How we handle your information

The Shop Park is run by The Shop Park LLC, a New Mexico limited liability company (in formation), at 2201 Menaul Blvd NE Ste A, Albuquerque, NM 87107. In this policy, “we” and “us” mean that company.

This policy covers theshoppark.com, the pages and emails that belong to it, and every account in the Park, whether you are a loan originator, a leader at a lending company, someone who appears in a shop’s content, or someone who asked for early access. It tells you what we collect, why, who else touches it, how long we keep it and what you can do about it.

The Park is a recruiting marketplace for the mortgage industry. Leaders at shops build a storefront that shows what they pay, how they support their people and who thrives with them. Loan originators read those storefronts anonymously and decide whether to start a conversation. The whole design turns on one promise: a shop learns who you are only when you decide to tell them. This policy explains how we keep that promise in practice.

When you create an account and build your profile, you give us:

• Your account email and password. The email is used to sign you in, to send you one-time codes and to send the mail described in section 6. We store a one-way hash of the password, never the password itself.
• Your legal name and NMLS number, and if you give it, the NMLS ID of the company you work for today. These exist so our team can confirm you are who you say you are. They are kept in the encrypted store described in section 7 and are never shown to a shop until you book a meeting.
• The states you are licensed in or, if you work under a bank or credit union registration, the states you originate in.
• Your production. Your trailing twelve months of volume and units, your prior year if you share it, and facts about your book such as purchase share, self-generated share, where your business comes from and the loan scenarios you close most. Only you and our team see the exact numbers. Shops see a production range.
• The documents that prove it. A funded-loans report, a W-2 or 1099 with a comp statement, commission statements, a published ranking or anything else that shows your production. Documents are stored under random file names in a private bucket, are opened only by our team through short-lived links, and are deleted on the schedule in section 10.
• Two texts in your words: your book as you would describe it, and what you want next. Before either is saved, a scan checks that it holds no name, phone number, company name or other detail that could identify you, and asks you to change it if it does. These two texts appear on your card.
• Your preferences: your goals, the kinds of shop you are open to, your timing, whether you would relocate or work remotely, and what you would say no to.
• Your handle. A generated name you pick from a short list. It is how shops, and we, refer to you until you choose to share more.

Once you are in the Park, we also keep what you do there: the shops you shortlist, the conversations you start and the messages and files in them, the meetings you book, your email choices and your appearance setting. If you use the Help page, we keep the tickets you open and our replies.

Leaders are named by design. A storefront is a public face, so most of what a leader gives us is meant to be seen by loan originators in the Park. When you build or join a shop, you give us:

• Your name, title, work email and a headshot, and if you add them, your own NMLS ID, a LinkedIn address and a short bio.
• Facts about the company: its name, its NMLS ID, its website, the kind of shop it is, the states it lends in, how it employs loan originators, its team size and how files move through it.
• Comp plans, with their tiers, fees, draws, guarantees and bonus terms, and the support you offer at each tier.
• Photos and videos: your logo, banner and team photos, your recorded pitch, and the video testimonials loan originators record for you. Photos may carry a place and the names of the people in them, with their consent recorded.
• Anonymous facts about loan originators who grew with you (production ranges, time with you, where they came from). These are never shown to loan originators; they inform the matching.
• Your calendar connection. If you connect Calendly, we keep an access token so a loan originator can book a time in your calendar from the Park, and we receive booking and cancellation notices from Calendly. The token is sealed and is never readable by a browser.

We also keep what your shop does in the Park: the conversations each leader holds, the bookings they receive, who on your team read a booked loan originator’s details and when, storefront edits and the counts that make up your reports.

People who appear in a shop’s content

A loan originator who records a video testimonial through a leader’s link gives us their first name, their production range, their consent and the video itself; no account is needed. A person named in a written story or tagged in a team photo appears only after the leader records that person’s permission. If you appear in a shop’s content and want it removed, write to us and we will take it down.

Before the Park opens, you can leave your email to hear when it does. A loan originator may also tell us the states they are licensed in and their production range; a leader gives their name, company, the kind of shop and the size of their team. We also record which link brought you to the form (the UTM source), so we know which channels reach the people we built this for.

Joining the list takes two steps. We send one confirmation email; your address is added only after you tap the link in it, and nothing else is sent until then. That confirmation is a transactional message about the request you just made. Every later email from the list carries a one-tap link to leave, and leaving removes your address from the list. Nothing on the list is used for anything other than telling you about the Park.

