HomePrivacy
Privacy Policy
Version 1.0. Effective August 19, 2026. Last updated August 19, 2026.
MMCG Invest, LLC, 27 Maiden Ln, Suite 625, San Francisco, CA 94108. This Policy covers mmcganalytics.com and app.mmcganalytics.com.
What this covers
This Privacy Policy describes how MMCG Invest, LLC, 27 Maiden Ln, Suite 625, San Francisco, CA 94108 ("MMCG," "we," "us"), handles personal information in connection with mmcganalytics.com and app.mmcganalytics.com (the "Services"). It covers two distinct populations, and it is organized accordingly:
- Part A covers visitors to our websites and holders of Services accounts: information you give us and information collected when you use the Services.
- Part B covers individuals who appear in the public-record datasets we analyze and display, such as owners named in county property records. These individuals typically have no relationship with MMCG. Part B explains where that information comes from, what we do and do not do with it, and how to request removal.
Where clients upload documents to a secured client vault, MMCG processes those documents as a service provider under the applicable engagement agreement; Section B4 describes that role. This Policy does not cover mmcginvest.com, which carries its own notices, or MMCG's professional consulting engagements, which are governed by their engagement agreements.
Part A: Visitors and Account Holders
A1. Information We Collect
You provide: name, business email address, employer or organization, role or title, account credentials and multi-factor authentication enrollment, content of support requests and correspondence, and content you upload to the Services.
Collected automatically: IP address, device and browser characteristics, pages viewed and features used, timestamps, referring pages, and session and security audit logs. We derive coarse location (such as city or region) from IP address to secure and operate the Services.
From service providers: subscription and payment records from our payment processor. MMCG does not receive or store full payment card numbers.
Sensitive personal information is limited to account log-in credentials and authentication data, which we use solely to authenticate you and secure the Services.
A2. Purposes
We use Part A information to provide, operate, and secure the Services; to create and administer accounts; to process subscriptions and payments; to respond to inquiries and provide support; to monitor performance and improve the Services; to enforce our Terms of Use; and to comply with law. We do not use it for advertising, and we do not build profiles about you for eligibility or marketing purposes.
A3. Disclosures
We disclose Part A information only to:
- Service providers operating under contracts that restrict their use of the information to providing services to us: database, authentication, and storage infrastructure (Supabase); content delivery, edge compute, and object storage (Cloudflare); web hosting (Netlify); payment processing (Stripe); transactional email (Resend); address geocoding (Esri); and AI processing (Anthropic). Under our commercial terms, our AI provider does not train its models on content we submit.
- Professional advisers such as lawyers, accountants, and insurers, under confidentiality obligations.
- Authorities or other parties where required by law, to protect rights, safety, or the integrity of the Services, or in connection with a merger, acquisition, or sale of assets, in which case this Policy continues to apply to the transferred information.
A4. No Sale or Sharing; Preference Signals
We do not sell personal information, and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We also do not disclose personal information to third parties for their own direct marketing. Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control do not currently change how we process it; if our practices ever change, we will honor such signals as required by law and update this Policy first.
A5. Cookies
We use only cookies and similar technologies that are strictly necessary to operate the Services: authentication, session integrity, security, and load distribution. We do not set advertising cookies or third-party analytics cookies. Because only strictly necessary cookies are used, no cookie consent banner is presented. If this posture changes, this Policy and the Services will be updated before the change takes effect.
A6. Retention
Account information is retained for the life of the account and for a reasonable period thereafter to resolve disputes and meet legal obligations. Billing records are retained as required by tax and accounting law. Security and audit logs and support correspondence are retained for up to 24 months unless a longer period is required by law or a live dispute. Records of privacy requests are retained for at least 24 months as required by California regulation.
A7. Security
We maintain administrative, technical, and physical safeguards appropriate to the nature of the information, including encryption in transit and at rest, role-based access controls enforced at the database tier, multi-factor authentication, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security.
Part B: Public Records and Third-Party Data Notice
B1. What This Data Is and Where It Comes From
The Services analyze and display records compiled from government sources, including:
- County and state property records: parcel boundaries and attributes and, in limited jurisdictions, the owner name and mailing address exactly as recorded by the county assessor or its state aggregator.
- U.S. Small Business Administration loan records released under the Freedom of Information Act, including borrower business names, addresses, and loan characteristics.
- U.S. Securities and Exchange Commission filings, including asset-level data for securitized commercial mortgages.
