Privacy Policy.

1. What we collect

Calculator inputs are used to produce the displayed scenario. If you submit a deal-review request, the site collects the deal parameters and contact details you choose to send. The public form is not designed for Social Security numbers, bank-account details, identity documents, or other sensitive records.

A deal-review request stores these fields, each for the purpose shown. Contact details — your name, email address and, if you give one, a phone number — so a reviewer can reply. Deal parameters — property type, property value, loan amount, monthly rent, interest rate, loan purpose (including a second lien on an existing mortgage, which also stores that mortgage's monthly payment and, if you give it, its remaining balance), the property's state and your timeline, and, only if you give them, the property's annual taxes and insurance, its monthly HOA and flood-insurance payments, the appraiser's market-rent estimate, and — for a larger or multi-property scenario — the number of units or properties involved — so the reviewer can look at the scenario you asked about. Borrower profile — your credit-score band (a range you choose, not a credit report), whether you would borrow as an individual or an entity, your US or non-US residency if you give it, your investing experience, and, if you pick one, your role (investor, broker, foreign national, short-term rental or vacation home) — so the reviewer can judge which program paths might fit. Notes — anything you choose to add in the optional notes field, with control characters stripped before it is stored — so a question or detail you want on record travels with the scenario. Confirmations — that the property is an investment property and that you agree to be contacted, with the time of that consent and the version of the consent wording — so there is a record of the basis for contacting you. Record-keeping — the time of the request, the page you sent it from and a random submission ID — so a retried submission does not create a second record.

A loan application submitted at /apply stores these fields, each for the purpose shown. Contact details — your full name, email address and phone number — so we can reach you about it. The loan request — whether it is a purchase, a rate-and-term refinance or a cash-out refinance, the property type, the property's state, its street address, city and ZIP code (or that you have no address yet), the purchase price or your estimate of its value, the loan amount you want and your timeline — so the application describes the loan you are asking about. The property and its income — the number of units for a multi-unit property, whether it is leased, vacant or a short-term rental, its monthly lease rent or rental income, a market-rent estimate if you give one, its annual property taxes and insurance, its monthly HOA dues if you give them and, for a refinance, your current mortgage balance — so a lender can see whether the property carries the loan. The borrower — your date of birth if you choose to provide it, for identification alongside your application, whether you borrow as an individual, an LLC, a corporation or a trust, an entity's legal name and the state it was formed in if you borrow through one, your citizenship status (US citizen, permanent resident or foreign national), your credit-score range (a range you choose, not a credit report), how many investment properties you own and how many you bought or sold in the last 36 months, and your liquid-reserves range — so a lender can judge which program paths might fit. Confirmations — that the loan is for a business purpose on an investment property you will not live in, and that Greenstreet may contact you by email or phone about the application and share it with lending partners, with the time you gave them and the version of the consent wording — so there is a record of the basis for contacting you and sharing it. Record-keeping — the time of the submission, the page you sent it from, the page that carried you there if one did (for example a calculator), a random submission ID, and a status the site's owner sets as the application is worked. The application form does not ask for, and this site does not collect, a Social Security number, a bank or account number, a government ID or any document, and submitting an application does not pull your credit. Date of birth stays out of saved browser drafts, tool links, routine email and webhook notifications, and CSV exports; it is available in the protected application record.

