Privacy Policy

1. Introduction

1.1. NEXUS Systems LLC (“NEXUS,” “Company,” “we,” “us,” or “our”) operates the NEXUS Platform, a Software-as-a-Service (“SaaS”) mortgage loan origination management system accessible at platform.nexus (the “Platform” or “Service”).

1.2. This Privacy Policy describes how we collect, use, store, protect, share, and dispose of information in connection with the Platform. This Policy applies to all users of the Platform, including Licensed Loan Officers, Organization administrators, and other authorized personnel (“Users” or “you”).

1.3. Because the Platform processes Consumer Data — including nonpublic personal information (“NPI”) of mortgage loan applicants and borrowers — this Privacy Policy is designed to satisfy the notice requirements of the Gramm-Leach-Bliley Act (“GLBA”), the California Consumer Privacy Act/California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Michigan Identity Theft Protection Act (MCL 445.61 et seq.), and other applicable state and federal privacy laws.

1.4. By using the Platform, you consent to the collection, use, and sharing of information as described in this Privacy Policy and in accordance with our Terms of Service.

2. Scope of This Policy

2.1. What This Policy Covers:

1. The NEXUS Platform at platform.nexus;
2. NEXUS APIs and integrations;
3. Communications between you and NEXUS (including email); and
4. Consumer Data entered into the Platform by authorized Users.

2.2. Dual Role Disclosure. NEXUS acts in two capacities:

1. Data Controller — for User account information (registration data, usage patterns, billing information); and
2. Data Processor — for Consumer Data that Users enter into the Platform on behalf of mortgage loan applicants and borrowers.

2.3. What This Policy Does Not Cover: Third-party websites, information collected by Users outside the Platform, or the privacy practices of Users themselves.

3. Information We Collect

3.1. Information You Provide Directly

3.1.1. Account Registration Information

3.1.2. Consumer Data — High-Sensitivity PII

The following data is classified as Restricted and receives the highest level of protection:

3.1.3. Consumer Data — Standard PII

3.1.4. Financial and Business Data

3.2. Information Collected Automatically

3.2.1. Technical and Usage Data

3.2.2. Sentry Error Monitoring. We use Sentry for application error monitoring and stability tracking. Sentry does NOT receive: SSNs, DOBs, financial data, borrower names, or any other Consumer Data.

3.3. Information We Do NOT Collect

• Credit card numbers, bank account numbers, or payment instrument data (handled exclusively by Stripe);
• Biometric data;
• Geolocation data (beyond IP-derived approximate location);
• Browsing activity outside the Platform;
• Data from social media accounts; or
• Any information from minors under the age of 18.

4. How We Use Your Information

4.2. We do NOT use your information for: selling or renting personal information; advertising or behavioral targeting; building consumer profiles for third-party marketing; any incompatible purpose; or training AI models on Consumer Data without explicit consent.

5. Legal Bases for Processing

1. Contract Performance — Processing necessary to perform our obligations under the Terms of Service;
2. Legal Obligation — Processing required by law (GLBA compliance, responding to legal process, breach notification);
3. Legitimate Interest — Processing necessary for our legitimate business interests (security, fraud prevention, service improvement); and
4. Consent — Where required by applicable law, we obtain your affirmative consent for specific processing activities.

6. Data Storage and Security

6.1. Data Storage Infrastructure

6.2. Security Measures

6.2.1. Encryption

6.2.2. Access Controls

• JWT Authentication — All API requests require valid JSON Web Token (HS256, 24-hour expiration);
• Live Session Validation — Every request performs a live database check; revoked sessions are rejected immediately;
• Role-Based Access Control (RBAC) — Admin, Manager, and Loan Officer roles with granular permissions;
• Organization-Level Data Isolation — Multi-tenancy enforced at the database query level; every query scoped to org_id;
• TOTP Two-Factor Authentication (2FA) — Available and recommended for all users;
• Rate Limiting — Login: 5 attempts/15min per IP; API: 100 req/min per user; SSN Reveal: 10/hour per user.

