Privacy Policy

Effective date: April 17, 2026

This privacy policy describes how Atlantic Home Mortgage, LLC dba Lendtrain (“Lendtrain,” “we,” “us”) collects, uses, and protects information when you (a) visit the Lendtrain website at lendtrain.com (the “Site”), (b) use the Lendtrain mortgage refinance plugin for Claude Code (the “Plugin”), or (c) use the Lendtrain Chat API (the “API”).

Information We Collect

Information you provide

When you use the Plugin or API to request a refinance quote, you may provide mortgage details such as:

Current loan balance, interest rate, and monthly payment
Estimated property value and property type
Property state and occupancy type
Estimated credit score range
Current loan type (Conventional, FHA, VA)
Refinance goals (lower payment, cash out, shorter term)

Information we never collect

The Plugin and API are designed to never collect the following, and will actively refuse if offered:

Social Security numbers (SSN)
Dates of birth
Bank account numbers or financial account credentials
Passwords or authentication tokens
Government-issued identification numbers (other than for loan application via secure portal)

Automatically collected information

The Chat API logs IP addresses for rate limiting purposes (20 requests per minute per IP). IP addresses are not associated with conversation content and are retained for a maximum of 30 days. The Plugin communicates with a mortgage pricing MCP server to retrieve rate quotes; these requests do not include personally identifiable information.

The Site automatically collects the following when you visit:

IP address (truncated for analytics; full IP hashed server-side for Meta Conversions API)
User agent string, screen resolution, device type, browser language
Pages viewed, buttons clicked, time on page, scroll depth, form interactions
Referring URL and, where present, Google Click ID (GCLID), Microsoft Click ID, Meta Click ID (fbclid), and UTM parameters
Funnel step completion, quote parameters entered (loan balance, rate, state — not name, email, or SSN), and which rate option was selected
A/B test variant assignments (stored in a first-party cookie named lt_exp)

Cookies and Tracking Technologies

The Site uses first-party and third-party cookies, pixels, and similar technologies for analytics, advertising measurement, and A/B testing. Cookies we set directly (“first-party”):

_lt_click (90 days): Stores ad click identifiers (GCLID, gbraid, wbraid, fbclid) and UTM parameters so we can attribute a completed application back to the ad campaign that drove it. Purpose: advertising measurement. No personal data.
lt_exp (90 days): Stores your A/B test variant assignments so you see a consistent experience across visits. Contains a random visitor ID and a map of experiment names to variant names. No personal data.

Third-party cookies and pixels are loaded via Google Tag Manager. See the “Advertising and Analytics Partners” section below for the specific vendors.

You can disable cookies in your browser settings. Disabling cookies may prevent some Site features (such as resuming a funnel in progress or seeing a consistent A/B variant) from working properly.

Advertising and Analytics Partners

The Site shares a limited set of behavioral events with the following third-party services to measure ad performance, retarget visitors, and improve the experience. Data is sent only from the public-facing Site. The Plugin and Chat API do not share data with any of these partners.

Google Analytics 4 (GA4): Measurement ID G-2P9ZNRSMLH. Receives page views and custom events (funnel step progression, quote displayed, application started, rate option selected, experiment assignment). IP addresses are anonymized by GA4. Governed by Google's Privacy Policy.
Google Tag Manager (GTM): Container ID GTM-W697KV2P. Loads and manages the tags for GA4, Google Ads, and the Meta Pixel. GTM itself does not collect or store personal data.
Google Ads: Receives conversion events (apply_click, funnel_start) linked to the Google Click ID (GCLID) when present. Used to measure ad effectiveness and bid on audiences that are likely to convert. Governed by Google's Privacy Policy above.
Meta (Facebook / Instagram) Pixel + Conversions API: Pixel ID 968243662400125. Fires standard events (PageView, ViewContent, InitiateCheckout, Lead) from your browser. The same events are also sent server-to-server from our /api/meta-capi endpoint for reliability. User-identifying fields (IP address, user agent) are hashed (SHA-256) before transmission. Used to measure ad effectiveness and build audiences on Facebook and Instagram. Governed by Meta's Privacy Policy.

We do not send the following to any advertising or analytics partner: your name, email address, phone number, Social Security number, date of birth, bank account information, or any information that would allow an advertising partner to identify you by name.

Your Choices

You can opt out of advertising and analytics tracking in the following ways:

Google Analytics: install the Google Analytics Opt-out Browser Add-on.
Google Ads personalization: manage at adssettings.google.com.
Meta ads: manage at facebook.com/adpreferences and Accounts Center.
Industry opt-outs: Digital Advertising Alliance and Network Advertising Initiative.
Browser controls:block third-party cookies, clear cookies, or enable “Global Privacy Control” in supported browsers. We honor Global Privacy Control signals for cookie-based tracking where technically feasible.
Do Not Track:most browsers allow you to signal a “Do Not Track” preference. Because no industry standard defines how sites should respond to this signal, we do not respond to Do Not Track at this time.

