Privacy Policy

We collect the following kinds of information, depending on how you use the service.

• Contact details. Your name, email address, phone number, company name, and your role, when you request a quote, ask a question, schedule a call, apply as a partner, sign up for the newsletter, chat with us, or create an account.
• Deal information. The property address and type, purchase price, deposit amount, closing date, parties, ownership details for your company and its owners, and the notes you add.
• Entries you haven’t submitted yet. Our deal form and deal application save what you enter as you go, before you press submit, so you don’t lose your work and so our team can follow up if you stop partway. This includes what you type into our public deal form even if you never send it. If you leave a request unfinished, we may email you about it at the address you entered; you can opt out at any time. We will not call or text you about an unfinished request unless you have agreed to be contacted.
• We use Didit Identity, Inc. to verify your identity. When you verify, Didit collects a photo of your government ID, a selfie and short liveness video, and creates a face template from them to confirm the ID is yours and that you are a real person present at the time. This is biometric information. Didit processes it only on our instructions, stores it on servers in Ireland, and deletes the ID images, selfie, video and face template within 30 days after you complete or abandon a verification, or sooner when you ask us. Didit may keep a limited security log for up to one year. We have turned off Didit's use of our data to improve its own products. We keep only the result of the check (whether it passed, the name and date of birth confirmed, and the date) with your deal records, as described under Retention. We never sell, rent or share biometric information for any other purpose. You can ask us to delete it sooner by emailing Jack@softdeposits.com.
• Biometric information. To match your selfie to your ID photo, our service provider Didit uses facial recognition technology that creates facial geometry data, which some laws (including in Illinois, Texas and Washington) treat as biometric identifiers or biometric information. We ask for your written consent in the verification step before any selfie is taken. Biometric information is collected and used only to verify your identity and prevent fraud. SoftDeposits does not receive or store it; Didit processes it on our behalf. We do not sell, lease, trade or otherwise profit from biometric information, and we do not disclose it except to Didit as our service provider, with your consent, or as required by law. If you don’t want to verify with a selfie, contact us at jack@softdeposits.com to ask about another way to verify.
• Documents. Purchase agreements, entity documents, IDs you choose to send us directly, and other files you upload or email to us.
• Account details. Your login email, a password stored only as a salted scrypt hash, your Google sign-in identifier if you connect Google, two-step verification settings (the secret is encrypted), the devices and approximate locations you sign in from, and a security log of sign-ins and key actions in the portal.
• Messages. What you write to us in forms, portal messages, and email, and our replies.
• Usage and device data. Your IP address, browser and device type, the page you submitted a form from, and campaign parameters in the link you arrived with (for example, how you heard about us). We also collect usage data through Google Analytics, as described in section 4.

We do not collect bank account logins through the service, and we never ask for your password by email or message.

If you sign in with Google, Google shares your name, email address, Google account ID, and whether your email is verified. We use that only to sign you in and keep your account secure. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

• to review your deal, decide whether to fund a deposit, and carry out the deal with title and escrow companies;
• to verify identity, prevent fraud, comply with sanctions laws, follow anti-money-laundering practices, and meet other legal duties;
• to create and manage your account and to respond to your questions, messages, and call requests;
• to send service messages such as status updates, document requests, and verification links;
• to send our newsletter and other marketing you have asked for, with an unsubscribe link in each message;
• to understand how the site is used, fix problems, and improve the service; and
• to enforce our terms, protect our rights and users, and comply with law.

We may contact you by phone, text message, and email about your request, account, or deal. We send text messages only if you have agreed to receive them. Message and data rates may apply, and you can reply STOP to any text to opt out of texts.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows.

• Service providers that help us run the service, under contract and only for our purposes. Today these are Netlify (website hosting, private document storage, form notifications, and our database through Netlify’s database service run by Neon), Resend (sending email), HubSpot (customer relationship management, form handling, marketing email, and site analytics, as described in section 4), Didit (identity verification), Google (Google Analytics, as described in section 4, and sign in with Google, only if you choose it), xAI (our website chat assistant, and automated reading of documents you upload, for example to fill in your deal details from your purchase agreement and to give our team a first review of it), and Cloudflare (spam protection on forms, if enabled) and, if you book a call through an online scheduler, Cal.com (booking calls with our team). We may add or replace providers over time.
• Title and escrow companies, sellers’ representatives, and other parties to your deal, to the extent needed to carry out the deal you asked us to fund.
• Companies under common control with H1 Capital LLC, which help run and fund the service and follow this policy.
• Our funding sources and their agents, such as the provider of our credit facility, to the extent needed to fund a deposit and to report on and service funded deals, under confidentiality obligations.
• Professional advisors such as lawyers, accountants, auditors, and insurers who are bound to keep it confidential.
• Legal and safety reasons, when we believe disclosure is required by law, subpoena, or court order, or is needed to prevent fraud or harm.
• A business transfer, if SoftDeposits or its parent is involved in a merger, financing, or sale of assets. We would tell you if your information became subject to a different policy.
• With your direction, for example if you ask us to introduce you to a partner.