If you choose to fill in the optional "speed up your review" section, the request also stores what you enter there: the property's street address, city and ZIP code, so the property itself can be looked up; where the deal stands; the range of cash you have available for it; the name and state of the entity you would borrow through; how many properties you currently finance; whether you have had a bankruptcy, foreclosure or short sale and roughly when; and your occupation and employer, which are context for programs other than DSCR and are not used in any score. The request also records how this visit used the site: the names of the tools you used and how many times you read a result, how many pages you viewed, how long the visit lasted, whether this browser had visited before, how many scenarios you saved, and the site and campaign that referred you. It does not record your location or a device fingerprint, and the request itself does not carry the figures you typed into a tool: those stay in your browser unless you send them in a form. Separately, only if you submit a loan application, the application also carries a log kept in your own browser of the pages and tools you used on this site: at most the latest 300 entries from the last 180 days, covering the pages you viewed, each tool whose result you read together with the deal figures the tools were holding at that moment, the topic of each guide you read, the figures (never the name you gave them) of each deal you saved, the fact and the minute that a deal-review or guide form was sent (no contact details), and how each visit arrived (campaign tags and the referring site; an ad click is noted only as having happened, never its identifier). That log is sent once, right after the application is accepted, and is stored with the application, carrying the application's own 24-month deletion date and removed with the application if you ask us to delete it (section 5), so that the person reviewing it can see what you looked at; it is shown only to Greenstreet staff, is not used in any score or grade, and is never shown to you or to a lender. Nothing is sent, and nothing is kept for you, if you never apply. It is not recorded at all if your browser sends Global Privacy Control or Do Not Track or is driven by automation. From these answers the site computes a preliminary reviewer's note for Greenstreet staff — a fit estimate against published program guidelines and a priority for follow-up — which is not a credit decision, is not shown to you, and pulls no credit report.

After you send a deal-review request, its confirmation may ask up to three optional multiple-choice questions, such as the range of cash you have available or how many properties you finance; your answers are stored with your request, are used to prepare for the call and to update the preliminary reviewer's note on it, and are deleted with the request.

For a loan application, the site computes the same preliminary reviewer's note as for a deal-review request, from the answers on the application alone: it is not a credit decision, is not shown to you, and pulls no credit report.

A guide request from the homepage form stores your first name, last name, email address and the guide you asked for, with the time of the request, so the request is on record.

Where a visit came from. When you arrive on the site, your browser notes, without sending anything anywhere, the campaign tags in the address you followed (utm_source, utm_medium, utm_campaign, utm_term and utm_content), one ad click identifier if the address carries one (the identifier an advertising platform such as Google, Meta, Microsoft, LinkedIn, TikTok or X adds to the links of its ads), the page you landed on (its path only, never anything typed into a tool) and the host name of the outside website that sent you. The visit that first brought your browser here stays in your browser for 90 days, and the latest visit in a tab for as long as the tab is open. They are recorded only when you send a deal-review request, a loan application or a guide request, and are stored with it, so that Greenstreet can see which campaign or site a request came from. If your browser sends Global Privacy Control or Do Not Track, no ad click identifier is kept (the campaign tags and the referring site still are); if the browser is driven by automation, nothing is kept. Nothing is sent to an advertising platform.

If the site's shared rate limiting is switched on, a keyed hash of your IP address and a request counter are stored to limit abusive traffic; the IP address itself is not stored.

Visit counts. To see which pages and tools are used, the site keeps its own totals in its own database, not with an analytics company. When you view a page, start a tool, read a tool's result or open the deal-review form, your browser sends the site four things and nothing else: which of those happened, the page's path (without any query string or fragment, so never a figure you typed into a calculator), the tool's name if one was used, and, for the first page of a visit, the host name of the website that sent you there (never this site). Each is added to that day's total for the whole site. The site reads your browser's description in memory only, to sort the visit as mobile or desktop and to skip automated crawlers; it is never stored. The daily totals hold no cookie, no IP address, no identifier, no record of any one visit, and no time finer than the day. The count of deal-review requests is added by the site's server when it accepts one, not by your browser. If your browser sends Global Privacy Control or Do Not Track, it sends none of this. The site operator can switch these counts off. (Requests to this route are rate-limited like every other route of the site. When shared rate limiting is on, a keyed hash of your IP address, not the address itself, is stored with a request counter for that purpose, as described above; the counter covers a window of about a minute. It is not part of the totals.)

Application counts. If you start a loan application, your browser also tells the site that an application was started, on the same terms as the counts above: the event and the page's path (/apply, never a query string), added to that day's total, and nothing about you; none of it is sent if your browser sends Global Privacy Control or Do Not Track. The count of submitted applications is added by the site's server when it accepts one, not by your browser.

