Privacy Policy

Effective 22 September 2026

NinthOar sells software to mortgage lenders. That means this policy has to cover two different things, and blurring them would make it useless — so it keeps them apart.

• This website. If you fill in the form on ninthoar.com, we decide what happens to what you sent. That part is ours, and it is covered below.
• Our software, running at a lender. Each client runs their own NinthOar instance holding their own loan files. That data belongs to the lender. We handle it on their instructions, not our own.

The short version

• We do not sell your information, and we never have.
• We do not run advertising trackers, and there is no ad network on this site.
• The browser extension sends nothing to NinthOar. It talks only to your own company’s system.
• We do not use any of this to decide whether someone gets a loan.

What this website collects

What you type into the form

The inquiry form asks for a name and a work email, which are required, and then for things that are all optional: company, your role, team size, how you heard about us, which vendors you currently run, and a free-text box for anything you’d want connected.

We use it to reply to you and to decide which integrations to build next. A person reads it. You will not be added to a drip campaign.

What gets recorded automatically

When a form is submitted we also store the sending IP address, the country Cloudflare reports for that request, and the browser’s user-agent string. These are kept to tell a burst of spam apart from a burst of interest, and to enforce a submission rate limit. They are not used for marketing, profiling or advertising.

Submissions may also be checked by Cloudflare’s bot protection before they are accepted.

Analytics

This site uses Cloudflare Web Analytics, which measures page views without cookies and without fingerprinting individual visitors. We set no advertising or tracking cookies of our own.

Where it is stored, and for how long

Inquiries are stored in a Cloudflare D1 database in the United States, readable only by us. We keep them while there is a live conversation and for our business records afterwards. Ask us to delete yours and we will — see Contact.

The NinthOar browser extension

The extension puts a lender’s own loan information alongside the loan origination system their staff already work in. It is used by employees of a lender, signed in to that lender’s system.

It sends no data to NinthOar. There is no NinthOar analytics endpoint, no telemetry, no crash reporting and no third-party SDK in it. It contacts exactly two places: your own company’s NinthOar instance, and the loan origination system it integrates with.

What it handles

Signed in, it displays information from your employer’s system: names and email addresses of staff and borrowers, loan numbers, statuses, dates and amounts, loan notes, and — where the lender has enabled it — borrower text messages. It rides the session you already have with that system; it never sees or stores your password.

Browser permissions, and what they are for

• Reading tab addresses. The extension checks which loan you currently have open so it can show that loan instead of asking you to search again. This happens on your own machine. Your browsing history is never transmitted to us and never stored off the device.
• Access to one website address, which you type in. Because every lender runs NinthOar on their own domain, the extension cannot know that address when it is packaged. On first run it asks you to enter it, and only then requests permission — for that one address, and nothing else. It never asks for access to the web at large.
• Access to the loan origination system. A fixed vendor address, the same for every customer, so the extension can read which loan is on screen.
• Local storage on your device for which instance you connected to, your display preferences, and any note you wrote while offline so it is not lost.
• Notifications, off by default, for mentions and incoming messages.

Nothing the extension handles is sold, shared with third parties, used for advertising, or used to assess creditworthiness or make lending decisions.

Data inside a lender’s NinthOar instance

Each client runs a separate instance with its own server, its own database and its own credentials. Client data is not pooled, and one lender’s instance cannot reach another’s.

For the loan and borrower information in that instance, the lender is responsible for the data and NinthOar acts as their service provider. We process it to run and support the software, on the lender’s instructions and under our agreement with them — not for our own purposes. We do not sell it, and we do not use it to train anything or to build a cross-client data product.

If you are a borrower

Your information reaches a NinthOar instance because your lender put it there. We have no direct relationship with you, and the lender is the right place to start. Contact them to see, correct or delete what they hold. If you reach us instead, we will refer you to them and help them respond — we are not able to act on their records on our own.

Who else is involved

We keep this list short on purpose:

• Cloudflare — hosts this website, stores form submissions, and provides the analytics and bot protection described above.
• Google Workspace — our email. A message you send us lands in a mailbox there.
• Amazon Web Services — infrastructure supporting client instances.

We disclose information beyond this only where the law requires it, or where it is necessary to protect our rights or the safety of others.

Security

Traffic to this site and to client instances is encrypted in transit. Access to our systems requires multi-factor authentication. Client instances are separated from one another as described above. No system is perfectly secure, and we do not claim otherwise; if you believe you have found a vulnerability, write to security@ninthoar.com.

Your choices

Ask us what we hold about you, ask for it to be corrected, or ask us to delete it, and we will — for data this policy says is ours. Depending on where you live you may have these as legal rights; we would rather just honor the request than argue about which statute applies. For data held inside a lender’s instance, see the borrower note above.

We do not sell or share personal information for cross-context behavioral advertising.

Children

This is business software for mortgage professionals. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Changes

If this policy changes in a way that matters, we will update the effective date at the top and, where the change is significant, tell affected clients directly.

Contact

NinthOar LLC — a US-based company.
Privacy: privacy@ninthoar.com
Support: support@ninthoar.com
Security: security@ninthoar.com