Collateral Oversight and Risk Analytics Inc. ("CORA," "we," "us") provides a software platform that lenders use to monitor credit facilities. This policy explains how we handle personal information when you visit our website, use the CORA platform, or contact us.
1. Our Role
Our customers are lenders and other financial institutions ("Customers"). When a Customer or its borrowers upload information to the platform, we process it on the Customer's behalf under our agreement with that Customer, and the Customer decides how it is used. If you were invited to the platform by a lender, please also review that lender's privacy notice.
2. Information We Collect
Account information. Name, business email, employer, job title and role for platform users, along with authentication data. Passwords are stored only in hashed form.
Customer data. Documents and data uploaded to or connected with the platform, such as borrowing base certificates, financial statements, collateral reports and related correspondence. These may include business contact details of people at lenders and borrowers.
Usage and device data. IP address, browser type, features used, timestamps and security logs, which we use to operate, secure and troubleshoot the platform.
Communications. Information you send us by email or through forms on our website, including job applications.
We do not intentionally collect sensitive personal information such as Social Security numbers, health information or government ID numbers. If an uploaded document contains such information, it is protected under the same controls as all Customer data.
3. How We Use Information
We use information to provide, maintain and secure the platform; to analyze Customer data at the Customer's direction, including with AI (section 4); to provide support; to send service and security notices; to meet legal, regulatory, audit and contractual obligations; and to improve the platform using aggregated or de-identified information.
We do not sell personal information, and we do not use Customer data for advertising.
4. Artificial Intelligence
CORA uses AI to help analyze Customer data and assist platform users. Customer data processed this way is not used to train the underlying AI models: our AI provider's commercial terms prohibit it from training its models on the data we send it, and CORA trains no models of its own. AI output supports the Customer's own judgment; decisions such as signing, approving or funding are made by people.
5. How We Share Information
We share information only with service providers that help us run the platform and website (section 6); with our auditors, lawyers, accountants and other professional advisors in the course of the services they render to us; with the Customer that controls the account and its authorized users; when required by law or legal process, or to protect the rights, property or safety of CORA, our Customers or others; and in connection with a merger, acquisition or sale of assets, subject to this policy.
6. Service Providers
We use a limited number of service providers, each bound by written agreements requiring confidentiality and appropriate security. They provide cloud infrastructure located in the United States, AI model processing, website hosting and delivery, email and productivity tools, and source code hosting. We may add or change providers from time to time. Customers may request the current list of named providers under their agreement, and any commitments about notice of provider changes are those set out in that agreement.
7. Security
We protect information with administrative, technical and physical safeguards, including encryption, multi-factor authentication, access controls and monitoring. No system is perfectly secure; if we learn of a security incident affecting your information, we will notify affected Customers as required by law and our agreements. To report a security issue, email security@coraabl.com.
8. Data Retention
We keep Customer data for the term of the Customer's agreement, then delete or return it within 90 days after termination unless the agreement says otherwise. Some records, such as audit logs, are kept longer where law or legitimate business needs require. Backups expire on their normal schedule.
9. Your Choices and Rights
Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, or to object to certain processing. If your information is in the platform because of a lender, please direct your request to that lender and we will help them respond. For other requests, email info@coraabl.com. We will verify your request, respond within the time required by law, and not discriminate against you for exercising these rights.
10. Cookies and Similar Technologies
We use only the cookies needed to operate our website and platform, such as keeping you signed in. We do not use advertising cookies. Because we do not track users across third-party websites, we do not respond differently to browser Do Not Track signals.
11. Children
Our services are for business use and are not directed to children under 16. We do not knowingly collect their information.
12. International Transfers
We store and process information in the United States. If you access our services from outside the U.S., your information will be transferred to the U.S.
13. Changes to This Policy
We may update this policy and will post the new version here with a new effective date. We will notify Customers in advance of material changes.
14. Contact
Collateral Oversight and Risk Analytics Inc.
info@coraabl.com