Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

Identifiers and Contact Information

• Full legal name, email address, and phone number.
• Government-issued identification numbers, including Social Security Number (SSN), used solely for identity verification and loan underwriting purposes.

Financial and Credit Information

• Credit reports and credit scores obtained through iSoftPull via Equifax, TransUnion, and Experian, accessed only after written consumer authorization.
• Bank account information, transaction history, and cash flow data obtained through Plaid, accessed only after written consumer authorization.
• Loan application data including property information, investment strategy, and requested loan amount.

Usage and Technical Information

• IP address, browser type, device identifiers, and interaction data collected automatically when you use the Platform.
• Authentication data associated with your Antal account.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To evaluate your eligibility for real estate investment financing, including fix-and-flip loan products.
• To prepare and submit lender-ready loan files to third-party lending partners on your behalf.
• To verify your identity and satisfy Know Your Customer (KYC) and anti-fraud obligations.
• To communicate with you regarding your loan application, account status, and Platform updates.
• To comply with applicable federal and state laws, including the Fair Credit Reporting Act (FCRA).
• To improve the Platform and develop new features and services.

We do not use your personal information for marketing or advertising by third parties, and we do not sell your personal information to any third party.

3. Consumer Reporting and FCRA Rights

Antal obtains consumer reports from Plaid, iSoftPull, and the national credit bureaus (Equifax, TransUnion, and Experian) solely for permissible purposes under Section 604 of the Fair Credit Reporting Act, including credit transaction evaluation and legitimate business need in connection with a consumer-initiated financing request. Consumer reports are accessed only after you provide written authorization.

You have the following rights under the FCRA:

• The right to know if information from a consumer report was used in a decision that adversely affects you.
• The right to obtain a free copy of your consumer report from the reporting agency within 60 days of an adverse action.
• The right to dispute incomplete or inaccurate information directly with the consumer reporting agency.

4. How We Share Your Personal Information

We may share your personal information with the parties described below and as otherwise stated in this Privacy Policy or at the time we collect it.

Affiliates

We may share personal information with our corporate parent, subsidiaries, and affiliates for purposes consistent with this Privacy Policy.

Service providers

We share information with vendors and service providers that perform services on our behalf or help us operate the Platform and our business—such as hosting, information technology, customer support, email and text message delivery, analytics, identity verification, credit or bank-data connectivity, document processing, and tools that support in-platform chat or application assistance. We enter into contracts with service providers that require them to handle your personal information only in a manner consistent with this Privacy Policy and applicable law.

Financial institutions and Plaid

We use Plaid Inc. ("Plaid") to connect your financial institution accounts and to obtain account, balance, and transaction-related information when you choose to link a financial institution through the Platform (for example, for asset verification, cash-flow analysis, or other loan underwriting steps you authorize). By using this feature, you grant Antal the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution, in accordance with Plaid's services and the credentials you provide. You understand and agree that your personal and financial information may be transferred to, stored, and processed by Plaid as described in Plaid's consumer disclosures and policies (available at plaid.com/legal).

Separately, we may share information with other financial institutions, payment processors, or banking partners as needed to originate, service, or fund a loan you request, always subject to your authorizations and applicable law.

Lending partners and consumer reporting

We share information with third-party lending partners to evaluate and fund your loan application. Lenders receive only what is reasonably necessary and are subject to applicable FCRA and data protection obligations. We also share information with consumer reporting agencies and similar providers—such as iSoftPull and the national credit bureaus (Equifax, TransUnion, and Experian)—when you have provided written authorization, as described in Section 3.

Legal requirements and business transfers

We may disclose information when required by applicable law, court order, or governmental request, or to protect our rights, users, or the public. We may also share information in connection with a merger, acquisition, financing, or sale of all or substantially all of our assets, provided the successor is bound by appropriate confidentiality and privacy commitments.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

5. Data Security

Antal implements administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• AES-256 encryption of consumer data at rest, hosted on Supabase infrastructure backed by AWS.
• TLS 1.2 or higher encryption for all data transmitted between your device and our servers.
• Multi-factor authentication (MFA) required for all Antal personnel accessing systems that store consumer data.
• Role-based access controls limiting data access to personnel with a documented need.
• Periodic access reviews and vulnerability assessments of production infrastructure.

No security system is impenetrable. In the event of a data breach affecting your personal information, we will notify you and applicable regulators as required by law.

6. Data Retention and Deletion

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, complete your loan transaction, and comply with applicable legal and regulatory retention requirements. Consumer report data is retained only for the duration of your active financing transaction and any legally required retention period thereafter, after which it is securely deleted.

You may request deletion of your personal information by contacting us at privacy@antalcapital.com. We will honor deletion requests to the extent permitted by applicable law and our regulatory obligations.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• The right to access and receive a copy of the personal information we hold about you.
• The right to correct inaccurate or incomplete personal information.
• The right to request deletion of your personal information, subject to applicable legal limitations.
• The right to opt out of certain data processing activities.
• The right to lodge a complaint with a relevant data protection authority.

To exercise any of these rights, please contact us at privacy@antalcapital.com. We will respond to verified requests within the timeframe required by applicable law.

8. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@antalcapital.com and we will take steps to delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy at antalcapital.com/privacy with a revised effective date. Your continued use of the Platform following any update constitutes acceptance of the revised policy. For material changes, we will provide additional notice as required by law.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact:

Antal Capital, Inc.
Privacy Inquiries: contact@antalcapital.com
Website: antalcapital.com