Privacy Policy

Last updated: July 8, 2026

This policy explains what mcaunderwriting.com (“we,” “us”) collects, how we use it, and your choices. See also our Security page.

Information we collect

• Account & contact info — your email and password (hashed by our auth provider).
• Billing info — processed by Stripe; we never receive your full card number.
• Uploaded documents — the bank statements you submit. We store them privately to your account, encrypted at rest, so you can reopen and unlock your deals; you can delete them at any time.
• Extracted data — the figures and reports we produce from your statements (revenue, balances, deposits, positions, etc.), stored to your account.
• Usage & analytics — standard request logs; a hashed IP for rate-limiting free scans; and aggregated, cookieless page-view analytics (Vercel Web Analytics) that do not identify you.
• Cookies — a session/auth cookie so you stay signed in.

How we use it

To provide the underwriting read, run your account and billing, prevent abuse, and provide support. We do not use your uploaded documents or the data in them for advertising, and we do not sell your data.

Service providers we share with

We share the minimum necessary with providers bound to use it only to serve us:

• Google LLC (Gemini API) — reads uploaded document content to extract figures. On our paid tier, Google does not use this data to train its models.
• Stripe, Inc. — payments and billing.
• Supabase — database and authentication hosting (data encrypted at rest).
• Vercel, Inc. — application hosting and privacy-friendly, cookieless web analytics.

Document handling & retention

We store your uploaded statements and the reports we produce privately to your account, encrypted at rest (see the Security page for exactly how, including the honest limits of that encryption). We keep them while your account is active or as needed to provide the service, and you can delete any deal — its statements and report — permanently at any time. Our reading provider (Google) may retain a request briefly for security/abuse monitoring.

We do not sell your information

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

Your rights

Depending on where you live (including under the CCPA/CPRA), you may have the right to know, access, correct, or delete your personal information, and to not be discriminated against for exercising those rights. To make a request, email support@mcaunderwriting.com; we’ll respond within the time the law requires. Do Not Track: we do not track you across third-party sites, so we do not respond to browser DNT signals differently.

Security

TLS encryption in transit, encryption at rest for stored data, and per-account access controls. No method is perfectly secure, but we design to minimize what we hold — see the Security page.

Children

The service is for business use by adults and is not directed to anyone under 18.

Changes & contact

We may update this policy; we’ll change the date above. Questions: support@mcaunderwriting.com.