2. How we use it

Calculator inputs support the educational result shown in the browser. A submitted deal-review request is stored so an authorized reviewer at Greenstreet can respond to it. The request itself is not a loan application, a credit decision, or a rate request, and submitting it does not authorize a credit pull. If you decide to proceed after that review, a separate application follows.

The visit counts are used only to see, in total, which pages and tools are used and where visitors come from. They cannot be tied to a person.

A loan application is stored so an authorized reviewer at Greenstreet can read it, contact you about it by email or phone, and, with your agreement, share it with lending partners to look for a loan program that fits. Submitting it is not an approval, a rate lock or a commitment to lend by Greenstreet or by any lender, and it does not authorize a credit pull: if a lender wants to check your credit, it asks for your authorization first. Applications are deleted automatically 24 months after submission; to have an application removed sooner, use the request process in section 5.

3. Sharing

A deal-review request is stored by configured infrastructure so it can be reviewed and answered. This policy does not identify or verify every downstream recipient or contractual control. Do not submit Social Security numbers, bank-account numbers, or other sensitive identity documents through the public form.

A loan application may be shared, as you agree on the form, with lending partners, so they can look for a loan program and make the credit decision. Greenstreet Finance is a broker, not a lender, and this policy does not name those partners or verify their contractual controls. Do not submit Social Security numbers, bank-account numbers, or other sensitive identity documents through the application: it has no place for them.

The processors that hold submissions: deal-review requests, loan applications, guide requests, the daily visit totals described above and, when shared rate limiting is on, the rate-limit counters are stored in Google Cloud Firestore, through Firebase. If the site operator has configured one, a copy of each deal-review request and each loan application is also sent over HTTPS to the operator's lead-delivery webhook.

Notification email: the site sends the operator an email through Resend, an email delivery service, carrying a summary of each deal-review request and each loan application you submit, contact details included, and Resend processes that email only to deliver it to the operator.

If the site operator switches on property and contact checks, parts of a deal-review request are sent to outside services to verify them, and only those parts: the property address to the U.S. Census Bureau's geocoder and to FEMA's flood-map service (public government services), and, if the operator subscribes, to a property-data provider for an estimated value, rent estimate and public-record details of that property; your email address to an email-verification service, to learn whether it accepts mail; your phone number to a phone-lookup service, to learn the line type; the entity's name to a business-registry service, to learn whether it is registered and in good standing; and, only if the operator switches it on, the optional note you may write to a language-understanding service, with email addresses, links, phone numbers and long numbers removed first, so that it can notice things such as a question you ask or the kind of loan you describe (the operator's own follow-up notes on a request, such as how it ended, are read the same way), and, when the business registry returns several similar names, the entity's name and state with those registry results, so that it can pick the one that is the entity. These checks verify the property, whether you can be reached and what your note says; they are not a credit report and are not used to decide whether you are offered a loan.

Analytics, only if the site operator switches it on: Plausible Analytics then receives the address of each page you view (the site removes the deal figures a tool keeps in the address before sending it), the site that referred you, your browser, operating system and device type, an approximate location derived from your IP address, and the names of a few site events: a tool started or a tool result shown (each with the tool's name), the review form opened, and a review request the site accepted. It receives no form contents, contact details or deal figures. Plausible's published data policy says it sets no cookies, writes nothing to your browser's storage, stores no raw IP addresses, and does not track visitors across websites.

Error reports, only if the site operator switches them on: when a page hits an error, the site sends a report to Sentry, an error-monitoring service, through this site's own server. A report holds the error's type, message and stack trace, the page address, your browser and operating system, and a short trail of the pages you moved between and the buttons and links you clicked just before the error, and, for a sample of visits, how long pages and requests took. It carries no values you typed into a form and no cookies, and this site's server does not pass your IP address on to Sentry.

Bot check, only if the site operator switches it on: the deal-review form, the loan application and the guide request can use Cloudflare Turnstile, a service of Cloudflare, Inc., to tell a person from an automated program. When it is on, opening one of those forms loads a script and a small frame from challenges.cloudflare.com, and Cloudflare receives your IP address and details of your browser and how it behaves on the page, as its own service decides it needs. When you send the form, this site's server passes the one-time result code Cloudflare gave your browser back to Cloudflare, with your IP address, to check it. The result code is not stored. What is stored with your request is only the outcome: passed, not checked (for example, when Cloudflare could not be reached), or held for a person to review. A request that does not pass is kept, but it is not sent on to staff or checked against outside sources until the site's owner releases it. Cloudflare's own privacy policy governs what it keeps. When the bot check is off, none of this happens and no Cloudflare script is loaded.

We may add to what you send us with information from public sources, such as business registries, property records and public websites, to prepare for our conversation with you.

We may check the business name, property address and other details you give us against public records, such as business registries, court and licensing records, and property and sanctions lists, to prepare for our conversation with you and to meet our legal obligations. Some of these checks are made by sending the name or address to the public body that publishes the record.

4. Cookies

The released site uses browser storage only where required for basic application functionality. It uses no de-anonymization tracking. The site's own visit counts (see What we collect above) set no cookies and write nothing to your browser's storage. Plausible Analytics runs only if the site operator switches it on, and then sets no cookies (see Sharing above). You can clear browser storage through your browser settings; some signed-in features may then require authentication again.

The keys it writes, all in your own browser: gs_deal_v1 (local storage) holds the deal inputs you entered, so the calculator and the other tools work from one scenario; gs_scenarios_v1 (local storage) holds up to 10 calculator deals you chose to save, each under the name you gave it; gs.refiTracker.inputs.v1 (local storage) holds the Refi Tracker's inputs; gs.portfolio.rows.v1 and gs.portfolio.reserves.v1 (local storage) hold the properties and reserves you entered on the Portfolio page; gs:arm-prefill (session storage, this tab only) carries a scenario from the calculator to the ARM reset tool and is deleted once read; gs:chunk-reloaded (session storage, this tab only) is a technical flag that stops a reload loop after a site update; gs:session-signals (session storage, this tab only) holds the counts and tool names described under What we collect, which the deal-review form attaches only to a request you choose to send; gs_first_seen_v1 (local storage) holds the time this browser first visited, so that a request you send can say it was a return visit; gs_first_touch_v1 (local storage) holds, for up to 90 days, the campaign tags, ad click identifier, landing page and referring site of the visit that first brought this browser here, and gs:last-touch (session storage, this tab only) holds the same for the latest visit in this tab, both described under What we collect and attached only to a request you choose to send; gs_activity_v1 (local storage) holds, for up to 180 days, the activity log described under What we collect (pages viewed, tool results with the deal figures, guide topics, saved-deal figures and how each visit arrived), which is sent only if you submit a loan application. If you sign in to the workspace, Firebase Authentication also keeps your sign-in session in the browser.

The loan application keeps one more key in your own browser: gs_apply_draft_v1 (session storage, this tab only) holds the answers you have entered so far and which step you are on, so a reload or a trip to another page and back does not lose them. It never holds your two confirmations. It is deleted when you submit, when you press Clear my answers, or when you close the tab. A link from a calculator to the application can carry the deal's figures (price, down payment, rent and the like) in the address; the application reads them once and removes them from the address bar.

5. Your rights

To ask what information you submitted through this site, to correct it, or to have it deleted, email privacy@greenstreet.finance. Describe the request and the scenario submission it concerns; we may ask you to confirm the request came from you before acting on it.

We keep scenario-review requests and loan applications for 24 months from the date you submit them, then delete them automatically. You can ask us to delete yours sooner.

One thing is not yet published and you should not assume it: a committed response time for a privacy request. Until it is published, do not submit Social Security numbers, bank-account numbers, or identity documents through the public form.

6. Contact

Privacy questions and privacy requests: privacy@greenstreet.finance.

This policy does not yet publish a postal address for written privacy requests or a response-time commitment. Those are outstanding and will be added here when confirmed.