Privacy Policy

orca lmp, Inc. ("orca lmp", "we", "our", or "us") operates the orca lmp platform (the "Platform"), a marketplace for Low-Income Housing Tax Credit (LIHTC) deal origination and capital formation. This Privacy Policy explains how we collect, use, disclose, and safeguard information about you when you access or use our Platform.

By accessing or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use immediately.

2.1 Information You Provide Directly

• Account registration: name, work email address, password (hashed), user role (Developer, Investor, or Lender), and beta access code.
• Company profile: company name, company type, MSA preferences, membership tier, and team member information.
• Deal data: deal name, location, address, MSA, financial figures, unit count, AMI mix, tax credit type, project documents, and images you upload when posting or editing a deal.
• Offer and LOI data: offer amounts, offer types (equity or debt), and supporting documents submitted in connection with a deal.
• Communications: messages, notes, and attachments sent via the Platform's messaging features.
• Support requests: information you provide when contacting our support team.

2.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, pages visited, referring URL, and timestamps.
• Session data: authentication tokens (JWT) stored in secure HTTP-only cookies.
• Usage data: actions taken on the Platform such as deal views, offer submissions, and messaging activity.
• Device data: device type, screen resolution, and other technical identifiers.

2.3 Information from Third Parties

• Email delivery: we use Resend to deliver transactional emails. Resend may process your email address in accordance with their own privacy policy.
• File storage: uploaded documents and images are stored via Supabase Storage. Supabase processes file metadata and content on our behalf.
• Address autocomplete: we may use a geocoding or address-suggestion API to assist with project location entry. Your inputted address may be transmitted to that provider.

• To create, authenticate, and maintain your account.
• To operate and provide Platform features, including deal posting, discovery, and capital matching.
• To facilitate communications between Developers, Investors, and Lenders within the Platform.
• To send transactional emails such as password resets, deal invitations, offer notifications, and deal award confirmations.
• To enforce our Terms of Service and ensure Platform integrity.
• To detect, prevent, and respond to fraud, security incidents, and misuse.
• To improve, personalize, and optimize the Platform and develop new features.
• To comply with applicable laws, regulations, and legal obligations.
• To respond to your inquiries and provide customer support.

4.1 With Other Platform Users

Certain information is visible to other authenticated users based on your role and deal participation. For example, Developers who post deals may have their company name and deal details visible to Investors and Lenders in the same MSA. The scope of visible information is determined by your deal's visibility settings (Public or Invite-Only) and the field visibility controls you configure when posting a deal.

4.2 With Service Providers

We share information with third-party vendors who process it on our behalf, including database hosting (Supabase/Neon), email delivery (Resend), and deployment infrastructure (Netlify). These providers are contractually obligated to handle data only as directed by us and to maintain appropriate security measures.

4.3 For Legal Reasons

We may disclose your information if required by law, subpoena, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, prevent fraud, or protect the safety of our users or the public.

4.4 Business Transfers

If orca lmp is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred as a business asset. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.5 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes.

We use cookies and similar tracking technologies to operate and secure the Platform:

• Session cookies: required to keep you logged in. These are HTTP-only, secure cookies that cannot be accessed by JavaScript.
• Preview cookies: used to grant early access to the Platform before the public launch.
• Preference cookies: may be used to remember UI preferences such as sidebar collapse state (stored locally in your browser via localStorage).

We do not currently use third-party advertising cookies or cross-site tracking technologies. Most browsers allow you to control cookies through their settings. Disabling session cookies will prevent you from logging in.

We retain your personal information for as long as your account is active or as needed to provide the Platform services. If you request account deletion, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, compliance, or legitimate business purposes (for example, records of financial transactions).

Deal data, offer records, and messaging history associated with completed transactions may be retained for up to 7 years to satisfy financial recordkeeping obligations.

We implement industry-standard technical and organizational measures to protect your information, including:

• TLS/HTTPS encryption for all data in transit.
• Bcrypt hashing for passwords — we never store plaintext passwords.
• HTTP-only, Secure, SameSite session cookies to prevent XSS and CSRF attacks.
• Role-based access controls ensuring users can only access data relevant to their role and deal participation.
• Database access restricted to server-side code; direct database connections are not exposed.

No method of transmission or storage is 100% secure. In the event of a data breach that affects your information, we will notify affected users as required by applicable law.

8.1 Access and Correction

You may access and update your profile information at any time through the Settings page within the Platform. To access a full export of data we hold about you, contact us at support@orcalmp.com.

8.2 Account Deletion

You may request deletion of your account and associated personal data by emailing support@orcalmp.com. We will process your request within 30 days, subject to legal retention requirements.

8.3 California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your personal information, and opt out of any sale of personal information (we do not sell personal information). To exercise these rights, contact us at support@orcalmp.com. We will not discriminate against you for exercising your privacy rights.

8.4 EEA / UK Residents (GDPR)

If you are located in the European Economic Area or United Kingdom, you have rights including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our lawful basis for processing is generally our contractual obligation to provide the Platform and our legitimate interests in operating a secure marketplace. To exercise your rights or lodge a complaint, contact us at support@orcalmp.com.

The Platform is intended for business professionals aged 18 and older. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly.

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you access.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you via email or a prominent notice within the Platform. Your continued use of the Platform after changes become effective constitutes acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: