Legal
How we protect your information
Last updated September 16, 2026. Version history
In plain language
Your phone number is stored as a one-way hash plus the last 4 digits, never in plain text.
Named people, with a second factor and expiring sessions, are the only ones who can open a record.
One message to contact@practitionfinance.com or the stop page ends contact and reaches the partners too.
1. What this page is
A plain description of how Practition Finance handles what you send us: what is collected, where it sits, who can open it, how long it stays, and what happens when you ask us to stop.
The Privacy page states your rights and our legal obligations. This page states the controls behind them.
2. What we collect and what we do not
We collect the business and contact details you type into a form, the state you operate in, the general shape of what you are financing, and the technical details of the submission itself.
- We do not collect protected health information, and forms are not the place for patient data.
- We do not collect government identifiers, bank credentials, or documents through any form here.
- We do not buy visitor identity data, and we do not run identity resolution on visitors who never submitted a form here.
3. How we protect it
Five controls carry most of the weight.
- Data is encrypted at rest with managed keys, held separately per data class, on a rotation schedule.
- Phone numbers are held as a one-way hash plus the last 4 digits for display. The plain number exists only in transit while your request is delivered.
- Files, including consent images, sit in private storage reachable only through short-lived signed links.
- Optional scripts, including analytics, load only after you turn them on, and never when your browser sends a Global Privacy Control signal.
- A strict content security policy limits what the browser is allowed to load and where it is allowed to send anything.
4. Who can access it
Access is by named role, not by shared login. The owner role covers exports, deletions, key rotation, and the allowlist. The operator role covers day-to-day lead work and nothing destructive.
Sign-in is Google plus a second factor. Sessions expire on a 12 hour maximum and a 1 hour idle timeout, and destructive actions require a fresh sign-in inside the last 5 minutes.
Every action writes to an append-only log that no role can edit or delete.
5. How long we keep it
Three tiers, published here, enforced by scheduled jobs and a legal hold when the law requires it. Opt-out status is kept the longest, consent evidence next, and the general record on its own clock.
| Record | How long we keep it |
|---|---|
| Opt-out and do-not-contact status: opt-out and deletion requests, do-not-disturb settings and the reason and date they were set, STOP replies, and the internal-only flag and its history | at least 10 years from the date of the opt-out, and never purged before then |
| Consent documentation: consent flags, the consent text shown, the hashed IP address, the timestamp, how the consent was captured, the transcript excerpt, the full call transcript stored on our systems, and any reconsent or consent-review record | 5 years from the date of the record |
| Call audio copied into our own consent-evidence storage, which happens only when the record is flagged for consent review, is marked internal only, or is under a legal hold | 5 years from the date of the record when the copy was made for a consent review, and at least 10 years when it was made for an internal-only flag or a legal hold |
| General lead and inquiry records with hashed identifiers on our systems, excluding the categories above | 5 years after last activity |
| Contact records, conversations, and call recordings held in our CRM platform | deleted 24 months after last activity, then permanently purged by the platform within 2 months, except opt-out status, which is kept at least 10 years, and any copy already held in our own storage under the rows above |
| Cookie preference choices | 12 months |
| Any other operational data | no longer than needed for the purpose it was collected |
Opt-out status and consent evidence are preserved when the general record reaches the end of its window, and are removed only by their own tier. A legal hold pauses deletion when a dispute or legal matter requires it; held records are deleted when the hold ends.
6. How consent is documented
When you submit a form we keep a record of that submission as you saw it, so consent can be shown later without asking you to remember it.
- A copy of the page as it appeared to you, with everything you typed masked.
- An image of the form area showing the consent text and the checked box.
- The timing of your interactions with the form, and whether the consent text was on your screen when you checked the box.
- The version of the site and of the consent language you saw.
- A tamper-evident hash linking your record to the ones before it, so a changed record is detectable.
- A monthly write-once preservation copy of the chain, held for 5 years.
7. How to stop us
Tell us the number or email to stop, and we stop and tell the partners who received your request within 10 business days.
Three routes work: the stop page at /stop, replying STOP to any text, or writing to contact@practitionfinance.com.
A stop request sets do-not-disturb in our contact system, blocks future submissions from that number or address, and notifies every funding partner that received your request inside the retention window.
8. How to get your records
Ask for a copy of what we hold, a correction, or deletion, and we return it in a readable file. Requests come in through the Do Not Sell or Share page and are tracked with a reference number you can check.
We verify a request against the number or address it concerns before we act on it, so nobody can pull your record by asking for it.
9. Who else touches it
Three groups, and no others.
- Subprocessors that run the site and its messaging: the hosting and database platform, the contact system, the email sender, and the error monitor. Each is named on the Privacy page.
- No AI provider receives personal information. Drafting tools see subject matter and figures, never a name, number, or address, and every provider we use is under business terms that prohibit training on what we send.
- Funding partners, who receive the request you asked us to send and act as independent parties responsible for their own handling of it.
10. If something goes wrong
We investigate, contain, and record what happened, then notify affected people and regulators as the law requires and within its deadlines.
Responsible disclosure is welcome. Write to contact@practitionfinance.com with the detail and we will confirm receipt, work the issue, and credit you if you want the credit.
11. What we never do
Five commitments, stated so they can be held against us.
- We do not sell information to data brokers or list resellers. In most states your information goes, after you consent, to no more than 3 funding partners at a time. In California and Missouri, we are paid a fixed fee to transfer your inquiry to a funding partner, which counts as a sale or sharing of personal information under state privacy law, and you can opt out any time through the Do Not Sell or Share link.
- We do not store phone numbers in plain text.
- We do not let AI providers train on personal information.
- We do not share your request beyond the partners it was submitted for.
- We do not display credentials we do not hold, and we do not manufacture urgency to make you act.
12. How we check ourselves
Quarterly: a self-run test pass over headers, access boundaries, tokens, rate limits, storage links, and webhook signatures, plus an access review and a key rotation review.
Yearly: a full policy review with counsel.
Continuously: every version of this page, Privacy, Terms, and Disclosures is listed with its date at /policy-history.
Disclosures effective September 25, 2026, version 7.
Last verified
The retention schedule was last checked against live records on October 16, 2026 at 03:40 UTC. No record had reached the end of its window.
Source: automated retention check, run nightly, logged to the internal audit trail.
Contact
JayBen, LLC dba Practition Finance
514 Americas Way #14796, Box Elder, SD 57719