← Back to MCACRM

MCACRM Privacy Policy

Effective Date: May 12, 2026

Company: MACRAM LLC

Contact: support@mcacrm.ai

This Privacy Policy explains how MCACRM collects, uses, shares, and protects information when you use our software platform (the "Services").

1. What We Collect

We collect information in three main categories:

A) Account and Profile Information

  • Your name, email address, and basic profile information associated with your account.
  • Shop/workspace identifiers and role/membership information.

B) Customer Content You Provide (Deal Data & Documents)

The Services are designed to process business underwriting files and related deal information you upload or connect. This may include documents that contain sensitive information, including personally identifiable information ("PII").

Where files live:

When you connect Google Drive, deal files may be stored and organized in folders in your own Google Drive. MCACRM may temporarily access files you select in order to process them and generate outputs.

C) Usage, Device, and Log Information

  • Feature usage, event timing, and error logs.
  • Device/browser information and IP address for security and debugging.

2. Google User Data (OAuth) and Scopes We Request

A) Google Drive (drive.file)

What it allows: Create, view, edit, and manage only the specific Drive files and folders you use with the app.

Why we need it: Organize deal documents inside your Drive and create/manage files you explicitly use with MCACRM.

B) Gmail Send (gmail.send)

What it allows: Send emails on your behalf.

Why we need it: Send lender submission emails and deal package communications initiated by you.

C) Gmail Modify (gmail.modify)

What it allows: Read, compose, send, and modify Gmail messages.

Why we need it: Power an in-app lender inbox/triage workflow including reading lender replies and syncing message state.

Limited Use

We do not use Google user data for advertising. We access Google Drive/Gmail data only as needed to provide features you enable and use.

Google API Services User Data Policy (Limited Use)

MCACRM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access, use, store, and share Google user data only as necessary to provide user-facing features you enable within MCACRM. We do not use Google user data for advertising, and we do not sell Google user data.

3. AI & Document Processing (Textract + Claude)

We may process selected documents through third-party services to provide underwriting summaries and derived metrics.

AWS Textract

We may use AWS Textract to extract text and structured data from documents.

Anthropic Claude API

We may use Anthropic's Claude API to generate summaries, classifications, or derived metrics.

PII Minimization

We are designed to minimize and scrub sensitive identifiers prior to AI processing where feasible. No automated system is perfect, and you should assume some sensitive information could appear in source documents. You are responsible for ensuring you have rights/consent to process documents you upload.

4. How We Use Information

We use information to provide, maintain, and improve the Services, generate underwriting outputs, enable integrations, prevent abuse, and provide support.

5. Data Isolation & Lead Protection

Your deal data is siloed to your workspace. We do not sell your deal flow, merchant contacts, or lead data to competing brokers, lenders, or third parties.

6. Data Retention

Raw documents generally remain in your linked Google Drive. We may retain extracted non-sensitive financial metrics, model inputs/outputs, audit logs, and PII-scrubbed anonymized metrics used to improve the platform.

7. Sharing and Disclosure

We may share information only with vendors necessary to provide the Services, to comply with law, or with your explicit instruction. We do not sell your personal information.

8. Subprocessors

  • Google — OAuth authentication and integrations
  • Supabase — authentication and database
  • Amazon Web Services (AWS) — Textract and infrastructure
  • Anthropic — Claude API processing
  • Vercel — frontend hosting
  • Render — backend hosting

9. No Sale / No Advertising

  • We do not sell your personal information.
  • We do not use Google user data for advertising.
  • We do not share your deal flow or merchant leads with competing brokers or lenders.

10. Security

We implement safeguards designed to protect information, but no system is 100% secure.

11. Your Choices and Rights

You can disconnect your Google account at any time. You may request access or deletion by contacting support@mcacrm.ai.

12. Changes

We may update this Privacy Policy and revise the Effective Date.