Legal
Privacy Policy
Want us to stop selling or sharing your information, or delete it? Send a privacy request.
BrokerSeat Privacy Policy, version 1.0, effective the date you accept them
This policy explains what personal information BrokerSeat holds, why, who gets it, how long we keep it, and how to ask us to delete it. It covers three groups: applicants, brokers (our customers) and merchants (business owners who asked about business funding).
1. What we collect
About brokers and their team members
| Data | Examples |
|---|---|
| Account | Your name, company name, business email, phone, your "I am an MCA broker or ISO" confirmation |
| Login and security | Password (stored hashed), 2-step setup, devices, IP addresses (including at sign-up), login history, fraud checks on new accounts (email domain type, payment risk level from Stripe, matches with other accounts, whether your company can be found online) |
| Billing | Plan, extra users, charges, receipts, credits history. Card details are held by Stripe, not by us |
| Activity | Buy box, unlocks, lead opens, status marks, opt-out reports, returns, exports, settings changes, webhook URL and delivery logs, in-app notifications |
| Agreement | Which terms version you accepted, when, and from which IP |
About applicants
| Data | Examples |
|---|---|
| Contact | First and last name, work email, mobile phone, company name. Saved as soon as you finish the first step, even if you do not finish the form |
| Your answers | Team size, funded deals a month, monthly lead budget band, your "I am an MCA broker or ISO" confirmation (older applications may also hold role, years in MCA, seats, states, merchant revenue and industries, CRM and lead sources) |
| Consent | The contact consent box, its wording version, date, time, IP address, user agent and page |
| Technical | IP address, browser user agent, the page and ad campaign that brought you (UTM tags, referrer), a first-party cookie ID |
| Email activity | Whether our invite and reminder emails were opened or clicked |
| Fraud checks | Email domain type (free or disposable), duplicate email or phone, same IP as another application. These never block your application |
About merchants
| Data | Examples |
|---|---|
| Contact | Name, business name, phone, email, street address and zip (if given), city and state |
| Business basics | Industry, stated monthly revenue range, time in business, funding amount asked for, use of funds, credit score range (if given) and other answers on the form |
| Checks | Phone number format result, duplicate and Do Not Contact results, an AI web lookup result (business found online, website), a short AI-written summary and red flags |
| Consent proof | Consent wording version, date, time, IP, page URL, browser user agent. The wording, time, IP and page are shown to the brokers who unlock the lead, as proof of consent |
| Status | What brokers report (Called, Applied, Funded, Dead) |
We never collect Social Security numbers, dates of birth, bank statements, funding applications or uploaded files.
2. Why we use it
- Applicants: to approve your request and send your invite, suggest a plan, fill in your buy box after you pay, contact you about your BrokerSeat access by email, phone and text (BrokerSeat only, never other companies), check for fraud, and improve the apply form.
- Brokers: to open and run your account, check new accounts for fraud, bill you, deliver leads, keep the service secure, prevent fraud and lead resale (including canary leads and activity monitoring), send service, billing and security emails and in-app notifications, and improve BrokerSeat.
- Merchants: to check the request is real, match it with business funding brokers who serve the merchant's state and business, keep proof of consent, honor opt-outs, and run aged lead lists as described below.
- We use an AI provider to look the merchant's business up on the web and write a short lead summary. We send it only the business name, state, city if given, industry, website if given and the business phone. We never send it the owner's name, email, IP address or consent data.
- At broker sign-up we may use the same AI provider to look your company up online (company name only) as a fraud check.
3. Who gets merchant information
- Up to 3 brokers per lead. When a merchant submits a request, their contact details and business basics can be unlocked by up to 3 BrokerSeat member brokers (business funding brokers). Those brokers may call, text or email the merchant about business funding.
- Aged list buyers after 30 days. After 30 days, contact details and business basics (name, business name, phone, email, state, industry, revenue range, time in business) may be included in aged lead lists sold to other BrokerSeat member brokers. Merchants who opted out or were marked Funded are never included.
- Service providers who run BrokerSeat for us under contract: hosting and database (Vercel, Supabase), payments (Stripe), email (Resend), error tracking (Sentry), security (Cloudflare), and an AI provider for lead summaries and business lookups.
- When the law requires it, to protect rights or safety, or as part of a sale or merger of BrokerSeat.
- BrokerSeat itself never calls, texts or emails merchants.