We use two kinds of cookies: cookies needed to run the service, listed below, and analytics cookies from Google Analytics, described under Analytics. The cookies needed to run the service are: a secure, httpOnly sign-in cookie, a security cookie that protects forms from cross-site attacks, and local browser storage for things like an unfinished application or a choice you made. We also use HubSpot, our customer relationship tool, which sets cookies to recognize returning visitors and, if you later submit a form, link the pages you viewed to your inquiry so we can follow up. We have turned off HubSpot’s advertising features, and we do not use HubSpot cookies for ads. We do not load HubSpot tracking if your browser sends a Global Privacy Control or Do Not Track signal. We use Google Analytics to understand how visitors use our site and portal (pages viewed and whether a form, sign-up, or deal submission was completed). Google Analytics sets its own cookies and receives your IP address and browser and device information; we do not send it your name, email, phone number, or deal details, and we have turned off Google signals and ad personalization. Google processes this data under its own privacy policy. We do not load Google Analytics if your browser sends a Global Privacy Control or Do Not Track signal, and you can also opt out with Google’s browser add-on at tools.google.com/dlpage/gaoptout.

If spam protection from Cloudflare Turnstile is turned on for a form, Cloudflare may process your IP address and browser signals to tell people from bots, under Cloudflare’s privacy policy. We honor a browser “Do Not Track” or Global Privacy Control signal by not loading Google Analytics or HubSpot tracking.

You can block or delete cookies in your browser settings. If you do, parts of the portal, such as staying signed in, may not work.

We keep personal information for as long as we need it for the purposes above. In general, we keep deal records, identity results, and related documents for at least seven years after a deal ends, because financial and compliance rules may require it. Entries on our public deal form that were never sent are kept for up to 90 days and then deleted. Quote requests that were submitted but never turned into an account, and related messages, are kept for up to three years. Security logs are kept for up to two years. Google Analytics data linked to cookies or device identifiers is kept for 14 months and then automatically deleted; aggregated reports that don’t identify you may be kept longer. When you close your account, we delete or anonymize your profile within 90 days, except records we must keep as described here. Backups roll off on their normal schedule. Newsletter subscribers stay on the list until they unsubscribe or ask us to remove them.

When we no longer need information, we delete it or make it anonymous, unless the law requires us to keep it longer.

We use reasonable administrative, technical, and physical safeguards, including encrypted connections (HTTPS with HSTS), encryption at rest at our hosting providers, passwords stored only as salted hashes, sign-in limits and temporary lockouts after repeated wrong passwords, documents stored privately and available only to your account and our staff, required two-step verification for staff, and a log of staff access, downloads and changes. No system is completely secure, and we cannot promise that information will never be accessed without permission. Choose a strong, unique password and protect your login.

If a breach affects your personal information, we will notify you and the authorities as the law requires, including under New York’s SHIELD Act.

• Access and correction. You can see and update much of your information in your account under Settings, and download a copy of your profile, deals and requests with “Download my data.” You can also email us to ask for a copy of what we hold about you or to fix it.
• Deletion. You can ask us to delete your personal information. We may keep some of it where we are required to by law, or need it to complete a deal or resolve a dispute, and we will tell you what we kept and why.
• Unsubscribe. Every marketing email has an unsubscribe link. You can also email us. Service messages about an active account or deal will continue. Reply STOP to a text message to stop texts.
• Identity data at Didit. Didit holds your verification data for us. To access or delete it, email Jack@softdeposits.com and we'll have Didit act on it; you can also write to privacy@didit.me.
• Cookies. Use your browser settings as described above.

To use any of these choices, email Jack@softdeposits.com from the address we have on file. We may need to confirm your identity first. We will reply within 45 days.

If you live in California, Colorado, Connecticut, Virginia, Utah, or another state with a consumer privacy law, you may have the right to know what personal information we collect and how we use it, to get a copy, to correct it, to delete it, and to opt out of the sale or sharing of personal information or of targeted advertising. You also have the right not to be treated unfairly for using these rights.

We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of, and we do not use sensitive personal information to infer characteristics about you. Some of the information we collect, such as information covered by the Gramm-Leach-Bliley Act or used for business-to-business purposes, may be outside these laws in some states.

Sensitive personal information we collect includes government ID images and numbers, your account login, and, through Didit, biometric information used only to verify identity. We use it only to provide the service, verify identity, prevent fraud, and meet legal duties, which is why we do not offer a separate right to limit its use. California residents may also ask, once a year, whether we shared personal information with third parties for their own direct marketing; we do not.

Financial privacy. The service is for business purposes only, so the federal Gramm-Leach-Bliley Act privacy notice rules for consumers generally do not apply. We still follow its principles: we do not share nonpublic personal information with companies outside our group for their own marketing, we share it only as described in section 3, and we protect it with the safeguards described in section 6.

In the last twelve months we have collected the categories of information listed above (identifiers, contact details, commercial information, government ID and identity results, internet activity, approximate location, and documents and messages) and disclosed them for business purposes to the service providers named above. To make a request, or to appeal a decision, email Jack@softdeposits.com. You may use an authorized agent, and we may ask for proof of that authority.

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has sent us information, email us and we will delete it.

We do not use automated decision-making. Every decision to approve, change, or decline a deal is made by our team. Our website chat uses an automated assistant (provided by xAI) to answer general questions. We keep chat transcripts, and the email you choose to share, to follow up with you. Please do not share sensitive information in chat. Please do not put sensitive information, such as ID numbers or account numbers, into messages.

The service may link to other sites, including Didit, title companies, and scheduling pages. We do not control them and are not responsible for their privacy practices.

We operate in the United States and the service is meant for United States property purchases. If you use it from elsewhere, your information will be processed in the United States, where privacy laws may differ from those where you live.

We may update this policy from time to time. The effective date at the top shows when it last changed. If a change is material, we will tell you by email or through the portal before it takes effect when we can.

SoftDeposits is operated by H1 Capital LLC, 725 Fifth Avenue, 16th Floor, New York, NY 10022.

Privacy questions and requests: Jack@softdeposits.com. Deals and account help: Deals@SoftDeposits.com.