Privacy Policy

KISAES, LLC, doing business as OwnerTrack ("OwnerTrack", "we", "us"). Effective date: November 16, 2026. This version replaces the policy dated September 29, 2026.

This policy explains what information OwnerTrack.Loan (the "Service") collects, how we use and share it, how long we keep it, and the choices you have. It applies to the OwnerTrack website at ownertrack.loan, the application at my.ownertrack.loan, and the borrower portal.

In short: lenders enter loan and borrower information to service their own notes; we use it only to run the Service for them. We do not sell personal information or share it for targeted advertising. The optional AI assistant sends a summary of one loan to an inference provider to answer a question, never borrower contact details, and never for training models.

1. Who this policy covers

• Lenders — people or businesses with an OwnerTrack account who service loans.

• Borrowers — people whose loans a lender services in OwnerTrack. Borrowers may be given access to a read-only portal.

• Visitors — anyone using the ownertrack.loan website.

Where this policy says "you", it means whichever of these applies to you.

2. Information we collect

Information lenders provide about themselves

• Account details: name, email address, password (stored only as a hash), phone number, company name and mailing address.

• Tax identifiers (such as an EIN) if you enter them for tax-form generation.

• Payment-collection details you choose to share with borrowers, such as Zelle, Venmo or Cash App handles, or a link to a payment provider you connect.

• Billing information for your subscription, which is collected and stored by our payment processor (see Section 6). We keep a record of what was paid and when, not your card number.

• Preferences and settings, and any messages you send to borrowers or to our support team.

Information lenders provide about borrowers and loans

• Borrower identity and contact details: name, email address, phone number, mailing address, and, where a lender enters them for tax reporting, the last four digits of a Social Security number and date of birth.

• Loan terms, balances, payment history, late fees, escrow items and disbursements, property address, and documents such as statements and payoff quotes generated from that data.

Lenders are responsible for having the right to enter this information and for keeping it accurate. See Section 5.

Information borrowers provide

When a lender enables the borrower portal, we collect the borrower's sign-in activity, notification preferences, any messages sent to the lender, and payment confirmations the borrower submits.

Information collected automatically

• Technical information: IP address, browser and device type, pages viewed, and timestamps. We may derive an approximate location (such as city or state) from an IP address for security purposes; we do not collect precise geolocation.

• Security and audit records: sign-ins, changes made to loans and settings, and who made them. These records exist so that servicing history can be verified.

• Website analytics through Google Analytics on the marketing website only (see Section 9 and our Cookie Notice).

Information from others

If you contact us through the website form or by email, we collect what you send. If a lender adds you as a borrower or an authorized user, we receive your information from that lender.

3. How we use information

• To provide the Service: calculating amortization, posting payments, generating statements, payoff quotes and tax forms, and operating the borrower portal.

• To communicate: transactional email and SMS (payment reminders, statements, late notices, portal access links) and, with your consent, marketing messages.

• To bill lenders for the Service.

• To keep records that lenders and the law require, including audit logs and tax-form history.

• To secure the Service, prevent fraud and abuse, and enforce our Terms of Service.

• To provide support, including answering questions about an account or a loan.

• To operate the optional AI assistant, described in Section 4.

• To create aggregated, de-identified information (for example, the total number of loans serviced) that does not identify any lender, borrower or individual. We will not attempt to re-identify de-identified information.

We process information because it is necessary to provide the Service you or your lender asked for, to meet legal obligations, and for our legitimate interests in running and securing the Service. Where consent is required, for example for marketing messages, we ask for it.

4. The AI assistant

OwnerTrack includes an optional assistant that answers lenders' questions about how the Service works and about their own loans. It is turned off until the account administrator enables it, and it can be turned off at any time.

What it sends

When a lender asks a question about a loan, we send the question, the conversation so far, and a summary of that one loan to an AI inference provider to generate the answer. The summary contains the loan's terms and settings, balances, amortization schedule, payment history, late fees, escrow figures, a computed payoff, and the borrower's name. It does not contain the borrower's contact details, Social Security digits, date of birth, documents, messages, or any other loan. Questions asked from the Help Center send no loan data at all.

Who processes it

Inference is performed by DigitalOcean, LLC (Gradient AI Platform) on our behalf, or by Anthropic, PBC when the account is configured to use Anthropic's API directly. These providers process the data only to return an answer. Under our agreements with them, the data is not used to train models.