Analytics

We measure how the Park is used so we can improve it: which pages are opened, where people stop in a flow, how many conversations and bookings happen, how long a reply takes. These events are recorded on our servers and mirrored to PostHog, an analytics service. The mirror identifies a loan originator by handle and a shop by an internal id, never by name, email or NMLS number, and it carries a loan originator’s production range rather than their numbers. Public pages count page views and the steps of a tour in the same way. We run no advertising trackers, no third-party advertising pixels and no fingerprinting scripts.

Cookies

We set only the cookies the service needs to work, and none that need your consent, which is why you see no cookie banner:

• Session cookies that keep you signed in. The refresh cookie is readable only by our server.
• A short-lived sign-in check value during a Google sign-in, which only our staff use. It proves the sign-in that finishes is the one that started.
• A staff activity cookie that signs our team out of the staff area after thirty idle minutes.

Your appearance choice (light or dark) and a draft you have not yet submitted are kept in your browser’s own storage and never leave your device until you submit. Your name, NMLS number and the two texts in your words are never written to a draft on our servers.

Server logs

Like every web service, our hosting provider records the technical details of each request (IP address, browser type, time, page) for security and reliability. Our own application logs never hold an email address, a code or a token.

We use what we collect to:

• Run your account and sign you in.
• Confirm a loan originator’s license and production by hand, and confirm a shop’s company and claims, so that what you see in the Park is true.
• Match loan originators with shops and leaders, and show each side what the other has chosen to show. The matching uses your production range, states, scenarios and preferences. It never uses your name.
• Carry conversations, files and bookings between a loan originator and a leader.
• Send the emails described below.
• Build the reports a shop receives about its own storefront, which hold counts only.
• Keep the Park safe: catch duplicate accounts, enforce the rules, review reports of bad behaviour and protect against abuse.
• Understand how the Park is used, in aggregate, so we can improve it.
• Meet our legal obligations and enforce our terms.

Email we send

Some emails are part of the service and cannot be turned off: sign-in and confirmation codes, the result of a verification or a shop review, account changes and deletion, team invites, a meeting booked, cancelled or needing a new time, and a calendar that needs reconnecting. Others are optional and default on: a new conversation, a reply while you were away, a weekly summary and, for shops, a daily count of loan originators who shortlisted you. You can turn each optional one off in Settings or with one tap from the email itself. We never put a name, a message or a document in an email subject, and digests carry counts only.

We do not profile you with automated decisions that have legal or similar effects. Every verification decision is made by a person on our team, and you can dispute it.

If you are a loan originator, this is the part that matters most, so here it is in plain words.

• Your name, NMLS number and documents live in a separate encrypted store. Each record is encrypted with its own key, and that key is wrapped by a master key kept outside the database, in the protected runtime that only our privileged functions can reach. The web application that draws your pages cannot read that store at all. Someone who stole a copy of the main database would find handles, ranges, timestamps and ciphertext.
• Nothing public holds them. Every table a shop can read is linked to you by an opaque reference, never by your login, your email or your NMLS number. Duplicate accounts are caught with a one-way fingerprint of your email and NMLS number, which cannot be turned back into either.
• Shops cannot find you. There is no search by name, NMLS number or employer anywhere a shop can reach. A shop sees a loan originator only as an anonymous card, and only after that loan originator starts a conversation or books a meeting. Shops never start contact.
• What a shop sees when you message. Your handle, your card (production range, states, scenarios, years, the kind of shop you are at today unless you hid it) and your two texts, which have passed the scan described in section 2. Your exact production, your name and your employer stay with you.
• What a shop sees when you book. Booking a meeting is the moment you choose to be known. Before anything travels, the screen names the three facts that will: your legal name, your email and your NMLS number, and the leader who will receive them. You confirm with a one-time code sent to your email. Only that leader can then read those facts, only once the meeting is booked, and every read is written to a log you can see in your booking history. Chat stays on your handle even after a booking.
• Our team sees your name only to verify you. Every time a member of our team opens your name or a document, the look is written to an audit log. Documents open through links that expire in five minutes.
• Files expire. Verification documents are deleted thirty days after the decision on them. Files shared in a conversation open through links that last one hour, and a file uploaded but never sent is removed after a day.

