Privacy Notice

Who we are

DuckWater Financial — a trade name of Agency Age Holdings, LLC, a Delaware limited liability company — is a technology platform. We help you assemble a file about your own project and, when you ask us to, introduce you to participating, licensed partners.

We are not a lender, an insurer or a broker, we hold no lending, brokerage or insurance licence, we make no credit or coverage decision, and we never hold your money. Everything about terms, approval, fees and funding is decided by the partner you choose, under their own agreement with you. Availability is per state and per partner.

This notice is written from the system itself. Each section below names a family of records we actually hold, why we hold it, and how long. If a new kind of record is added and nobody describes it here, our own build fails — that is a deliberate control, not a claim about our diligence.

Your account and how you sign in

Your email address, and your name, phone number and picture if you give them. Behind that: the credential you sign in with, held as a hash and never as the password itself; your active sessions and the tokens that renew them; the short-lived codes we email you; and, for staff accounts, an enrolled authenticator held as a sealed secret with each unused recovery code kept as a keyed verifier.

Why. To let you in, to keep somebody else out, and to end a session when you or we choose to.

How long. While the account exists. Codes and sessions expire on their own; deleting your account removes the record and its second factor.

• We never store your password or a recovery code in a form we could read back.

Your project and your application

Your name, email address, phone number, the property's ZIP code and state, the contractor you are working with, the project type, the budget band, the timeline and the needs you tick. If a contractor invited you, their invitation may already carry your name, email address or phone number, and it records each time they sent it and to which address or number.

Why. To receive the application, to confirm we have it, and to work out which participating, licensed partners can serve each need in your state.

How long. While the relationship is live, and afterwards for as long as we need the record. Deleting your account overwrites the identifying fields and leaves the project type, budget band and property state behind, unattached to you.

The file you build here

What you told us you are planning — your goals, who is buying with you, your timeline — the checklists you assemble, the numbers you confirm, the readings of your own documents that suggested them, the illustrations you save, and where you left off in a guide.

Why. So the work of assembling a file survives between visits and you are not asked the same thing twice.

How long. While your account exists. Deleting it removes every row here outright.

• A confirmed number is sealed under a key we hold, and a reading is kept beside it so you can see where a figure came from.
• An illustration is arithmetic on the numbers you entered. It is not an offer, a rate, or a decision by anybody.

Documents you upload

The identity, income and property papers you put in your vault, and the papers attached to an application — a W-9, a licence, a certificate of insurance, an agreement. We keep the file, its name, its type and its size.

Why. So you can build one file and use it more than once, instead of finding the same three documents for every party who asks.

How long. Until you remove the file, or until your account is deleted — which deletes the stored object as well as the row that points at it.

• A document in your vault has no public address. Opening one goes through this site, under your own session, and is written to the audit trail as a sensitive read.
• Bytes are protected by our provider's encryption at rest and by owner-only access. Per-file encryption under our own keys is not built yet, and this notice will say so until it is.

Worksheets you fill in

Figures you type for yourself: debts you are carrying, a home sale you are working through, a property's value as you estimate it beside public-record figures you entered.

Why. To produce the reports and illustrations you asked for.

How long. While your account exists; deleting it removes them.

• Every calculator on this site computes only on numbers you typed, and its output is illustrative.

Credit information

If you ever instruct us to fetch it: a credit band, a count of open accounts and a utilization figure, sealed under a key we hold — together with a record of when the retrieval happened, which provider performed it and which instruction of yours authorised it.

Why. Only to show you what you asked to see.

How long. While your account exists; deleting it removes both outright.

• No credit provider is connected in production today, so neither of these holds anything. There is no credit check to get started, and this notice will change before that does.
• We do not make credit decisions. Approval, terms, fees and funding are decided by participating, licensed partners.

What you ask us to move, and what you agreed to

Each consent you grant, stored as the words you actually saw rather than a version number, with the time, your IP address and your browser's user-agent string. Each document share: who you sent it to, which documents, why, and when it expires. Each introduction: which institution, when, and under which consent.