6.2.3. Monitoring and Incident Response

• Watchdog — Automated health monitoring every 30 seconds with auto-restart on failure;
• Sentry — Error monitoring for application stability (no PII transmitted);
• Audit Logging — Complete audit trail for all sensitive data access;
• Security Headers — Helmet.js enforcing CSP, HSTS (preload), X-Frame-Options, X-Content-Type-Options, Referrer-Policy;
• Input Sanitization — DOMPurify strips all HTML/JS from user inputs to prevent XSS attacks;
• CI/CD Security — GitHub Actions pipeline with syntax validation, dependency auditing, and health checks.

6.2.4. Key Management

• Encryption keys stored exclusively in environment variables — never committed to source code, logs, or disk;
• Separate keys for distinct purposes (encryption, JWT signing, Stripe, API integrations);
• Key rotation procedures documented and tested;
• Compromise of one key does not grant access to other systems.

7. Data Sharing and Third-Party Service Providers

7.2. Service Providers

7.3. Legal Disclosures. We may disclose personal information if required by law, subpoena, court order, or to protect the rights, property, or safety of NEXUS, its Users, or the public.

7.4. Business Transfers. In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction with prior notice.

7.5. No Other Sharing. We do not share personal information with any parties other than those described in this Section 7.

8. GLBA Privacy Notice

8.1. NEXUS is a service provider that processes nonpublic personal information (“NPI”) on behalf of financial institutions.

8.2. Categories of NPI Collected:

1. Information provided on loan applications — Names, addresses, SSN, DOB, income, employment, assets, liabilities, credit information;
2. Information from transactions — Loan amounts, payment history, pipeline status, closing data; and
3. Information from third-party sources — Credit reports and scores, property valuations (as entered by Users).

8.3. Information Sharing Practices. We do not disclose NPI to non-affiliated third parties except as permitted by GLBA. We do not sell NPI. We share NPI only with the service providers listed in Section 7.2.

8.4. Opt-Out. Because we do not share NPI with non-affiliated third parties for marketing purposes, no opt-out is required. However, Users and consumers may exercise their rights as described in Section 9.

8.5. Safeguards. We maintain comprehensive safeguards consistent with the GLBA Safeguards Rule and the FTC’s Revised Safeguards Rule, as detailed in Section 6.2.

9. Your Privacy Rights

9.2. We will acknowledge requests within ten (10) business days and fulfill them within thirty (30) days (or forty-five days for complex requests with notice).

9.3. We may verify your identity before fulfilling a request.

9.4. We will not discriminate against you for exercising your privacy rights.

10. California Privacy Rights (CCPA/CPRA)

10.1. If you are a California resident, the CCPA/CPRA provides you with specific privacy rights.

10.2. Categories of Personal Information Collected:

10.3. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

10.4–10.7. You have the right to know/access, delete, correct, and limit use of sensitive personal information.

10.8. Submit requests to admin@platform.nexus with the subject line [CCPA Request].

10.9. We will not discriminate against you for exercising your CCPA rights.

11. Virginia Consumer Data Protection Act (VCDPA)

11.1. If you are a Virginia resident, the VCDPA provides you with the right to access, correct, delete, data portability, and opt out. (NEXUS does not engage in targeted advertising, data sales, or profiling.)

11.3. Submit requests to admin@platform.nexus with the subject line [VCDPA Request].

11.4. If we decline your request, you may appeal by emailing admin@platform.nexus with the subject line [VCDPA Appeal]. We will respond within sixty (60) days.

12. Michigan Privacy and Data Protection

12.1. NEXUS Systems LLC is organized under the laws of the State of Michigan.

12.2. Michigan Identity Theft Protection Act (MCL 445.61 et seq.). We implement reasonable security measures, provide timely breach notification, notify the Michigan Attorney General if more than 1,000 residents are affected, and properly dispose of records containing personal information.

