Privacy Policy

Above All CRM ("we," "us," or "our") operates the Above All Elite platform, a multi-tenant SaaS application for licensed mortgage loan officers. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. Above All CRM is operated by West Capital Lending, NMLS# 1566096, DRE# 02227951, located at 17911 Von Karman Ave Suite 400, Irvine, CA 92614.

1. Information We Collect

Account & Profile Data

When you register, we collect your name, email address, phone number, NMLS number, DRE number, company name, headshot, and professional biography. This data is stored in our Supabase PostgreSQL database with row-level security enforced per user.

Lead & Client Data

Loan officers import or create lead records that may include borrower names, phone numbers, email addresses, property addresses, estimated credit scores, loan amounts, and loan purposes. This data is owned by the loan officer and is portable.

Usage Data

We automatically collect analytics data such as page views, feature usage, quote link opens, and sequence engagement metrics. We log IP addresses, browser type, and device information for security and diagnostics.

Communication Data

When you use our messaging features, we store SMS and email content in your activity log for compliance and audit purposes. Voice drop recordings generated through ElevenLabs are stored temporarily for delivery.

2. How We Use Your Information

• Providing and maintaining the Above All Elite CRM platform
• Processing and delivering automated sequences (SMS, email, voice drops)
• Generating personalized mortgage quote pages for borrowers
• Powering AI features (Ezra AI assistant) for loan officer productivity
• Enforcing TCPA compliance including time-of-day restrictions and DNC list management
• Sending platform notifications, billing updates, and support communications
• Improving our platform through aggregated, anonymized analytics

3. Data Sharing & Third-Party Integrations

We do not sell your personal information. We share data only with the following categories of service providers, as necessary to operate the platform:

• Supabase — Cloud database hosting, authentication, and edge function execution
• Vercel — Application hosting and content delivery
• Bonzo — SMS delivery and CRM synchronization (when enabled by the loan officer)
• GoHighLevel (GHL) — CRM synchronization, SMS, and email delivery (when enabled by the loan officer)
• ElevenLabs — AI voice generation for voice drop features
• Google (Gmail API) — Email sending on behalf of loan officers who connect their Gmail accounts via OAuth

Each loan officer controls which integrations are active for their account. We do not activate integrations without explicit consent.

4. Data Security

We implement industry-standard security measures including encrypted connections (TLS/SSL), row-level security policies on all database tables, cookie-based authentication (not localStorage), and environment-variable-protected API keys. Service role credentials are restricted to server-side execution only and are never exposed to client-side code. All data is hosted within Supabase's SOC 2 Type II compliant infrastructure.

5. TCPA Compliance

Our platform enforces the Telephone Consumer Protection Act (TCPA) at the infrastructure level. All outbound SMS and voice messages are restricted to the 8:00 AM – 9:00 PM window in the lead's local time zone. Every SMS includes "Reply STOP to opt out" language. STOP keyword responses trigger immediate addition to the Do Not Contact (DNC) list and cessation of all automated sequences. These protections are enforced at the edge function level and cannot be bypassed through the user interface.

6. Data Retention

Account data is retained for the duration of your active subscription. Lead data, activity logs, and communication records are retained for compliance purposes for up to 7 years after the last activity, consistent with mortgage industry record-keeping requirements. Upon account termination, you may request a full export of your data before deletion.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Export your lead data in a portable format (CSV)
• Opt out of marketing communications
• Withdraw consent for specific integrations at any time through your dashboard settings

California residents have additional rights under the CCPA/CPRA. Contact us to exercise any of these rights.

8. Cookies & Tracking

We use essential cookies for authentication (Supabase session cookies) and functional cookies for theme preferences. We do not use third-party advertising cookies. Quote link tracking pixels may be used to notify loan officers when a borrower opens their personalized quote page.

9. Children's Privacy

Our platform is designed for licensed mortgage professionals and is not intended for individuals under 18 years of age. We do not knowingly collect information from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes via email or in-app notification. Continued use of the platform after changes constitutes acceptance.