Privacy Policy
Effective date: October 25, 2026
BrokerLumen is operated by Scott Yale, a sole proprietor ("BrokerLumen," "we," "us"). This Privacy Policy explains how we collect, use, and protect personal information when you visit brokerlumen.com, contact us, buy our kits or services, or use the BrokerLumen portal at app.brokerlumen.com. BrokerLumen is based in El Cajon, San Diego County, California.
Information we collect
From the website and intake form: name, email address, company name, NMLS number, number of loan officers, states licensed, loan origination system (LOS) used, AI tools used, package interest, and any notes you include. The intake form opens your email app and sends this information to us by email. We do not ask for, and you should not send, borrower or consumer loan data.
From the portal: when a company uses the portal, its administrators add their team members. For each person the portal may store: first, middle, and last name; work email; state and ZIP; branch; job title; NMLS ID; phone; employee ID; hire date; manager email; role; and account status. When someone signs a policy acknowledgment, the portal records the date and time, the name they typed, their IP address, and their browser (user agent), so the company has a reliable record of the sign-off. The portal also keeps sign-in records, an admin audit log of changes, reminder history, and any spreadsheets an admin uploads to import people.
Cookies: the website does not use advertising or analytics cookies. It stores your light or dark theme choice in your browser. The portal uses essential cookies only: a sign-in session cookie, a security (CSRF) cookie, and a theme cookie.
Payments
Payments are processed by Stripe. BrokerLumen does not receive or store your full card number. Stripe handles payment information under its own privacy policy. We may receive limited transaction details from Stripe, such as your name, email, billing address, amount paid, and the last four digits of your card.
How we use information
- To respond to your inquiry and prepare proposals
- To provide the portal: sign-in, invitations, reminders, acknowledgment records, and reports for your company
- To deliver, support, and bill for kits, services, and plans you purchase
- To send service emails such as invitations, password resets, reminders, and account notices
- To keep our services secure and prevent abuse
- To meet legal, tax, and accounting obligations
Portal data we process for your company
When your company uses the portal, your company decides which team members to add and what information to enter, and it controls that data. We process portal data on your company's behalf, only to provide and support the portal for your company, and not for our own marketing. We do not sell it or use it to train AI models. Company administrators can edit, export, deactivate, and archive team member records. To have records or a whole company account deleted, a company administrator can email [email protected]. If you are a team member, contact your employer first; we will help your employer respond to your request.
Service providers (subprocessors)
We use these providers to run BrokerLumen. They receive only what they need to provide their service:
- Cloudflare: website and portal hosting, database, and security
- Our email providers: business email and delivery of portal emails such as invitations, resets, and reminders
- Stripe: payments and subscription billing
- Microsoft and Google: optional "Sign in with Microsoft" or "Sign in with Google" when your company turns it on. We receive your name and email from them to sign you in, not your password.
No sale or sharing
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only to the service providers above, when required by law, or with your consent.
Retention
We keep personal information only as long as needed for the purposes above. Portal data is kept while your company's account is open, because acknowledgment records are meant to serve as an audit trail. After an account is closed, we delete or de-identify portal data within 90 days unless your company asks us to delete it sooner or we must keep some records for legal, tax, or accounting reasons. Billing records are kept as required for tax and accounting. Inquiries that do not lead to an engagement are deleted when no longer needed.
Security
We use reasonable administrative and technical safeguards, including encrypted connections (HTTPS), hashed passwords and session tokens, and company-by-company separation of portal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you as required by law.
California privacy notice
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the rights below.
Categories collected in the last 12 months: identifiers (name, email, IP address); professional or employment information (company, job title, branch, NMLS number, employee ID, hire date, manager, number of loan officers, states licensed, systems and tools used); internet activity (browser type, sign-in and acknowledgment records); commercial information (packages purchased, transaction records); and any information you include in notes. Sources: directly from you, from your employer when it adds you to the portal, from Microsoft or Google if you use their sign-in, and from Stripe for payments. Purpose: as described in "How we use information."
- Right to know: request the categories and specific pieces of personal information we have collected about you, and how we use and disclose it.
- Right to delete: request deletion of your personal information, subject to legal exceptions.
- Right to correct: request correction of inaccurate personal information.
- Right to opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of.
- Right to limit use of sensitive personal information: we do not collect sensitive personal information for purposes that would require this right. If that changes, we will offer it.
- Non-discrimination: we will not discriminate against you for exercising any of these rights.
How to submit a request: email [email protected] with the subject "California Privacy Request." We will verify your request by matching the information you provide with what we hold. You may use an authorized agent, who must provide proof of authorization. We respond within the time required by law (generally 45 days). For portal data your employer entered, we may refer your request to your employer and help it respond.
Children
Our services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy. Changes take effect when posted here with a new effective date. If a change is significant, we will tell portal account administrators by email.
Contact
BrokerLumen is operated by Scott Yale, a sole proprietor.
Mailing address: 740 Mundy Terrace, El Cajon, CA 92020
Email: [email protected] (support, privacy, refunds) or [email protected] (sales)