lender that receives it handles your information under its own privacy notice. We tell you which lenders those are in your account.

Because we arrange financing, information about owners and guarantors is handled in line with the federal Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. This page is also our privacy notice under those laws, and it is written for the United States.

What we collect

To match a business with lenders we collect these kinds of information:

• Identity and contact details of the person applying and of each owner: name, mobile number, email, title, date of birth, home address, and Social Security number. The full number is held encrypted only until you submit, when it is passed to our funding partner for identity verification and erased here; we keep only the last four digits.
• How you sign in: your mobile number, your email address and a password, or your Google or Microsoft account, whichever you choose. A password is held by our sign-in provider, Firebase, and never reaches us. When you sign in with Google or Microsoft, we receive your name and email address from them (and from Google, a link to your profile picture). We don’t get your Google or Microsoft password, and we get no access to your mailbox, contacts, calendar, or files.
• Business details: legal name, trade name, EIN (masked after it has been used), entity type, industry, address, phone, email, website, formation date and state, revenue, and headcount.
• Financial information: how much you are asking for and what for, existing debt, the documents you upload (bank statements, tax returns, identification, and anything a lender asks for), and the bank account funds are paid into. The account number is held encrypted until you submit, passed to our funding partner, and erased here; we keep only the last four digits.
• Credit and verification information about the business and its owners, obtained with your authorization from credit bureaus and business-data providers: soft credit inquiries, business credit data, identity and business verification results.
• What lenders tell us: whether they received your application, their offers, their decisions, and closing status.
• Communications: messages with your advisor and our assistant, your notification settings, and the authorizations you gave, with their version, the time, and the IP address they came from.
• Device and usage information: IP address, browser and device type, the pages and features you use, error reports from the site (with personal details removed), and a push-notification token if you use the app.

We do not collect precise location, biometric information, or your browsing on other sites, and we run no advertising trackers. If you allow it, Google Analytics measures how our public pages are used (see Cookies) and, in the app, which screens are opened; the app asks first, and you can turn it off in Account → Usage analytics.

How we use it

We use your information to:

• verify who you are and that the business exists and is yours to apply for;
• work out which lenders and products the business is likely to be eligible for, and send the application to them;
• show you offers, record what you accept or decline, and pass the funding details to the lender you choose;
• talk to you about your application, in your inbox and account notifications and, if you allow them, by push notification;
• meet legal duties: know-your-customer and anti-money-laundering checks, record keeping under the Equal Credit Opportunity Act, and lawful requests;
• detect and prevent fraud, and keep the service secure; and
• understand how the service is used, in aggregate, and improve it.

Lenders make the credit decisions. The eligibility indications in your account come from matching your application against lenders’ published criteria and are reviewed by your advisor; they are not a credit decision and no adverse action is taken by us on the basis of them.

Credit checks

Checking your options uses a soft inquiry, which does not affect your credit score and is visible only to you on your report. You authorize it when you apply. We obtain it for the permissible purpose of a credit transaction you initiated.

A hard inquiry happens only if you accept a specific lender’s offer. Before that step the portal shows you the authorization, names the lender, and asks you to agree; it is that lender, not us, who makes the inquiry. If a lender declines you, the adverse-action notice and its reasons come from that lender.

If you believe something on your credit report is wrong, you have the right under the Fair Credit Reporting Act to dispute it with the bureau that issued it. Your advisor can tell you which bureau a report came from.

Who we share it with

We share your information with:

• Lenders and financing partners your application is sent to. Each is an independent company with its own privacy notice, and each keeps its own records of your application.
• Our funding platform partner, which processes applications, verification, and offers on our behalf and on lenders’ behalf.
• Service providers that work for us under contract: identity, credit, and business verification; bank-data and document processing; cloud hosting and sign-in (Google Cloud and Firebase); text-message and push-notification delivery; and, if you allow them, website and app analytics from Google (Google Analytics) and the scheduling calendar from HubSpot. They may use your information only to provide their service to us.
• Professional advisers, regulators, and law enforcement where the law requires it, to enforce our terms, or to protect someone’s rights or safety.
• A successor, if 37Lend is merged, acquired, or sells its assets, under this policy unless you are told otherwise.
• Anyone else you tell us to share it with.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the past twelve months.

Cookies and similar technologies

We set no cookies of our own for tracking and run no advertising trackers. What the site stores in your browser without asking is what it needs to work, plus a note of the campaign link that brought you, if any:

• your sign-in session, kept by Firebase in your browser’s storage, so you stay signed in;
• the application you are filling in, in session storage for that tab only, so a reload does not send you back to the start. It holds your sign-in id, your business’s details, and each owner’s title, share, email and phone, but never a Social Security number, the EIN, bank account or routing numbers, or an owner’s name, date of birth or home address. It is cleared once the application is sent;
• the campaign link you arrived through, if any (its name only, nothing about you), in session storage for this visit only, so the application you send can be credited to that campaign; and
• your cookie choice, so we do not ask again.