Why. So the answer to "what did you agree to, and what moved because of it" is a record and not a reconstruction.

How long. A consent record outlives the grant on purpose — withdrawing is a mark, never a deletion, because the evidence that a disclosure was made is the point of it. Deleting your account erases the email address, IP address and user agent from it and keeps the kind, the version, the timestamps and the disclosure text, which name nobody.

• We ask before we pass your details to a financing partner, every time, and the box you tick is the consent — there is no path that produces an introduction without first storing what you agreed to.
• Withdrawing a consent stops anything further. Neither withdrawal nor deletion can recall a file a partner has already received — they hold it under their own obligations from that point.
• We never rank or order partners by what they pay us, and no commercial term reaches anything shown to you.

If you are a contractor

Your business record: company name, website, year established, trades, states served, business address, contact name, email address and phone number, your licence and certificate of insurance and the files that evidence them, the reference code we assign, and any insurance worksheet you save.

Why. To run the Builder Partner programme and to keep your papers on record.

How long. While the business relationship is live.

• Saving an insurance worksheet is never a quote request and never reaches an insurer.
• A Builder Partner sees status, never detail: that an invitation was sent, that an application was started, that it is under review. Not a homeowner's financial information, documents, or anything told to us privately.

If we hold you as a business lead

Business contact details bought from a data source — name, business address, phone, mobile and email — with the lead metadata that came with them, each attempt we made to contact you and how it went, and where you stand in a sequence.

Why. To introduce the Builder Partner programme to contractors.

How long. Under review, and named as a gap: no automatic sweep runs today. It is a decision the owner has to take, and this notice states the position rather than implying a schedule we do not operate.

• Purchased numbers are never texted.
• Reply STOP, unsubscribe, or ask us, and the address or number goes on a do-not-contact list. That list is kept indefinitely and on purpose — it is what makes a later import unable to bring you back. It is the one thing deletion keeps rather than erases.

Records of what happened

An audit entry for changes made through our workflows — who acted, on what, and the before and after — with reads of consumer financial records marked as sensitive. Beside it, a security record of what the system refused or noticed, and an operational note when a message we tried to send did not arrive. And, if you write to us about your own data, a record that you did: what you asked for, when it arrived, when it is due and what we decided.

Why. So we can answer who looked at your documents, and so a refusal is evidence rather than a memory.

How long. Audit entries for 365 days; security records for 400 days; failed-send notes for 90 days. A record that you made a request is kept longer, because it is the evidence that we honoured it.

• Deleting your account redacts your audit rows rather than removing them: your identifiers and the before/after snapshots are overwritten, and the shape, the action and the timestamps stay. That is redaction, not erasure, and we say so rather than implying more.
• A failing address appears in a security record only as a keyed fingerprint, never in the clear.
• The record of a request you make holds no address and no link to your account — only a fingerprint that lets us see two requests came from the same person. What you and we actually wrote stays in the email thread it happened in.

Documents, models and your device

No model is configured on this deployment, so nothing you upload or type is sent to one. The assistant on this site answers from a fixed script.

We do not sell your personal information, and we do not use it for third-party advertising. We do not share it with data brokers or lead resellers.

We do not use your personal information to train artificial intelligence or machine-learning models, and we do not provide it to anyone for that purpose.

Who receives it

Each of these receives only what it needs to do the job named beside it. The engineering list this is generated from is public in our repository, and it is reviewed annually and on any change.