- Federal geospatial and statistical data from the U.S. Census Bureau, the U.S. Geological Survey, and the U.S. Department of Agriculture.
These records are created and maintained by the issuing government offices. The Services display a copy as of a stated effective date, with the source and date identified alongside the data.
B2. What We Do and Do Not Do With It
We display these records to business subscribers for commercial real estate and credit market analysis. We do not enrich individual records with contact appending, skip tracing, or inferences about individuals; we do not compile or sell lists of individuals; we do not permit use of the Services for locating or profiling individuals or for any purpose covered by the Fair Credit Reporting Act, and our Terms of Use prohibit such use; and we do not use these records for advertising. Where display of owner names is enabled at all, it is restricted by jurisdiction and by role, and suppression controls are enforced on the server.
B3. Removal Requests
MMCG Invest, LLC publishes property records obtained from county and state government sources. If you are a federal judge, a North Carolina judicial officer, or another person protected by a statute restricting publication of your home address, or if you wish to exercise a privacy right under applicable state law, write to privacy@mmcginvest.com. Include the property address or parcel number, the name as it appears in the record, the basis for the request, and a return email address. Please do not send government identification numbers, financial account numbers, or other sensitive identifiers; we do not need them and will not retain them.
Requests covered by the Daniel Anderl Judicial Security and Privacy Act or North Carolina's judicial privacy statute are processed within 72 hours of receipt. All other requests are acknowledged within 10 business days and answered within 45 days.
Suppression applies to display within our Services. The underlying government record remains with, and is controlled by, the issuing office; removing it from the Services does not alter the public record, and we encourage covered persons to pursue redaction with the issuing office as well.
B4. Client Vault Documents
When a client uploads documents to a secured client vault, those documents may contain personal information about third parties, such as borrowers, guarantors, principals, or employees. MMCG processes vault content solely as a service provider under the client's instructions and the applicable engagement agreement. Access is restricted to the client's authorized users and to MMCG personnel who need it to perform the engagement; content is encrypted in transit and at rest; and content is retained for the duration of the engagement and thereafter as the engagement agreement provides, and is deleted or returned upon the client's written request following the close of the engagement. Individuals whose information appears in vault documents should direct requests to the client that uploaded them; we will assist that client in responding as the engagement requires.
Your Privacy Rights
California Residents
If you are a California resident, the California Consumer Privacy Act gives you the right to know the categories and specific pieces of personal information we collect, use, and disclose; to access it in a portable format; to correct inaccurate information; to delete it, subject to legal exceptions; and to be free from discrimination for exercising these rights. Because we do not sell or share personal information, there is no sale or sharing to opt out of, and we offer no financial incentives in exchange for personal information.
For the categories enumerated by the CCPA: in the preceding twelve months we have collected identifiers, professional information, commercial information, internet and network activity, coarse geolocation derived from IP address, and sensitive personal information limited to account log-in and authentication data, from the sources and for the purposes described in Part A, and, for the public-records population, the categories described in Part B from government sources. We disclose these categories to the service providers listed in Section A3 for business purposes only.
To exercise your rights, email privacy@mmcginvest.com from the email address associated with your account, or identify the record at issue as described in Section B3. We verify requests by matching the information you provide against our records, and we may request additional information where necessary to verify identity; we use that information only for verification. You may use an authorized agent by providing the agent's written authorization signed by you; we may still verify your identity directly. We acknowledge requests within 10 business days and respond within 45 days, extendable once by a further 45 days with notice. If we deny a request, we will explain why, and you may appeal by replying to our response.
Other U.S. States
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Texas, and Oregon, may have similar rights of access, correction, deletion, and portability to the extent those laws apply to our processing. Submit requests through the same channel; we honor them as those laws require and will explain the outcome either way.
Children
The Services are professional tools directed to business users. They are not directed to anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided personal information to us, contact us and we will delete it.
Processing in the United States
The Services are operated from the United States and directed to United States users. Information we hold is processed and stored in the United States, where privacy laws may differ from those of your jurisdiction.
Changes to This Policy
We may update this Policy. We will post the updated version with a new date, and for material changes we will notify registered account holders by email or in-product notice before the changes take effect.
The other document
These two are read together.
The Terms of Use govern access to the Services and set out what you may and may not do with them. This Policy describes how personal information is handled. Section 12 of the Terms sends handling of personal information in uploaded content here, and Section 21 makes the two documents one agreement.
Every source and its licence →
Questions about this document: info@mmcginvest.com.