Privacy Notice

Coralstone is not a lender. We do not make credit decisions. We process loan files and coordinate real estate transactions for Loan Partners (loan officers), Real Estate Partners (realtors), and Companies (brokerages and mortgage bankers). We also work with their Clients (borrowers, buyers and sellers) and with Service Providers such as title, escrow, insurance, appraisal, attorneys, inspectors and HOAs.

A senior human processor owns every loan file from setup to closing. Software specialists we call Coral do routine work under that processor, including reading and organizing documents. This notice applies to anyone whose information reaches us: people who apply for a Coralstone account, people who use the app, and people whose information appears in a loan file.

We collect only what we need to apply, to open an account, to process a file and to keep the service secure. The information comes from you, from the other parties on your file, and from the documents they upload.

• Apply form: name, email, mobile phone, company, NMLS ID or real estate license and state, expected monthly file volume, and preferred language.
• Loan file data: Social Security number, date of birth, income, employment, assets, liabilities, credit information, property and contract details, bank statements, tax returns, identity documents, appraisals and title documents.
• Communications: messages, and recordings and transcripts of phone calls with parties on a file. Calls placed by Coral are recorded and transcribed, and the transcript is added to the file timeline.
• Sign-in data: passkeys or one-time codes, and session cookies.
• Device and log data: basic technical information we use for security, such as IP address, browser type and the time of each request.

We use personal information to review applications, to run the service, and to close loans and transactions. We do not use it for any other purpose without a legal basis or your consent.

• Open, approve and maintain accounts.
• Set up, process, track and coordinate loan files and transactions through closing.
• Send email and text updates, and share a live status link with the parties on a file.
• Bill fees and collect payment.
• Detect fraud, protect accounts and investigate misuse.
• Meet legal duties and respond to lawful requests.

We do not sell personal information. We do not share it for advertising. We share it only when needed to do the work, or when the law requires it.

In line with the Gramm-Leach-Bliley Act (GLBA), we do not share nonpublic personal information with non affiliated third parties except as needed to process the loan or as the law permits. The recipients below fall inside that limit.

• The parties on the file, who see the one live file for their transaction.
• The lender the file is submitted to.
• Title, escrow and settlement agents, and other Service Providers needed to close.
• Vendors that host or process data for us under contract: hosting, email and text delivery, voice calling, payment processing and AI model providers.
• Regulators, courts and other authorities when the law requires it.
• A successor, if Coralstone takes part in a merger, acquisition or sale of assets.

Coralstone uses AI models from outside AI service providers to help Coral read and organize documents and to draft routine messages. These providers process data for us under contract. A licensed processor reviews key steps, and people make the decisions that matter.

Coral writes, texts and calls only parties on the file. A phone call from Coral is recorded and transcribed. The recording and transcript are stored with the file and are available to the parties on that file.

Our marketing website uses no third-party scripts, no advertising trackers, no analytics and no third-party fonts. It sets no tracking cookies.

The signed-in app uses only the cookies required to keep your session secure. We do not use them to follow you across other sites.

We protect personal information with layered controls. No system is perfectly secure, but we work to keep your data safe.

• Every stored document is encrypted with its own key.
• Social Security numbers, dates of birth and account numbers are encrypted again at the field level.
• Staff, Company admins and Partners must use passkeys or authenticator codes.
• Each Company’s data is isolated from every other Company’s data.
• Access to sensitive fields is logged.
• Uploads are scanned for malware.
• Backups are encrypted.
• Wire-fraud shield: Coralstone never sends, confirms or changes wire instructions by email or text. Confirm wiring details by phone with the title company, using a number you already know.

We keep loan file records as long as federal and state law and investor rules require. This is generally up to seven years after the file closes or is withdrawn. After that, we delete the records securely.

If we reject an applicant, we keep the application data for up to 12 months and then delete it.

Under GLBA, you may have the right to limit certain sharing of your nonpublic personal information. We do not share it in ways that trigger that right, other than as needed to process your loan or as the law permits. You can also ask us to stop optional messages at any time.

Depending on where you live, state privacy laws may give you the right to access, correct or delete your personal information. Data covered by GLBA is largely exempt from some of these laws, so we may not be able to honor every request for loan file data. We will tell you what we can do and why.

To make a request, email privacy@coralstoneprocessing.com. We may need to confirm your identity first. We answer requests within 45 days.

Our website and app are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child sent us information, write to us and we will delete it.

We may update this notice when our practices or the law change. We post the new version here and change the date at the top. If a change is material, we will tell account holders by email or in the app.

Questions or requests about privacy: privacy@coralstoneprocessing.com.