PRIVACY POLICY
Broker Launch UK Operations Ltd
Last updated: 30 May 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. WHO WE ARE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Broker Launch UK Operations Ltd (“BrokerLaunch”, “we”, “us”, “our”) is a
company registered in England and Wales. Our registered address is 71-75
Shelton Street, London, WC2H 9JQ.

We operate the BrokerLaunch platform and the Orion deal management system
(together, “the Platform”), accessible at app.brokerlaunch.co.uk.

For privacy enquiries: admin@brokerlaunch.co.uk

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2. WHAT INFORMATION WE COLLECT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2.1 Account and profile information
When you register for an account, we collect your name, email address,
business name, business phone number, business address, and ICO
registration number (where applicable). You may optionally upload a
profile photo and company logo.

2.2 Deal and case data
When you use the Platform to manage commercial finance cases, you enter
information about your clients and their loan requirements. This may
include company names, director information, loan amounts, financial
details, and supporting documents. This data belongs to you — we process
it solely to operate the Platform on your behalf.

2.3 Lender submission data
When you submit deals to lenders through the Platform, we store records
of those submissions including lender details, submission timestamps,
delivery status, offer terms received, and commission information.

2.4 Documents
You may upload documents to the Platform (bank statements, accounts,
application forms, offer letters). These are stored securely in our
cloud infrastructure and are only accessible by you and, where you
choose to share them, the lenders you submit to.

2.5 Meta Lead Ads data
If you choose to connect your Meta Business account (Facebook/Instagram)
to the Platform, we access lead form submissions from your connected
advertising accounts. This includes names, email addresses, phone numbers,
and any other fields you have configured in your lead forms. This data
is imported into your CRM on the Platform.

We access this data solely to provide the lead import feature you have
explicitly enabled. We do not use Meta lead data for advertising,
profiling, or any purpose other than populating your CRM.

2.6 Technical and usage data
We automatically collect IP addresses, browser type and version, device
type, pages visited, feature usage, and session duration. This is used
to operate and improve the Platform.

2.7 Communications
If you contact us by email or through the Platform, we retain those
communications for support and record-keeping purposes.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
3. HOW WE USE YOUR INFORMATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We use the information we collect to:

• Provide and operate the Platform and all its features
• Authenticate your account and maintain security
• Process deal data through AI analysis features (see Section 5)
• Send deal submissions to lenders on your behalf
• Import lead data from connected advertising platforms
• Calculate and display commission and earnings information
• Send platform notifications and service emails
• Provide customer support
• Monitor Platform performance and fix bugs
• Comply with legal and regulatory obligations

We do not use your information for advertising purposes. We do not sell
your data to third parties.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
4. LEGAL BASIS FOR PROCESSING (UK GDPR)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We process your personal data under the following legal bases:

• Contract performance — processing necessary to provide the Platform
you have subscribed to
• Legitimate interests — improving the Platform, preventing fraud,
maintaining security
• Consent — where you have explicitly connected third-party services
such as Meta Lead Ads
• Legal obligation — where required by law

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
5. AI PROCESSING AND THIRD-PARTY SERVICES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

To provide Platform features, we share data with the following trusted
third-party processors. All are bound by data processing agreements.

5.1 Supabase (database and storage)
All Platform data is stored on Supabase infrastructure. Supabase is
SOC 2 Type II certified. Data is encrypted at rest and in transit.
Privacy: https://supabase.com/privacy

5.2 Anthropic (AI analysis)
Our AI deal analysis, lender matching, and document extraction features
are powered by Anthropic’s Claude AI models. When you run an AI analysis,
relevant deal information is sent to Anthropic’s API for processing.
Anthropic does not use your data to train AI models. Data sent to the
API is processed in real time and not retained by Anthropic beyond the
immediate request.
Privacy: https://www.anthropic.com/privacy

5.3 Resend (email delivery)
When deal submissions are sent to lenders by email, those emails are
delivered via Resend’s email infrastructure. Submission data included
in those emails is processed by Resend solely for delivery purposes.
Privacy: https://resend.com/privacy

5.4 Companies House API
When you use the company pre-screening feature, we query the UK
Companies House public API. No personal data is sent to Companies House
— we only submit company names or registration numbers you provide.