Signing in by phone uses Google’s reCAPTCHA to stop automated abuse, and Google may set its own cookies for that; see Google’s privacy policy. Signing in with Google or Microsoft happens in a window they run, under their own privacy policies. So that this window can open the moment you tap, on phones, tablets, and Safari, Firebase, our sign-in provider, gets it ready as each page of this site opens: your browser loads a small piece of Google’s code from apis.google.com and a hidden page from our sign-in domain at Firebase (lend37.firebaseapp.com). They receive what any web request carries, such as your IP address and browser type; we send nothing about you with them. There are two optional third parties, both on our public pages only and both only if you allow them in the cookie notice: Google Analytics, which sets Google’s cookies to measure which pages are visited and how (it receives your IP address, browser and device type, and the pages you view, and we do not send it your name, contact details, or anything from an application); and the booking calendar from HubSpot, which sets HubSpot’s cookies when it loads. Neither runs on the sign-in page or on your account’s pages: moving to one of those from a public page reloads it without them. They can run on our public pages while you are signed in. If you choose essential only, neither loads and the booking page is a plain link. You can change your choice at any time from “Cookie settings” in the footer.

The 37Lend app on your phone asks before it measures anything. If you allow it, Google Analytics for Firebase records which screens you open, with your app version, phone model and operating system, and an approximate location worked out from your IP address. We do not send it your name, contact details, business, or anything from an application, we do not link it to your account, and it collects no advertising identifiers. You can turn it off at any time in Account → Usage analytics, which also deletes the ID your phone was measured under.

If your browser sends a Global Privacy Control signal we treat it as a choice of essential only, without asking, even if you allowed optional cookies earlier. Choosing “all” again in Cookie settings while the signal is on overrides it for this site.

Text messages

Signing in with your phone sends a one-time code by text to the mobile number you give us, and you agree to it by entering your number. That is the only text we send: news about your application reaches you in your account and, if you allow them, as push notifications.

Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

How long we keep it

Federal lending law (Regulation B, which implements the Equal Credit Opportunity Act) requires an application record to be kept for 25 months after the applicant is told of the decision. We keep submitted applications, the authorizations you gave, and your conversations with your advisor for at least that long, and longer only if a dispute, an investigation, or another law requires it.

Applications you never submitted are yours to discard, and are erased in full, files included, when you delete them or your account. When you delete your account, submitted applications are kept for the remainder of that period without your sign-in, and purged when it ends. Conversations with our assistant are erased at once.

Underwriting data pulled for an application is kept for ninety days from the pull, and operational logs for a short period after that.

Security

Your information is encrypted in transit and at rest, and the most sensitive values are encrypted separately with keys we hold. Full Social Security, EIN, and bank account numbers are never kept in the clear: while an application is a draft they are held encrypted, and when you submit they are passed on once and erased, leaving only the last four digits. Nothing about an application reaches our funding partner or any lender until you submit it. Access inside 37Lend is limited to what a person or system needs: only your assigned advisor and the lenders you applied to can see your application.

No method of storing or sending information is perfectly secure. If you believe your account has been accessed by someone else, tell your advisor straight away. Signing out ends the session on the device you use only; deleting your account from the account page stops your sign-in working on every device.

Your rights and choices

Everyone with an account can, from the account page, without asking us:

• download a copy of everything we hold about them, as one file (Account → Your data);
• correct their profile and business details, or ask their advisor to correct anything else;
• delete their account. Your sign-in stops working at once and unsubmitted applications are erased; applications that reached lenders are kept for the period above, without your sign-in, and then purged. Lenders keep their own records; and
• change how we contact them: push notifications can be turned off on the notification settings.

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect, use, and disclose and to whom; to delete it; to correct it; to opt out of its sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only to provide the service you asked for and as the law permits); and not to be discriminated against for exercising any of these. Much of what we collect to arrange financing is covered by the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act and is outside the CCPA; the rights above apply to the rest, and we honor access and deletion requests for everything except the records the law makes us keep.

If you live in another state with a privacy law (Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, New Jersey, and others), you have comparable rights of access, correction, deletion, and portability, and the right to appeal our decision on a request. We treat requests from every state the same way.

To make a request you cannot complete from your account, or to appeal one, message your advisor from your inbox or book a time with our team. We will confirm it is you, using the sign-in and details on your account, and answer within forty-five days. You may use an authorized agent; we will ask for proof that you gave them permission. We never charge for a request.

Children

37Lend is for businesses and the adults who run them. It is not directed at anyone under eighteen, and we do not knowingly collect information from anyone under eighteen. If you believe we have, tell us and we will delete it.

Changes to this policy

When this policy changes we post the new version here with the date at the top. If a change affects how we use information you have already given us, we tell you in your account or at the contact details we hold before it takes effect.

Contact

Questions about this policy or about your information: message your advisor from your inbox if you have an account.

Otherwise: Book a time with our team.