California, Colorado, Connecticut, Utah, and Virginia residents have additional rights under state privacy laws, including the right to know what personal information we collect, the right to delete it (see our Data Deletion Instructions), and the right to opt out of “sale” or “sharing” for cross-context behavioral advertising. To exercise these rights, email team@lendtrain.com with the subject line “Privacy Rights Request.”

How We Use Your Information

Information you provide is used exclusively to:

Generate real-time mortgage refinance rate quotes
Calculate state-specific itemized closing costs
Perform savings analysis with breakeven timeline and recommendation scoring
Determine eligibility for VA IRRRL refinance programs
Provide compliant refinance recommendations per TRID, RESPA, TILA, and ECOA

Data Storage and Retention

Plugin (Claude Code): The Plugin runs locally within your Claude Code session. Conversation data is managed by Anthropic's Claude Code platform according to their privacy policy. Lendtrain does not store Plugin conversation content on its servers.
Chat API: The Chat API is stateless. Conversation history is sent with each request and is not persisted on Lendtrain servers after the response is returned. Rate quotes are generated in real time and are not stored.
Pricing Engine: The MCP pricing server processes loan parameters to generate rate quotes. Loan parameters are not logged or stored. Only aggregated, anonymized usage metrics (request counts) are retained for operational monitoring.

We do not sell your information. Information may be shared in the following circumstances:

Advertising and analytics partners:behavioral events from the Site (page views, funnel progression, conversion events) are shared with Google and Meta for ad measurement, audience building, and optimization, as described in the “Advertising and Analytics Partners” section above. Some state privacy laws (California CCPA/CPRA and similar) classify this as a “sale” or “sharing” for cross-context behavioral advertising; see “Your Choices” for how to opt out.
Loan application:if you choose to apply for a mortgage through our secure application portal, the information you submit on that portal is governed by the loan origination system's separate privacy policy.
Legal requirements: we may disclose information if required by law, regulation, or legal process.
Service providers:we use Anthropic's Claude API to power the Chat API. Conversations processed through the Chat API are subject to Anthropic's data handling policies.

External Connections and MCP Scoping

The Plugin connects to one external service via the Model Context Protocol (MCP):

MCP Pricing Server: A read-only mortgage pricing engine that accepts loan parameters (balance, property value, credit score, state, loan type) and returns rate quotes. The server exposes three tools: calculate_pricing, calculate_all_pricing, and get_effective_date.
Connection security: All MCP communications are encrypted using TLS. The pricing server is stateless and does not retain loan parameters after generating a response. No authentication tokens, user credentials, or personally identifiable information are transmitted to the pricing server.
No other external connections from the Plugin: The Plugin does not connect to any advertising networks, analytics platforms, or other third-party services. Tracking described elsewhere in this policy applies only to the public-facing Site, not to the Plugin or Chat API.

Plugin Permissions and Scope

The Plugin operates with minimal permissions and does not request or use elevated access:

Does not read, write, or modify files on the user's file system (except mortgage statement uploads processed in-memory by Claude)
Does not execute shell commands or spawn subprocesses
Does not install software or modify system configuration
Does not access environment variables, credentials, or secrets
Does not attempt to evade or bypass Claude Code safety guardrails
Does not override or modify Claude's default safety behaviors

The Plugin consists entirely of Markdown skill files and an MCP server configuration. It contains no executable code, hooks, or scripts.

Security

All communications with the Chat API and MCP pricing server are encrypted using TLS. The Plugin includes a dedicated security-guardrails skill that enforces:

Prompt injection defense for uploaded documents and conversational manipulation
System prompt and business logic disclosure protection
Social engineering and authority impersonation detection
Workflow phase enforcement to prevent skipping data collection steps
Rejection of requests for SSN, DOB, bank accounts, or passwords

Borrowers who wish to proceed with a loan application are directed to a secure, authenticated application portal. Sensitive personal information required for loan origination is collected only through that portal, not through the Plugin or API.

Children's Privacy

The Plugin and API are not directed to individuals under the age of 18. We do not knowingly collect information from children. Mortgage origination services are only available to individuals who have the legal capacity to enter into a binding contract.

Maintenance and Support

Lendtrain is actively maintained by Nexus Digital Group LLC. We commit to promptly addressing security vulnerabilities, compatibility issues with Claude Code updates, and user-reported bugs. The Plugin source code is available at github.com/lendtrain/mortgage. To report issues, contact us at team@lendtrain.com or open an issue on GitHub.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Plugin or API after changes constitutes acceptance of the updated policy.

Contact

Atlantic Home Mortgage, LLC dba Lendtrain

12600 Deerfield Pkwy, Suite 100

Alpharetta, GA 30004

Phone: (888) 309-4643

Email: team@lendtrain.com

NMLS# 1844873 — Equal Housing Opportunity