5.5 Meta (Facebook/Instagram)
If you connect your Meta Business account, we use the Meta Lead Ads API
to retrieve lead form submissions from your advertising campaigns.
We store your Meta access token encrypted in our database. You can
disconnect your Meta account at any time from within the Platform,
which will revoke our access and delete your stored access token.
Meta Privacy Policy: https://www.facebook.com/privacy/policy/

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6. META LEAD DATA — SPECIFIC TERMS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

If you use the Meta Lead Ads integration, the following specific terms apply:

6.1 What we access
We access lead form submissions from Meta advertising campaigns you
manage, using permissions you explicitly grant during the OAuth
connection flow.

6.2 How we use it
Lead data retrieved from Meta is imported into your CRM within the
Platform. It is used solely to populate contact records on your behalf.
It is not used for targeting, advertising, profiling, or shared with
any party other than you.

6.3 Data retention
Meta lead data is retained within the Platform for as long as your
account is active. If you disconnect your Meta integration, we stop
retrieving new leads but existing CRM records are retained unless
you choose to delete them.

6.4 Deletion requests
You may request deletion of all Meta-sourced data by emailing
admin@brokerlaunch.co.uk or by submitting a deletion request at
brokerlaunch.co.uk/data-deletion. We will process deletion requests
within 30 days and provide a confirmation reference.

6.5 User data deletion callback
In accordance with Meta Platform Policy, we maintain a data deletion
callback endpoint. When a user removes our app from their Meta account,
Meta will notify our systems and we will delete all associated Meta
platform data within 30 days. Users can verify deletion status at
brokerlaunch.co.uk/data-deletion?ref=[reference_code]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
7. DATA SHARING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We share your data only in the following circumstances:

• With lenders, when you choose to submit a deal — only the information
you have selected to include in that submission
• With the third-party processors listed in Section 5, under data
processing agreements
• With law enforcement or regulatory authorities if legally required
• With a buyer of our business, under confidentiality obligations,
if we are acquired

We do not sell, rent, or trade personal data.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
8. DATA SECURITY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We implement the following security measures:

• All data encrypted at rest and in transit (TLS 1.2+)
• Row-level security on all database tables
• Authentication via Supabase JWT with auto-refresh
• Invite-only access — no public self-registration
• API keys and secrets stored only in server-side environment
variables, never in client-side code
• Time-limited signed URLs for document access (30-day expiry)
• OAuth token storage encrypted in database

We do not store payment card information. All billing is handled by
third-party payment processors.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
9. DATA RETENTION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Account data: retained while your account is active
• Deal and case data: retained while your account is active
• Uploaded documents: retained until you delete them or close your account
• Meta lead data: retained while your account is active, or until you
delete specific records
• Technical logs: retained for 90 days
• Emails and support records: retained for 2 years

Upon account closure, all personal data is deleted within 30 days,
except where retention is required by law (e.g. financial records
which may be retained for 7 years under HMRC requirements).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
10. YOUR RIGHTS UNDER UK GDPR
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (“right to be forgotten”)
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we use your data
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any of these rights, contact us at admin@brokerlaunch.co.uk.
We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint
with the Information Commissioner’s Office (ICO):
Website: ico.org.uk | Phone: 0303 123 1113

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
11. COOKIES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Platform uses the following cookies:

Essential cookies (required for the Platform to function):
• Authentication session token (Supabase auth)
• CSRF protection token
• User preference storage (theme, settings)

We do not use advertising cookies, tracking pixels, or third-party
analytics that track you across other websites.

Our marketing website (brokerlaunch.co.uk) may use Google Analytics
for anonymous traffic analysis. You can opt out of this via our
cookie consent banner.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
12. CHILDREN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Platform is intended for commercial use by adults in a professional
capacity. We do not knowingly collect data from anyone under 18.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
13. CHANGES TO THIS POLICY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We may update this policy from time to time. We will notify you of
material changes by email or via a notice within the Platform.
Continued use of the Platform after changes take effect constitutes
acceptance of the updated policy.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
14. CONTACT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Broker Launch UK Operations Ltd
71-75 Shelton Street, London, WC2H 9JQ
admin@brokerlaunch.co.uk
brokerlaunch.co.uk