Data Processing Addendum

Last updated October 15, 2026

1. Scope

This Data Processing Addendum ("DPA") applies only when a business, such as a loan officer, mortgage broker, real estate agent, or housing counselor ("Customer"), has a written agreement with Lighthouse Companies, LLC ("Lighthouse") that allows Lighthouse to process personal information about the Customer's own clients ("Customer Personal Data") on the Customer's behalf. It does not apply to individuals who use Lighthouse for themselves, whose information is governed by the Privacy Policy, and it does not by itself give anyone the right to upload client information: Terms Section 37 requires a signed agreement first. If this DPA conflicts with the Terms about Customer Personal Data, this DPA controls.

2. Roles

For Customer Personal Data, the Customer is the business (the controller) and Lighthouse is its service provider (the processor). Lighthouse processes Customer Personal Data only on the Customer's documented instructions, which are this DPA, the written agreement, and the Customer's use of the features of the Service.

3. Purposes and Limits

Lighthouse processes Customer Personal Data only to provide the Service the Customer requested: reading uploaded mortgage documents, building Home Profiles and results, answering questions, preparing letters, and the account, security, billing, and support functions needed to deliver them. Lighthouse will not sell or share Customer Personal Data, will not retain, use, or disclose it outside the direct business relationship with the Customer or for any purpose other than the purposes in this section, will not combine it with personal information from other sources except as the law allows for these purposes, and will not use it to train AI models.

4. Customer Responsibilities

The Customer is responsible for having the notices, consents, and legal authority needed to give Lighthouse the Customer Personal Data, for not uploading Social Security numbers, bank or card numbers, or other information the Service does not need, and for using the output as educational information and not as a lending decision, consumer report, or legal advice.

5. Confidentiality and Personnel

Lighthouse limits access to Customer Personal Data to people who need it to run the Service and who are bound by confidentiality duties. Administrative access is limited and administrative actions are logged.

6. Security Measures

Lighthouse protects Customer Personal Data with safeguards suited to its sensitivity, including: HTTPS between the Customer's device and the Service; Secure, HttpOnly session cookies with protection against cross-site request forgery; one-time sign-in links stored only as one-way hashes; rate limits on sign-in and other sensitive requests; automatic removal of detected sensitive identifiers (such as Social Security, loan, account, routing, and card numbers) from saved document facts, letters, and borrower memory; no retention of the uploaded files themselves; encrypted connections to the database; role-based access for Lighthouse staff with shortened staff sessions; and logging of sign-ins and administrative actions. No method of transmission or storage is completely secure. Lighthouse may update these measures if the protection they give is not reduced.

7. Subprocessors

The Customer authorizes Lighthouse to use these subprocessors, each under written terms that require protection of personal information at least as protective as this DPA: Google LLC (Gemini API, which reads uploaded documents and answers questions, and Grounding with Google Search for some questions, under Google's paid-service terms); Stripe, Inc. (payment processing and billing records); Resend, Inc. (email delivery); and Railway Corporation (hosting and database, in a United States region). Lighthouse will post any new subprocessor on this page and email the Customer's account address at least 30 days before the subprocessor first handles Customer Personal Data. The Customer may object in writing within that time, and if the parties cannot resolve the objection the Customer may end the agreement and receive a refund of prepaid fees for the period after termination.

8. Requests from Individuals

Taking into account the nature of the Service, Lighthouse will help the Customer respond to requests from the Customer's clients to access, correct, delete, or receive a copy of their personal information, through the export and deletion tools in Settings or on request. If an individual contacts Lighthouse directly about Customer Personal Data, Lighthouse will tell the individual to contact the Customer and will tell the Customer within 10 business days.

9. Security Incidents

Lighthouse will notify the Customer without undue delay, and within 72 hours, after confirming a security incident that affects Customer Personal Data, with the information it then has about what happened, what data is involved, and what it is doing about it, and will give reasonable help so the Customer can meet its own notice duties. Lighthouse will not notify the Customer's clients or regulators about Customer Personal Data unless the law requires it or the Customer asks.

10. Return and Deletion

On termination, and at any earlier time on request, the Customer can export Customer Personal Data and Lighthouse will delete it from the Service within 30 days, except where the law requires Lighthouse to keep it. Copies in the hosting provider's backups are overwritten on its normal schedule. Lighthouse will tell its subprocessors to delete Customer Personal Data they hold for Lighthouse.

11. Audits and Information

Lighthouse will give the Customer the information reasonably necessary to show compliance with this DPA, including answers to a reasonable security questionnaire once a year, and will cooperate with reasonable steps the Customer takes to confirm that Customer Personal Data is used consistently with this DPA. Lighthouse will tell the Customer if it can no longer meet its obligations under applicable privacy law, and the Customer may take reasonable steps to stop and remediate any unauthorized use of Customer Personal Data.

12. Privacy Laws and Financial Institutions

Lighthouse will comply with the privacy laws that apply to it as a service provider or processor, including the California Consumer Privacy Act and the contract requirements of other state privacy laws, and certifies that it understands and will follow the restrictions in Section 3. If the Customer is a financial institution under the Gramm-Leach-Bliley Act, Lighthouse will maintain safeguards for Customer Personal Data appropriate to the Service and will cooperate with the Customer's service provider oversight.

13. Liability and Term

This DPA lasts as long as Lighthouse processes Customer Personal Data for the Customer. Each party's liability under it is subject to the limits in the written agreement. This DPA is effective only when signed or accepted in writing by both parties.

14. Contact

To request a signed DPA or ask about it, contact Lighthouse Companies, LLC at support@lighthousecompanies.pro.