What we keep

Questions and answers are stored with the lender's account, visible to that lender and to our support staff, for 12 months and then deleted. Each question is noted in the account's audit log. When a lender uses "Send to support", the question, the conversation, and the loan summary are stored with the support request; the loan summary is deleted when the request is closed.

What it cannot do

The assistant is read-only. It cannot post, edit, reverse or waive anything, and it does not make decisions about any loan or borrower. We do not use the assistant, or any other automated process, to make decisions that produce legal or similarly significant effects on borrowers. Its answers are generated automatically and may be wrong; they are not legal, tax or financial advice.

5. Borrower information and the lender's role

Lenders decide what borrower information to enter and how to use it; OwnerTrack processes that information on the lender's instructions to provide the Service, under the Data Processing Addendum that forms part of our Terms of Service. Lenders are responsible for having a lawful basis to enter it, for keeping it accurate, for giving borrowers any privacy notice the law requires, and for handling borrowers' questions and requests about it.

Some lenders are "financial institutions" under the federal Gramm-Leach-Bliley Act. For those lenders, OwnerTrack acts as a service provider: we use and disclose borrower information only to provide the Service to that lender or as the law permits or requires, and we protect it with the safeguards described in Section 10 and in our Data Processing Addendum. The lender's own privacy notice governs how the lender shares borrower information.

If you are a borrower and want to correct or remove your information, contact your lender first; you can also contact us and we will assist within the limits of the lender's instructions and our legal obligations.

6. Service providers

We share information with companies that help us run the Service. They may use it only to provide their service to us, under written agreements that require them to protect it.

DigitalOcean, LLC — Hosting, storage, backups, and AI inference (Gradient) — All Service data; loan summaries and questions for the assistant

Anthropic, PBC — AI inference, when configured to use Anthropic's API directly — Loan summaries and questions for the assistant

Stripe, Inc. — Subscription billing for lenders — Lender name, email, payment card details (held by Stripe)

Emailit — Transactional email delivery — Recipient address and message content (statements, reminders, portal links)

Twilio, Inc. or TextLink — SMS delivery, when a lender enables SMS — Recipient phone number and message content

Google LLC (Google Analytics) — Marketing website analytics — Technical and usage information from the marketing website only

We will update this list, and notify lenders by email, before a new provider begins processing borrower information.

Payment providers a lender chooses

Lenders may share payment details for apps such as Zelle, Venmo or Cash App, or, where the Service offers it, connect their own account with a third-party payment provider. Those providers are chosen by the lender, not by OwnerTrack. When a borrower uses one, the borrower's information is handled under that provider's own terms and privacy policy, and OwnerTrack receives only the payment information needed to record the payment for the lender.

7. Other disclosures

We may also disclose information: to a borrower's lender or a lender's borrower as part of the Service (for example, a statement sent to a borrower, or a borrower's message shown to the lender); to professional advisors such as lawyers and accountants under a duty of confidentiality; to comply with law, a court order, or a lawful request from a public authority; to protect the rights, safety or property of OwnerTrack, our users, or others; or in connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to the transferred information.

We do not sell personal information and do not share it for cross-context behavioral or targeted advertising. We have not done so in the past 12 months.

8. How long we keep information

Lender account and loan data — For the life of the account, then deleted within 90 days of a closure request, except as noted below

Audit logs, generated tax forms and statements — 7 years, to support tax and record-keeping obligations

Assistant questions and answers — 12 months

Support requests — The loan summary is deleted when the request is closed; the request itself is kept for 2 years

Backups — [[CONFIRM: Nightly]] backups are retained for 30 days and then overwritten

Website analytics — 14 months, per our Google Analytics retention setting

Website contact-form messages — 2 years

We may keep information longer where a law, regulation, dispute or legal hold requires it.

9. Cookies and analytics

The application and borrower portal use only cookies that are necessary to keep you signed in and to protect against request forgery. The marketing website uses Google Analytics, which sets its own cookies to measure how the site is used, and our website platform may set cookies needed to deliver the site. We do not use advertising cookies, and we honor Global Privacy Control signals. Our Cookie Notice explains the cookies we use and how to block them.

