Privacy Policy

Scope and contact

This Privacy Policy describes Fundlane's website visitors, demo inquiries, workspace users and people whose information customers submit. Sentinel Tech Solutions LLC, 7 Holly Hill Road, Marlboro, NJ 07746, can be contacted at mike@sentineltechsolutions.io. It takes effect on September 28, 2026.

Our role and our customers’ role

Fundlane handles its own website, account and billing administration. For customer-controlled merchant records, Fundlane processes information to provide the customer's requested service. Merchant requests may need coordination with the relevant customer. This policy does not assert that a data processing addendum has been signed.

Information we collect and its sources

Information can include account names, emails, credentials and memberships; demo names, work emails, brokerage, team size and messages; business and owner contacts, identifiers, financing and financial records; uploaded documents; communications; integration credentials and tokens; and request, security, delivery and audit events.

Sources include direct entry, customer uploads, merchant upload portals, connected mailboxes and calendars, integration providers and provider callbacks. Uploaded documents can contain sensitive information beyond structured fields.

How we use information

We use information to authenticate users, provide workspace tools and document processing, carry out requested communications and submissions, administer billing, provide support, secure and troubleshoot the service, and maintain auditability.

Merchant documents and upload links

Applications, statements, identification and checks may contain sensitive information. Documents use private storage and authorized workspace access; scoped upload and signed download links can also permit merchants without workspace accounts to provide or receive selected files. Customers must have authority to collect and share them.

Billing and payment information

Stripe hosts payment collection. Fundlane maintains customer, subscription and invoice references and billing status, not full card numbers. Stripe Checkout may request billing address and tax ID when configured. Trial-abuse checks may process limited signup or payment-method signals where configured; this does not mean every user has a collected fingerprint.

AI and document analysis

When enabled, OpenAI receives prompts, conversation context, authorized deal data and selected files or document contents for assistance and analysis. Configured hosted file tools and public research may process related inputs. Application requests can set provider storage options, but this policy does not promise provider zero retention or no training.

Connected email and calendar accounts

When connected, Google Gmail or Microsoft mailboxes may allow reading and sending messages, recipients, attachments, threads and delivery or reply data; Fundlane stores OAuth credentials needed for the connection. Google Calendar can read selected calendars and synchronize Fundlane activity events. Disconnecting stops future authorized use but cannot recall sent messages or guarantee removal of remote events.

SMS communications and choices

When enabled, Twilio processes phone numbers, message contents and delivery events; Fundlane records opt-in evidence and suppression choices. SMS opt-in is voluntary. Message frequency varies. Message and data rates may apply. Reply STOP to opt out. Where the sending service has configured HELP responses, reply HELP for assistance; you may also contact the sending company or mike@sentineltechsolutions.io.

Mobile information collected for SMS consent is not shared with third parties for their marketing purposes.

Recipients, service providers and subprocessors

Core infrastructure includes Vercel for hosting, Supabase for Auth, PostgreSQL database and private storage, and Stripe for billing. When configured, OpenAI processes AI inputs; Twilio handles SMS; Resend, or useSend as a fallback, or a configured delivery receiver handles transactional and funder-submission email; Cloudmersive or Verisys may receive files or signed URLs for scanning; Sentry (Functional Software, Inc.) receives error reports, diagnostic logs, performance traces, masked session recordings and feedback that users choose to send, so we can find and fix problems.

Customer-connected or customer-selected recipients can include Google and Microsoft mailboxes, Google Calendar or Drive where used, funders, custom webhooks, DataMerch, DocuSeal and configured form or intake providers. Such recipients are not all Fundlane subprocessors. SMTP, SendGrid and Postmark adapter support alone does not establish production use. Supabase Auth's SMTP provider, external webhook operators, provider legal entities, processing regions and contractual roles remain unconfirmed.

Cookies, browser storage and analytics

Supabase session cookies support sign-in; a cookie remembers active workspace selection and sidebar_state remembers the sidebar preference. Local storage remembers theme preferences. The application has no advertising SDK. When configured, Sentry error monitoring runs in the browser and session storage keeps a session recording consistent across page loads. Error reports can include the signed-in user’s ID, name and email, the workspace and role, the page address with tokens and query values removed, and browser and device details. For signed-in users in the app, a sample of sessions, and the moments before an error or a feedback report, may be recorded as page interactions with text, form inputs and images masked (only navigation menus and button labels remain visible). Public pages, application forms, merchant upload and review links, and account security pages are not recorded. We configure Sentry not to collect cookies, request bodies, IP addresses or AI inputs and outputs. A feedback screenshot is captured only when a user chooses to attach one, and the user can review it before sending. Hosting-side analytics and the complete cookie inventory require confirmation.

Security and operational records

Workspace roles and assignments, selected-field encryption, private document storage and limited-access links help control access. Audit events and operational monitoring record activity and errors. These measures do not guarantee absolute security, comprehensive log redaction, universal scanning or certification.

Retention, deletion and exports

Information is retained according to its purpose and applicable obligations. Existing controls include permission-scoped deal and offer exports, selective assistant deletion and expiring assistant-file or download tokens. Token expiry is not a promise of file, backup or provider deletion; a complete account archive and erasure procedure are not established.

US state privacy rights

Where applicable, individuals may request access or knowledge, correction, deletion and portability, and exercise nondiscrimination, authorized-agent or appeal rights. Applicable sale, sharing, targeted-advertising and sensitive-data choices may also apply. Send requests to mike@sentineltechsolutions.io; we may verify identity and coordinate customer-controlled records with the relevant customer.

US operations and children

Fundlane is intended for business operations in the United States and is not directed to individuals under 18. This does not guarantee that storage or provider processing occurs only in the United States.

Changes to this policy

Future revisions will carry an effective date and appropriate notice of material changes.