4. Who gets applicant and broker information
- Applicants: only BrokerSeat and the service providers above. We do not sell applicant information, we do not share it with other companies for their marketing, and we never give it to merchants, lead sources or other brokers.
Brokers:
- Our service providers listed above, to run the service and take payments.
- Card networks, banks and Stripe, as evidence if you dispute a charge.
- Authorities when the law requires it, or a buyer of BrokerSeat in a sale or merger.
- We do not sell broker information. Merchants do not see which brokers unlocked their request unless a broker tells them.
5. How long we keep it
How long we keep each kind of data:
| Data | Kept for |
|---|---|
| Merchant contact details | 2 years from when the request came in, then anonymized |
| Consent proof | Contact data period plus 5 years |
| Opt-out (Do Not Contact) list | Forever, as one-way hashes, so an opted-out merchant is never listed again |
| Purchases, credits and billing records | 7 years |
| Audit and security logs | At least 2 years |
| Webhook delivery logs | 2 years |
| Applicant data (apply form, consent, email activity) | 2 years from your last activity (last form step, email open or click, or login), then deleted or anonymized. If you become a broker, the broker rows below apply |
| Broker account details | While the account is open; removed on request after closing, except records we must keep (billing, purchases, audit) |
Deleted data can remain in encrypted backups until the backup window passes, then it is gone.
6. Opt-outs and deletion requests
- Merchants can stop calls and texts by replying STOP to a broker or telling the broker. To stop BrokerSeat offering their request to more brokers, they can email privacy@brokerseat.com. We send a confirmation link to the email on file for their request; once they confirm, we stop all future sales and alerts of it and stop emailing them.
- Merchants can ask us to delete their information. After they confirm by the link we send to the email on file for their request, we stop all future sales and alerts of it, stop our own emails to them, and keep the consent proof and a record of the request (so we can prove what happened and keep them out of future sales). Brokers who already bought the request keep their copy under their own legal duties. We aim to finish within 45 days.
- Applicants can stop our emails with the unsubscribe link in any email, stop texts by replying STOP, ask us not to call, or ask us to delete their application by emailing privacy@brokerseat.com. Stopping our emails does not cancel your invite.
- Brokers can ask for a copy of their data or to delete their account information after closing their account. Billing, purchase and audit records are kept for the periods above.
- Send requests to privacy@brokerseat.com. We may need to confirm your identity first.
7. Security
- Lead contact details are kept in a locked part of the database and are never sent to a broker's browser before that broker unlocks the lead.
- All traffic is encrypted (HTTPS). Data is encrypted at rest by our providers.
- Passwords are hashed. 2-step verification is available to every broker and required for BrokerSeat staff. Sensitive actions (payment methods, settings, exports) ask you to confirm it's you again, with your 2-step code if it's on or your password if not.
- Webhooks are signed and only sent to secure (HTTPS) addresses.
- Access by BrokerSeat staff is limited by role and logged in an audit log that cannot be edited.
- Card details are held by Stripe, not by BrokerSeat.
- If a breach affects your personal information, we will tell you as the law requires.
No system is perfectly secure, but we work to protect your data.
8. Your choices and rights
Depending on where you live, you may have rights to know, access, correct or delete your information, or to opt out of its sale. Email privacy@brokerseat.com to use them. We will not treat you differently for using these rights.
8a. California residents
- Do Not Sell or Share: BrokerSeat sells merchant contact details to member brokers (section 3). California residents can opt out of the sale or sharing of their personal information with the "Do Not Sell or Share My Personal Information" link in our website footer, or by emailing privacy@brokerseat.com. After you confirm by the link we send to the email on file, we keep you out of all future sales.
- Deletion: California residents can ask us to delete their information, directly or through the California data broker deletion platform. We honor the request as in section 6.
- You also have the rights in section 8 (know, access, correct, delete, opt out), and we will not treat you differently for using them.
9. Children
BrokerSeat is a business service. It is not for anyone under 18, and we do not knowingly collect data from children.
10. Changes to this policy
We will post updates here with a new effective date and email brokers about material changes at least 14 days before they apply.
11. Contact
- Privacy and opt-outs: privacy@brokerseat.com
- Support: support@brokerseat.com
- Mail: BrokerSeat, BrokerSeat, 2230 Cropsey Avenue, Brooklyn, NY 11230