Trust and data stewardship
Privacy is part of the operating model.
Fintek Sentinel handles real identities and confidential lender information. This notice explains the controlled transfer, limited source queries, confidential delivery, and deletion practices behind each review.
This notice is for website visitors, institutional contacts, and people whose information may appear in a lender-authorized review. It is not a substitute for a lender's own privacy notice, a data-processing agreement, or an engagement-specific security schedule.
Do not send a lender tape, borrower details, account numbers, government identifiers, or other sensitive records through the public Contact form or ordinary email. We establish an approved, controlled transfer path with an institution before receiving a tape.
Who decides why data is processed
Fintek Capital LLC operates Fintek Sentinel. For an institution's lender tape and related review, the institution determines the review purpose and provides the data under its authority; Fintek operates the service for that engagement and follows the agreed scope. For this public website, business inquiries, and our own administrative records, Fintek determines the purposes described below.
The service is directed to institutional commercial real estate teams, not consumers seeking credit. Its Distress Signal Summary presents evidence for human review; it does not score, rank, recommend action on, or make a lending decision about any person or borrower.
Information we handle
A lender tape may contain borrower, principal, guarantor, entity, property, loan, and related identifiers and relationships, including personal information about real individuals. Optional supplemental records can be added by an authorized Fintek administrator; they are not required from the lender.
For the agreed jurisdictions and sources, the workflow may consult corporate, court, bankruptcy, land, tax, or other public-record material and retain source, match, timing, and limitation context. Source availability and coverage differ by engagement.
The Contact form collects name, institution, work contact details, topic, and message. Standard network/security metadata, such as IP address and request details, may be processed by Cloudflare to deliver and protect the site. The public pages do not currently run advertising pixels or behavioral analytics scripts.
We maintain tenant and run identifiers, authorized administrator identity and audit events, transfer integrity digests, processing status, and delivery/deletion events. The control-plane logs are designed not to contain lender-tape contents.
Use, sources, and disclosures
We use lender data to receive and validate the authorized tape, investigate relevant entities and relationships, examine configured evidence sources, prepare the confidential summary, deliver it to the registered institution contact, support the review, and perform security, audit, and deletion operations. We use website inquiry data to respond to the inquiry and maintain business correspondence.
A configured court, corporate-record, or property-data query may send the necessary name, address, or review-date search terms to that source provider. The full lender tape and confidential summary are not sent to those providers as files. The Sentinel workflow does not publish lender tapes or summaries, provide one lender's tape to another lender, or use tape data for public marketing. The current build has no third-party generative-AI call for tape processing or model training. Other disclosures may be made to infrastructure and delivery providers needed to operate the service, including Cloudflare; to the institution that supplied the tape; and where law or valid process requires. Specific source, processor, residency, and contractual requirements should be settled in the institution's engagement terms.
Public-record availability does not make a lender's combined tape, identity graph, or summary public. Source records can be incomplete or inaccurate; a similar name alone is not treated as a confirmed identity match.
Restricted access and confidential delivery
The current build uses HTTPS transport; Cloudflare Access and named memberships for Fintek administrators; run-specific storage paths and server-side access checks; one-use, expiring, signed lender-upload links; size and SHA-256 integrity checks; and a restricted processing path. A separate D1 tenant for each institution is an onboarding requirement before its real tape is accepted. The public Contact form cannot start a portfolio review or receive a lender tape. Material run actions are recorded for administrative audit without placing tape contents in application audit logs.
The original confidential tape and internal evidence artifacts are held in restricted storage for the run. The institution receives an AES-encrypted Excel Distress Signal Summary; the download link and workbook passcode are sent in separate emails to the same registered institution address. The passcode is not stored in the control database or object storage, and plain processing artifacts remain administrator-only. Ordinary email and the public Contact form are not approved channels for transmitting confidential lender records.
No safeguard eliminates all risk. We investigate suspected incidents and coordinate notice with affected institutions and authorities as required by the applicable contract and law.
Thirty-day run-content policy with scheduled deletion
The standard lender-run retention period is 30 days. A run receives an expiration when created; for a completed review, the window is refreshed when its summary becomes available. A scheduled process checks every 15 minutes, retires expired runs, and removes the associated confidential tape, generated artifacts, and run-scoped source cache. A Fintek administrator can delete a run sooner. If an object removal fails, maintenance retries it; a limited deletion audit record remains. Any engagement-specific retention period or legal-preservation requirement must be addressed in the institution's terms.
Business inquiries and necessary account, security, audit, and legal records are subject to different retention criteria: they are kept only as needed for the inquiry, service administration, security, contractual obligations, or applicable law, then disposed of under the relevant process. The 30-day run-content policy does not mean every operational record or contact email is erased on the same schedule.
Privacy requests and legal boundaries
State privacy laws may give an individual rights to know, access, correct, delete, or limit certain personal information, depending on residence, the data, our role, and applicable exceptions. We do not assume that financial-data exemptions remove every obligation. A person whose information came from a lender tape should normally direct a request to that institution, which controls the engagement. If a request reaches Fintek, we will authenticate it as appropriate, coordinate with the institution, and respond or assist as required by law and contract. Please do not include account numbers, full government identifiers, or tape extracts in an initial request.
Federal financial-privacy and security rules, the Fair Credit Reporting Act where its definitions and use conditions are met, and state privacy and breach-notification requirements may apply to a particular use or dataset. A score-free commercial review is not, by itself, a legal exemption. Any proposed eligibility or consumer-report use requires separate legal review before use.
To start a privacy or security inquiry, use the Contact page, select “Security and privacy,” or write to sales@fintekcapitallc.com. We may need to verify identity or institutional authority through a separate secure channel.
Contact and notice changes
Fintek Capital LLC, Alabama Office, 8603 Madison Blvd, Madison, AL 35758. Telephone: 307.533.7712. Email: sales@fintekcapitallc.com.
We may revise this notice as the product, controls, and applicable law change. We will post the updated date here; material changes affecting an active lender engagement will be handled under its contract. This public notice is descriptive and does not override stricter signed terms.
For context on the regulatory framework, see the FTC Safeguards Rule guidance, CFPB Regulation P, and the California Privacy Protection Agency FAQ. These links do not imply that every rule applies to every Sentinel engagement.