12.3. Michigan SSN Privacy Act (MCL 445.81 et seq.). We do not publicly display or embed SSNs; do not transmit SSNs over unsecured connections; do not print SSNs on mailed materials; and store SSNs in encrypted form with access restricted and audit-logged.

12.4. Submit requests to admin@platform.nexus with the subject line [Michigan Privacy Request].

13. Other State Privacy Laws

13.1. NEXUS serves mortgage loan originators across approximately 40 states. We comply with applicable state privacy laws including:

1. Colorado Privacy Act (CPA);
2. Connecticut Data Privacy Act (CTDPA);
3. Texas Data Privacy and Security Act (TDPSA);
4. Oregon Consumer Privacy Act (OCPA);
5. Montana Consumer Data Privacy Act (MCDPA);
6. New York Department of Financial Services (NYDFS) 23 NYCRR 500;
7. New Jersey Data Privacy Act;
8. Delaware Personal Data Privacy Act; and
9. Other state laws as enacted and applicable.

13.2. Contact us at admin@platform.nexus with the subject line [Privacy Request — Your State].

14. Data Retention and Deletion

14.2. Deletion Process. Data is removed from production, backup copies purged on next rotation (within 90 days), encrypted data rendered irrecoverable, and confirmation provided.

14.3. Legal Holds. We may retain data beyond stated periods when required by law or pending litigation.

15. Cookies and Tracking Technologies

15.1. Minimal Cookie Usage. NEXUS uses a minimal cookie footprint. We do not use third-party tracking cookies, advertising pixels, or behavioral analytics tools.

15.3. No Third-Party Tracking. We do not use Google Analytics, Facebook Pixel, advertising cookies, cross-site tracking, or participate in ad exchanges.

15.4. Do Not Track. Because we do not track users across third-party websites, our Platform’s behavior does not change in response to DNT signals.

16. Data Breach Notification

16.1. In the event of a confirmed data breach, NEXUS will:

1. Contain — Immediately revoke compromised sessions, rotate keys, and disable compromised endpoints;
2. Assess — Determine scope using audit logs and system monitoring;
3. Notify Affected Parties — Within seventy-two (72) hours of confirmation, or as required by applicable state laws;
4. Notify Authorities — Including the Michigan Attorney General if more than 1,000 Michigan residents are affected; and
5. Remediate — Address vulnerabilities, rotate keys, re-encrypt data, and document the incident.

16.2. Notifications will include: nature of the breach, categories of data affected, approximate number of records, steps taken, recommendations, and contact information.

17. Children’s Privacy

17.1. The Platform is a B2B service not directed at or intended for individuals under 18.

17.2. We do not knowingly collect personal information from children under 13 (COPPA) or minors under 16 (CCPA).

17.3. If we become aware of inadvertent collection from a child, we will immediately delete such information. Contact admin@platform.nexus to report concerns.

18. International Data Transfers

18.1. The Platform is hosted on US-based infrastructure and intended for US-based mortgage professionals.

18.2. All Consumer Data is stored and processed within the United States.

18.3. Certain service providers (e.g., Cloudflare) may process HTTP request metadata at global edge locations for CDN and DDoS protection. This involves only network routing data, not Consumer Data.

19. Changes to This Privacy Policy

19.1. We may update this Policy from time to time.

19.2. Material changes will be notified via email, Platform notice, or in-app notification.

19.3. Material changes take effect thirty (30) days after notice (or immediately if required by law).

19.4. A dated version will be maintained at platform.nexus/privacy.

19.5. Continued use after the effective date constitutes acceptance of changes.

20. Contact Information

NEXUS Systems LLC
Email: admin@platform.nexus
Website: https://platform.nexus

Privacy-Specific Requests: admin@platform.nexus — Subject Line: [Privacy Request]
Security Concerns: admin@platform.nexus — Subject Line: [SECURITY]
Regulatory Inquiries: admin@platform.nexus — Subject Line: [Regulatory Inquiry]