Privacy Policy.

Who we are

Passy Capital LLC is a Florida limited liability company (filing N° L26000208363), at 7901 4th St N, Ste 300, St. Petersburg, FL 33702. We are a commercial real estate financing brokerage, not a lender, and we arrange business-purpose loans only.

For anything on this page, including a request to see or delete your data, write to contact@passycapital.com. A real person reads it.

What we collect, and when

When you submit a deal. Your name, email address and phone number, and the details of the transaction: loan type and amount, property location and type, purchase price or budget, timeline, and anything you write in the description. If you attach documents, we receive those documents and whatever is in them. We also ask how you found us, and that answer is required: it is the only way we can tell what is working for visitors whose browser tells us nothing.

When you submit a deal as a broker. The above, plus your name, firm, email, phone and NMLS number, and a record that you accepted the non-disclosure and no-solicit terms. That acceptance is logged with the time, your IP address and your browser identification, because it is the evidence the agreement was entered into.

When you message us on WhatsApp. Your phone number, the name on your WhatsApp profile, and the content of your message. On a first message we reply asking how you came across us. Answering is entirely up to you.

When you use a calculator. Nothing. The loan calculators run entirely in your browser and the figures you type are never sent to us. Typing a property address into an address field is different: those keystrokes go to Google to return suggestions.

Automatically, on any visit. Your IP address, which we use to rate-limit submissions and uploads against abuse, and the measurement described in the next section.

Cookies, analytics and how we know where you came from

Five things store or read something in your browser. Two are measurement, one is our own attribution cookie, one records your answer to the consent question, and one is only ever set for our own staff. We used to run session recording as well, and removed it in August 2026 because we were not using what it collected.

• pc_attr (ours). A first-party cookie, kept for 90 days, recording how you arrived: the referring site, the page you landed on, and any campaign tags on the link. It is how we can tell that an enquiry came from a search engine, an AI assistant, an ad or a direct visit. It holds no name, email or phone number, and it is never sent to anyone else.
• Google Analytics 4. Aggregate audience and behaviour measurement, run by Google.
• Google Ads conversion tracking. Tells us which advertising produced an enquiry. When a deal we sourced from an ad closes, we send Google the click identifier and the fact it converted. We do not send your name, email or phone number with it.
• Admin session cookie. Only ever set for our own staff signing in to the internal dashboard. It is not set for visitors.
• pc_consent (ours). Records whether you accepted or declined, so we stop asking. Set only where we ask, kept for six months, and the one cookie here that exists because you were given a choice.

If you are in the European Economic Area or the United Kingdom, we ask before any of this loads. Until you answer, nothing non-essential is stored and the advertising and analytics tags are held in a denied state. Declining costs you nothing: the site behaves exactly the same, and we do not ask again for six months. You can change your answer at any time through the Cookie preferences link in the footer, and if you decline after previously accepting, the attribution cookie is deleted from your browser there and then.

Elsewhere, including the United States, these load from your first page view without a prompt, which is the norm and what local law allows. You can still stop them: block them in your browser settings, install the Google Analytics opt-out add-on, or use any tracker blocker, and the site will work exactly as it does now. If you would rather we simply erased what was collected about your visit, email us and we will.

Who we share it with

Lenders. This is the main one, and it is the point of the service. We are a brokerage: to place your loan we send your transaction, and the documents supporting it, to lenders and capital partners we believe can fund it. We do that to arrange the financing you asked us to arrange. If you would rather we approached a particular lender or avoided one, tell us.

Beyond that, we use ordinary service providers, each of which sees only what it needs:

• Supabase. The database holding deals and enquiries. Hosted in Paris, France.
• Vercel. Website hosting and the storage holding uploaded documents. United States.
• Resend. Sends our confirmation and alert emails.
• Upstash. Rate limiting, to stop automated abuse of the forms.
• Google. Analytics, advertising measurement, and the address autocomplete on property fields.
• Anthropic. When we run an uploaded deal document through an AI model to pull out its terms, that document is sent to Anthropic for processing. This happens only when we do it deliberately from our internal tools, never automatically on submission.
• Notion. Our internal deal tracker receives a summary of each new enquiry: the reference number, amount, asset and location, and the broker where there is one. Borrower email addresses and phone numbers are deliberately kept out of it.
• Meta. If you contact us on WhatsApp, that conversation runs on Meta’s platform under Meta’s terms.

We do not sell your information, and we do not share it for anyone else’s advertising.

Where it goes

We are a US business and our systems span the United States and the European Union: the database sits in France, the website and document storage in the United States. If you contact us from outside the United States, submitting a deal means your information is transferred to the United States, and to whichever lenders we approach on your behalf, which may themselves be elsewhere.

How long we keep it

Deal records and their documents are kept for as long as we may need them: to work the transaction, to answer questions about a deal we placed, and to meet the record-keeping expected of a brokerage. We have no fixed deletion schedule, which is the honest answer rather than a comfortable one. Uploaded files that are never attached to a submitted deal are discarded automatically after 24 hours. Ask us to delete your record and we will, unless we are required to keep it.

Your rights

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. One email to contact@passycapital.com is enough, and we will answer within 30 days.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you those rights plus the right to object to processing, to restrict it, to receive your data in a portable form, and to complain to your national data protection authority. Where we process your information to arrange your financing, we do it to perform the engagement you asked for. Where we measure the site, we do it in our legitimate interest in understanding how it is used, and you can object at any time. If you are in Switzerland, the revised Federal Act on Data Protection gives you equivalent rights. If you are in California, you may request disclosure or deletion, and we will not treat you differently for asking.

Security

Traffic to this site is encrypted. The internal dashboard is reachable only through a single-use sign-in link sent to one address, and access to enquiries is limited to the people who work on them. Uploaded documents are stored under unguessable addresses, are not listed anywhere, and are served to our team through the authenticated dashboard. No system is perfect, and we would rather say so than imply otherwise.

Children

This site is aimed at property investors and finance professionals. It is not directed at anyone under 18, and we do not knowingly collect information from them.

Changes

If this policy changes, the date at the top changes with it. The current version is always the one on this page.