• Convex — Everything the platform holds — the tables above, the files you upload, and the keys that protect the sealed fields. Our database, file storage and backend. Hosted on AWS in the United States. An administrator of that platform can read what is stored in the clear; that is the boundary we operate inside, and we would rather write it down than imply one that does not exist.
• Vercel — All traffic to this site, including request contents and IP addresses in transit. Hosting and building the site.
• Resend — The recipient's address, the subject line and the body of every email we send — which includes one-time sign-in and password-reset codes. Delivering email.
• Twilio — The mobile number and the message body of every text we send. Delivering text messages. Purchased marketing numbers are never texted.
• Cloudflare — A challenge token and your IP address, when a public form is protected. Telling people apart from bots on public forms. Not switched on in production today, so it currently receives nothing. It is listed anyway, because it will receive IP addresses the moment the keys are set — a recipient list that is accurate only until the next configuration change is not a control.
• Participating, licensed partners — What you instruct us to send them, when you instruct it. So they can talk to you about financing or coverage. They are not processing on our behalf. From the moment they receive your file they hold it under their own obligations and their own privacy policy, and availability is per state and per partner.

We also give information to professional advisors, or to authorities, where the law requires it or where it is needed to protect someone from harm.

What you can do

Most of these you do yourself, now, without asking us. Where a link appears, that is the control; where none does, write to us.

• Get a copy of your data. Download a copy of what we hold under your account, as a zip of readable files, from your account page. It is not quite everything, and it says so: a plain-English page inside it lists what is in the file, what is only partly in it, and what we deliberately left out — your documents are listed rather than included, and credential material such as your password hash and your session tokens is never put in a downloadable file. Anything the file cannot answer, ask us for. Every download is recorded before it is produced. Your account
• Withdraw a consent. Each consent you granted is listed on your account page with the words you agreed to, and each can be withdrawn there. Withdrawing stops anything further from moving. Your account
• Delete your account and data. Requesting deletion revokes every consent at once and starts a 30-day window in which you can change your mind from the same account. After that the erasure runs and is final. What survives is listed above, family by family. Your account
• Correct something that is wrong. Most of it you can edit yourself. For anything you cannot, write to us and we will correct it.
• Stop the messages. Reply STOP to any text, use the unsubscribe link in any email, or ask us. The address or number goes on a do-not-contact list that later imports cannot override.
• Ask, and appeal. Depending on where you live you may have further rights under state privacy law, including the right to appeal a refusal. Write to us and we will record the request, tell you when to expect an answer, and give you the reason if the answer is no.

Write to privacy@duckwaterfinancial.com. We record every request when it arrives, and we aim to answer within 45 days. We will not make you worse off for asking.

What this notice does not describe

Some of what we store is not about the people this notice addresses. Rather than leave it unmentioned, here it is, with the reason:

• Employee records — who works here, which policies they acknowledged, which access reviews covered them, which training they took. Personal data, but of DuckWater's own people, governed by the HR Security policy and the notice they are given on hire; a consumer notice describing them would be addressing the wrong reader.
• The internal compliance register. By construction these hold no personal data at all — an incident record counts the people affected rather than naming them, and the writer refuses text that looks like an address or a phone number.
• Key-vault and backup operations metadata: wrapped keys, what an operator did to which key, the daily health check, and a confirmed backup's hashes and row counts. No personal data — key material appears only as a fingerprint, and a backup row never holds the archive or its passphrase.
• The catalogue of participating institutions, their states and their commercial terms. A business record about companies, not about people — and the terms in it are precisely what is never allowed to reach anything a consumer sees.
• The digital-asset bridge, which is switched off on both public hosts (`lib/bridge/gate.ts` → `bridgeEnabled()`): every page 404s and every route refuses, so these receive nothing. They are pseudonymous by design — a keyed fingerprint and an amount band, never a wallet address or a balance. This notice gains a section describing them before that flag is ever turned on.

Children

DuckWater is for adults. This site is not directed to children under 18 and we do not knowingly collect information from them. If you believe a child gave us information, write to us and we will delete it.

Changes

Every change bumps the version at the top of this page. If a change materially affects how we handle information you have already given us, we will tell you by email before it takes effect.

Contact

Email privacy@duckwaterfinancial.com, or write to Agency Age Holdings, LLC d/b/a DuckWater Financial, 525 Broadhollow Rd., Suite 106, Melville, NY 11747.