We use a small number of companies to run the Park. Each receives only what its job needs, acts on our instructions and may not use your information for its own purposes.

• Insforge hosts the application, the database, file storage and the protected runtime where our privileged functions run. It holds everything described in this policy, including the encrypted store, and it operates the sign-in system that keeps your login email.
• Resend sends our email. It receives your email address and the content of each message. Sign-in and confirmation codes may be sent by Insforge’s own mail sender instead.
• Mux stores and streams video: a leader’s pitch and the testimonials loan originators record. It receives the video file and serves it through signed playback links.
• Calendly hosts a leader’s calendar. When a loan originator books, Calendly receives the name and email that loan originator chose to share, and sends us the booking’s time and status. We never read a leader’s other calendar events.
• PostHog receives the usage events described in section 5, identified by handle or shop id.
• Cloudflare answers for our domain name and screens traffic for bots. It sees the technical details of each request, such as your IP address, in order to do so.
• Google provides the sign-in our staff use to reach the staff area. Google receives the staff member’s Google account details for that sign-in. Loan originators and leaders sign in with email and password, and Google receives nothing about them.
• Have I Been Pwned runs the breached-password list we check against when you choose a password. Only the first five characters of a one-way hash of your password leave your browser; the password itself never does.

We may also share information when the law requires it, to protect someone’s safety, to enforce our terms, or as part of a merger or sale of the company, in which case this policy continues to apply to it.

We do not sell personal information. We do not share it for advertising. We do not run advertising in the Park or on our public pages, and we place no advertising trackers. Our revenue comes from shops paying to be in the Park, and from nothing else.

Shops never buy lists of loan originators, and no shop receives anything about a loan originator who has not chosen to contact them.

We keep your information while your account is open and for as long as needed to run the service and meet our obligations. Some things have fixed clocks:

• Verification documents are deleted thirty days after our team decides on them, whether the decision was yes or no. A dispute resets that clock until the dispute closes.
• Links to documents expire in five minutes. Links to files in a conversation expire in one hour. A file uploaded to a conversation and never sent is removed after one day.
• A storefront share link expires after ninety days.
• Early-access addresses are kept until you leave the list or the Park has opened and the list is retired.

Deleting your account

You can delete your account from Settings at any time. We ask you to type a word and enter a one-time code, because deletion cannot be undone. When a loan originator deletes their account:

• Your name, email, NMLS number and the other contents of your encrypted record are erased, together with the key that protected them. A one-way fingerprint of your email and NMLS number is kept as a tombstone, a record that an account existed and was deleted. It cannot be turned back into either value, and it does not stop you from signing up again later.
• Your verification documents are deleted at once.
• Your login is removed and your profile is marked deleted. Your handle is retained so the conversations you took part in can show “Former member” instead of a blank.
• Your messages stay visible to the leaders you spoke with for ninety days, so they are not left without context, and are then purged with every file in those conversations.
• Upcoming meetings are cancelled and the leader is told. The record that you once shared your details with a leader is kept, because a disclosure cannot be undone.

When a leader deletes their account, their storefront content, conversations and bookings are hidden and their calendar connection is revoked. An owner with other active leaders hands ownership to one of them first. Counts in a shop’s past reports are not rewritten.

Audit logs, which record privileged actions such as a look at a name or a verification decision, are kept for as long as we need them to show that we kept our promises. They reference accounts by opaque ids and never hold a name, an email or a document.

In plain words, the measures that matter most:

• Everything travels over encrypted connections.
• Personal details that identify a loan originator are encrypted at rest with per-record keys, wrapped by a master key kept outside the database. The master key can be rotated without anyone reading the data.
• The web application holds no privileged credentials. Only a small set of protected functions can reach the encrypted store, and each privileged action is written to an append-only audit log.
• Row-level access rules in the database let each person read only their own rows. A leader’s conversations are theirs alone; no owner or other leader can read them, in the app or in the database.
• Documents and videos live in private storage opened only through short-lived signed links.
• Passwords are checked against a public list of breached passwords before they are accepted, without the password leaving your browser.
• Deletion and sharing of your details each require a one-time code sent to your email.
• Our team signs in with Google accounts on a fixed staff list, and is signed out of the staff area after thirty idle minutes.
• Rate limits and automated checks guard against scraping and abuse.

