Legal

Privacy Policy

Effective Date: May 2026 · Verdad Holdings Group

1. Introduction

Verdad Holdings Group ("VERDAD," "we," "our," or "us") operates the website located at vhfc.io and the application platform located at app.vhfc.io (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect information you provide when using our Platform or engaging with our services.

By using the Platform, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Information you provide directly:

  • Contact information: name, email address, phone number
  • Company and business information: legal entity name, industry, years in operation, business description
  • Financial information: revenue, EBITDA, existing debt obligations, net worth, liquidity, loan amounts requested
  • Transaction details: use of funds, collateral type, project size, equity contribution
  • Supporting documents you upload through the application

Information collected automatically:

  • Browser type, operating system, and device type
  • IP address and approximate geographic location
  • Pages visited, time spent, and navigation behavior
  • Referring URLs

Information from third-party services:

  • Authentication data processed through our secure OTP email verification system
  • Communication data processed through Resend (resend.com)

2a. Cookies and Browser Storage

We use a small number of strictly necessary cookies and browser storage mechanisms to operate the Platform. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

Cookies (set by our servers, transmitted over HTTPS only):

  • verdad_session — An encrypted, HMAC-signed session token stored as an httpOnly cookie. Authenticates you across page loads. Expires after 7 days (clients) or 30 days of inactivity (admins).
  • verdad_csrf — A CSRF protection token used to prevent cross-site request forgery attacks. Expires with your session.
  • verdad_pending_2fa — A short-lived (5-minute) cookie set during admin two-factor authentication. Deleted automatically upon completion or expiry.

All cookies are set with SameSite=Strict and are never readable by third parties. None contain personally identifiable information in readable form.

Local Storage (stored only in your browser; never transmitted to our servers):

  • Application form drafts — auto-saved progress to allow resuming incomplete applications
  • Draft ID — a reference to a server-side draft for cross-device resume
  • UI preferences — saved column visibility and filter presets in the admin dashboard (admins only)

Session Storage (cleared automatically when your browser tab is closed):

  • Your email address is temporarily held in session storage during the one-time password sign-in flow and is not persisted beyond that step.

No analytics, advertising, or tracking cookies are used on this Platform. No third-party scripts set cookies. The cookies listed above are strictly necessary for the Platform to function and do not require consent under applicable privacy law.

3. How We Use Your Information

We use the information we collect to:

  • Respond to your inquiries and provide capital advisory services
  • Process and evaluate your financing application
  • Match your transaction profile with appropriate capital sources
  • Communicate with you about your engagement, deal status, and market updates
  • Maintain records required for our business operations
  • Improve our Platform and services
  • Comply with legal and regulatory obligations

4. AI-Powered Features

Our Platform uses artificial intelligence tools, including services provided by Anthropic, PBC ("Claude"), to power our advisory chatbot and deal analysis features. Information you share with the AI advisor may be processed by Anthropic's systems in accordance with their privacy practices (anthropic.com/privacy). We do not use your personal financial information to train AI models.

AI-generated responses are informational only and do not constitute financial, legal, or investment advice.

5. CRM and Data Storage

Information submitted through our application and contact forms is stored in HubSpot, Inc.'s customer relationship management platform. HubSpot's privacy practices are available at legal.hubspot.com/privacy-policy. We use this data exclusively to manage client relationships and transaction workflows.

6. Disclosure to Third Parties

We do not sell, rent, or trade your personal information. We may share information:

  • With capital sources (lenders, funds, financial institutions) you authorize us to approach on your behalf as part of our advisory engagement
  • With service providers who assist in operating our Platform (HubSpot, Resend, Anthropic, Vercel, Supabase), each bound by appropriate confidentiality and data handling obligations
  • As required by law, regulation, legal process, or governmental request
  • To protect the rights, property, or safety of VERDAD, our clients, or others

We will not submit your information to any lender or capital source without your express authorization.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information from unauthorized access, disclosure, alteration, or destruction. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Sensitive application data is transmitted over encrypted connections (HTTPS/TLS). Authentication is handled through a secure one-time password (OTP) email verification system with HMAC-signed sessions.

8. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this policy, to comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your personal information at any time by contacting us at the address below, subject to any legal retention requirements.

9. Your Rights & Opt-Out

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with a relevant data protection authority

To exercise any of these rights, contact us at info@vhfc.io.

9a. Opt-Out of Marketing Communications

We may use your contact information to send you updates, market commentary, and information about VERDAD's services. You may opt out of marketing communications at any time by:

  • Clicking the unsubscribe link included in any marketing email
  • Emailing us directly at info@vhfc.io with "Unsubscribe" in the subject line

Opting out of marketing communications will not affect transactional messages related to an active advisory engagement, including deal status updates, document requests, or closing communications.

9b. Opt-Out of Sharing with Non-Affiliated Third Parties

In accordance with applicable financial privacy regulations, including Regulation S-P, we provide this notice regarding our information-sharing practices. We share your nonpublic personal financial information only with:

  • Affiliates: We do not currently share nonpublic personal financial information with affiliates for marketing purposes.
  • Authorized capital sources: Lenders, funds, and financial institutions you expressly authorize us to approach on your behalf as part of an advisory engagement.
  • Service providers: Companies operating under contract with us that assist in running our Platform (HubSpot, Resend, Anthropic, Vercel, Supabase), subject to confidentiality obligations.
  • Legal requirements: As required by applicable law, regulation, or governmental request.

We do not share your nonpublic personal financial information with non-affiliated third parties for their independent marketing purposes, so no opt-out election is needed for that category of sharing because it does not occur. If you wish to restrict sharing beyond what is described in this Policy, please contact us at info@vhfc.io.

9c. California Residents — CCPA / CPRA Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for which we use it, and the categories of third parties with whom we share it.
  • Right to Delete: You may request deletion of personal information we have collected from you, subject to certain legal exceptions (such as information required to complete a transaction or comply with a legal obligation).
  • Right to Correct: You may request correction of inaccurate personal information we maintain about you.
  • Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising purposes. No opt-out is required.
  • Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (such as precise financial data), you may request that we limit its use to what is necessary to perform the services you requested.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any California privacy right, submit a verifiable consumer request to info@vhfc.io with the subject line "California Privacy Request." We will respond within 45 days as required by law.

Note: Certain information collected and used in connection with providing financial services may be subject to the Gramm-Leach-Bliley Act (GLBA), which may limit the applicability of CCPA provisions to that information.

10. Children's Privacy

Our Platform is intended for business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Platform following any changes constitutes your acceptance of the revised policy.

12. Contact

Verdad Holdings Group
San Antonio, Texas
vhfc.io

This policy was last reviewed in May 2026. For questions regarding this policy or your data, please email us at info@vhfc.io.