10. Security

All connections use HTTPS. Data is encrypted at rest and backed up [[CONFIRM: nightly]]. Each lender's data is isolated from every other lender's, and the Service checks that isolation on every request. Passwords are stored only as salted hashes; borrower portal access uses expiring magic links or a hashed PIN, and passkeys are available for lenders. Sign-in attempts are rate-limited. Administrative access to our servers is restricted to authorized personnel, and staff access to customer data is limited to what support requires and is logged. If a security incident affects a lender's data, we will notify that lender as described in our Data Processing Addendum. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights and choices

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use and disclose it;

• access or receive a portable copy of it;

• correct inaccurate information;

• delete it;

• opt out of the sale or sharing of personal information, targeted advertising, and profiling (we do not engage in any of these);

• limit the use of sensitive personal information (see Section 12); and

• not be discriminated against for exercising these rights.

We honor these rights for residents of every U.S. state with a comprehensive consumer privacy law, to the extent those laws apply to us and to the information involved. Some of these laws do not apply to information covered by the Gramm-Leach-Bliley Act or to business contact information.

How to make a request. Lenders can view, correct and export their data from within the Service at any time. Borrowers should direct requests about a loan record to their lender, who controls it; we will assist as described in Section 5. To make a request to us, email info@kisaes.com or write to the address in Section 19.

Verification. We will verify your identity before acting on a request, usually by confirming control of the email address or account associated with the information. We will respond within the time the applicable law requires (generally 45 days, which may be extended where the law allows).

Authorized agents. You may use an authorized agent to make a request for you. We may ask the agent for proof of your written permission (or a valid power of attorney) and may ask you to verify your identity directly.

Appeals. If we deny your request, you may appeal by replying to our response with the word "Appeal". We will respond to appeals within the time the applicable law requires. If you are not satisfied with the result, you may contact your state attorney general.

Global Privacy Control. We treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale or sharing of your personal information.

Marketing and SMS. You can opt out of marketing email using the unsubscribe link in any message, and out of SMS by replying STOP. Transactional messages about your account or loan will continue while the account is active.

12. Sensitive personal information

Some information in the Service is considered sensitive under certain state laws, including the last four digits of a Social Security number, account sign-in credentials, and, where entered, date of birth. We use sensitive personal information only to provide the Service (for example, to prepare tax forms a lender requests and to secure accounts) and as the law permits. We do not use it to infer characteristics about anyone, and we do not sell or share it.

13. Additional state disclosures

Categories of personal information. In the past 12 months we have collected the following categories of personal information, as defined by California law, from the sources and for the purposes described in Sections 2 and 3, and disclosed each category for business purposes only to the service providers and recipients described in Sections 6 and 7:

• Identifiers (such as name, email address, phone number, mailing address, IP address, account ID);

• Customer records (such as partial Social Security number, loan and payment information);

• Commercial information (such as subscription purchases, loan terms and payment history);

• Internet or network activity (such as sign-in history, pages viewed, and website analytics);

• Professional information (such as a lender's company name);

• Sensitive personal information (partial Social Security number and account sign-in credentials).

We do not sell or share any of these categories, and we do not knowingly sell or share the personal information of consumers under 16.

California "Shine the Light". California residents may ask whether we disclosed personal information to third parties for their own direct marketing purposes in the prior year. We do not make such disclosures.

Nevada. We do not sell covered information as defined by Nevada law. Nevada residents may still submit an opt-out request to info@kisaes.com.

14. Text messaging (SMS)

When a lender enables SMS for a borrower, we send transactional messages such as payment reminders, statements, late notices and portal links on the lender's behalf. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. Mobile phone numbers and SMS opt-in consent are not shared with or sold to third parties or affiliates for their marketing or promotional purposes. Phone numbers are shared only with our SMS delivery provider to send the messages.

15. Links to other sites

The Service and our website may link to sites we do not control, such as a lender's payment provider. This policy does not apply to those sites; please review their privacy policies.

16. Children

The Service is for businesses and adults. We do not knowingly collect information from anyone under 18. If you believe a minor's information has been entered, contact us and we will remove it.

17. Where information is processed

Information is stored and processed in the United States. If you use the Service from elsewhere, you understand that your information is transferred to and processed in the United States.

18. Changes to this policy

When we make material changes we will post the new policy here with a new effective date and notify lenders by email or a notice in the Service at least 30 days before the changes take effect. Continued use after the effective date means the new policy applies.

19. Contact

KISAES, LLC DBA OwnerTrack

6041 S Brightwater Trl, Springfield, MO 65810

Email: info@kisaes.com

Lenders can also reach support from inside the Service using "Send to support" in the assistant window.