No system is perfectly safe. If we learn of a breach that affects you, we will tell you and the authorities as the law requires, and we will tell you what we are doing about it.

Wherever you live, you can:

• See what we hold. Most of it is on your own screens. Write to us for a copy of the rest.
• Correct it. You can edit your profile, book and preferences yourself. A verified loan originator changes production or licensed states through a re-verification, so the old truth stays live until the new one is checked. Name and NMLS number cannot be changed in the app once verified; write to us.
• Delete it. From Settings, as described in section 10, or by writing to us.
• Take it with you. Ask us and we will send you the information you gave us in a common machine-readable format.
• Stop optional email. In Settings, or with one tap from any optional email or any early-access email.
• Object or complain. Write to us about any use of your information you disagree with. You may also complain to your state attorney general or the Federal Trade Commission.

To exercise a right, email [email protected] from the address on your account, or use the Help page when you are signed in. We answer within forty-five days. If we need to confirm it is you, we will ask you to sign in or to answer a code sent to your account email; we never ask for your password. You can also have someone act for you if they show us your written permission. We will never treat you differently for exercising a right.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents specific rights. This section describes them and how our practices map to the law’s categories.

What we collect, by the law’s categories

In the last twelve months we have collected these categories of personal information: identifiers (name, email, NMLS number, handle, IP address); professional and employment information (licensed states, production, employer type, comp model, documents); audio and visual information (headshots, photos, pitch videos and testimonials, for leaders and the people who record them); internet activity (pages opened, actions in the Park); and inferences used to match loan originators with shops (fit on production range, states and scenarios). We collect them from you, from your use of the Park and from the service providers in section 8. We use them for the purposes in section 6, and we disclose them to the service providers in section 8 for business purposes only.

We do not collect sensitive personal information as the law defines it beyond your account login, and we use it only to run your account.

We do not sell or share personal information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the last twelve months. We have no actual knowledge of selling or sharing the personal information of anyone under sixteen. Because we do not sell or share, we offer no “Do Not Sell or Share” link; there is nothing to opt out of.

Your rights

• To know what personal information we have collected about you, where it came from, why, and who we disclosed it to.
• To delete the personal information we hold about you, with the exceptions the law allows (for example, to complete a transaction you asked for, to detect security incidents, or to meet a legal obligation).
• To correct inaccurate personal information.
• To limit the use of sensitive personal information. We use it only as the law permits without a request.
• Not to be discriminated against for exercising any of these rights.

Submit a request by emailing [email protected] or through the Help page while signed in. We confirm receipt within ten business days and respond within forty-five days, which we may extend once by another forty-five with notice. We verify your request by matching it to your account email and, where needed, a one-time code. An authorized agent may submit a request with your signed permission; we may also ask you to confirm it directly.

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Iowa, Indiana, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia, have rights to access, correct, delete and obtain a portable copy of their personal information, and to opt out of its sale, of targeted advertising and of profiling that produces legal or similarly significant effects.

We do not sell personal information, do not use it for targeted advertising and do not profile you with automated decisions of that kind, so there is nothing to opt out of. You can exercise the other rights by writing to [email protected] or through the Help page. We respond within forty-five days. If we decline a request, we tell you why, and you may appeal by replying to our answer; we respond to an appeal within forty-five days and tell you how to reach your state attorney general if you still disagree.

Residents of Nevada may ask us not to sell their covered information. We do not sell it, and we will honour such a request should that ever change.

The Park is for working professionals in mortgage lending. No one under eighteen may create an account or join the early-access list, and we do not knowingly collect information from anyone under eighteen. If you believe a child has given us information, write to us and we will delete it.

The Park is a United States service for people who originate or lead mortgage lending in the United States. Our servers and our service providers are in the United States. If you use the Park from elsewhere, your information is transferred to and handled in the United States under this policy and US law, which may differ from the law where you live.

When we change this policy we update the date at the top. If a change affects how we handle information you have already given us in a way you would not expect, we email account holders before it takes effect and, where the law requires, ask for your consent. Earlier versions are available on request.

Questions, requests and complaints about privacy go to [email protected], or by post to The Shop Park LLC, 2201 Menaul Blvd NE Ste A, Albuquerque, NM 87107. When you are signed in, the Help page reaches the same team.

Our Terms of service describe the rules of the Park.