Privacy Policy

This Privacy Policy describes how Borrova (“Borrova,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our website, applications, and related services (collectively, the “Services”). It also explains your rights and choices regarding that information.

Where we process personal information on behalf of a lender, broker, or other business customer, we do so to provide the Services to that customer. The customer determines how it uses that information and is responsible for its own privacy notices and obligations. This policy does not replace the privacy notice of your lender or other financial services provider.

The personal information we collect depends on how you interact with the Services and the information you or our customers provide. It may include:

• Contact and account information. Name, email address, telephone number, mailing address, organization, account credentials, and preferences.
• Application and financial information. Property details, employment, income, assets, liabilities, financial account information, tax records, and other information contained in applications and supporting documents.
• Identification and other sensitive information. Date of birth, Social Security number, government-issued identification, and demographic or other sensitive information where requested by a customer and provided through the Services.
• Documents and communications. Files, messages, correspondence, electronic signatures, consent records, and related activity records.
• Device and usage information. IP address, browser and device information, access times, interactions with the Services, and delivery and error logs.

We collect information directly from you when you create an account, complete a form, upload a file, communicate through the Services, or contact us. We also receive information from our customers and their authorized users, including information they provide about applicants and other individuals.

We collect certain information automatically when you use the Services. If you connect a third-party account, we receive information from that provider in accordance with the permissions you authorize.

We use personal information for the following purposes:

• Provide, operate, maintain, and improve the Services.
• Create and manage accounts, authenticate users, and administer access.
• Process and organize applications, documents, and related records.
• Deliver communications, respond to inquiries, and provide customer support.
• Monitor service performance, troubleshoot issues, and prevent fraud and misuse.
• Comply with legal obligations, enforce agreements, and protect rights and security.

Where enabled, automated document-processing features analyze submitted files to assist with document checks and organization. These features do not make or recommend lending decisions.

We may disclose personal information in the following circumstances:

• Customers and authorized recipients. To the business customer on whose behalf information is submitted, its authorized users, and recipients you or that customer select when using the Services.
• Service providers. To providers that support hosting, storage, authentication, email delivery, and document processing. These include Supabase and Resend. Connected email services use Google or Microsoft. Enabled document-analysis features send submitted files and instructions through Lovable’s AI gateway to the model provider serving the request.
• Service operation and support. Authorized Borrova personnel and service providers may access information as needed to operate the Services, provide support, investigate issues, or comply with legal obligations.
• Legal and security purposes. Where required by law or legal process, or as necessary to protect the rights, property, or safety of Borrova, our customers, or others, and to detect or address fraud and security issues.
• Business transactions. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to applicable confidentiality and data-protection obligations.
• At your direction. With your consent or as otherwise directed by you in connection with the Services.

We use cookies and similar browser storage technologies to maintain sessions, authenticate users, remember preferences, and support service functionality. Certain emails sent through the Services include tracking technologies that record message opens and link clicks.

You can manage cookies through your browser settings. Blocking or deleting cookies and browser storage may affect sign-in and other features of the Services.

If you choose to connect a Google or Microsoft account, we access your account identity and email address and use the sending permissions you authorize. We process the recipients, message content, and attachments you choose to send, and store encrypted authorization credentials and delivery records. This integration does not request permission to read or browse your inbox. You may disconnect the account in your account settings or revoke access through the provider. Disconnecting does not recall messages already sent.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements. Google user data is used only to provide the connected-email features you authorize. It is not sold, used for advertising, or used to train general-purpose AI or machine-learning models. Human access is limited to your consent, necessary security investigations, legal requirements, or other exceptions permitted by those policies.

Our primary database and uploaded document storage are hosted by Supabase on AWS in Northern California, United States. Other service providers, including email and document-processing providers, may process information in other locations. Depending on where you reside, your information may be processed outside your state or country, where data-protection laws may differ.

We use administrative and technical measures designed to protect personal information against unauthorized access, use, alteration, and disclosure. These measures include encryption in transit and at rest, private document storage, and access controls. No method of transmission or electronic storage is completely secure.

Additional information about our security measures is available on our Security & Compliance page.

We retain personal information for as long as reasonably necessary to provide the Services and fulfill the purposes described in this policy, including applicable legal, recordkeeping, security, and dispute-resolution requirements. Retention periods depend on the nature of the information, our relationship with the customer, and applicable obligations.

Information processed on behalf of a customer is also subject to that customer’s retention requirements. Archiving a record does not delete it. Residual copies may remain in backups for a limited period or be retained where required by law.

Depending on your location and applicable law, you may have rights to request access to or a copy of your personal information, correct inaccurate information, request deletion, or object to or restrict certain processing. You may also have the right to withdraw consent where processing relies on consent, appeal a decision regarding a privacy request, or lodge a complaint with the appropriate privacy regulator.

To submit a request, contact us at support@borrova.app. We may need to verify your identity and, where applicable, an agent’s authority before responding. Requests are subject to applicable legal requirements and exceptions. We will not discriminate against you for exercising applicable privacy rights.

If your information was submitted to or provided by a lender or another business customer, please contact that organization directly. We may refer your request to the customer or assist it in responding. You may update information available in your account and revoke connected-account permissions through your settings.

This section supplements this policy for California residents. It describes rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), to the extent that law applies to the personal information and processing involved.

Our separate California Privacy Notice (CCPA/CPRA) describes the categories of information collected, its sources and purposes, disclosures, retention, your California privacy rights, and how to exercise them.

Sale and sharing of personal information

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not disclose personal information to advertising companies for targeted advertising.

The Services may contain links to or integrations with third-party websites and services. Their privacy practices are governed by their own policies. Review those policies before providing personal information to them.

The Services are intended for adults and are not directed to individuals under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, please contact us so we can investigate and take appropriate action.

We may update this Privacy Policy to reflect changes in our practices, the Services, or applicable requirements. We will post the revised policy on this page and update the date above. Where required by law, we will provide additional notice of material changes.

For questions about this Privacy Policy or our handling of personal information, please contact Borrova at support@borrova.app.