Obsidian Prive

Effective date: July 03, 2025

Who we are
Obsidian Prive LLC (“Obsidian Prive,” “we,” “us,” “our”) acquires and places performing, seller‑financed mortgage notes and partial payment streams. We close through licensed escrow/title companies and use licensed servicers to collect and remit payments. We are based in Florida, USA.

This Policy explains how we collect, use, share, and protect personal information from:

• Website visitors and marketing contacts
• Prospective/active investors
• Prospective/active note sellers
• Counterparties and professional partners (title/escrow, servicers, law firms, valuation vendors)

What we collect

We collect information you provide directly, information from documents you upload, information from service providers, and limited data via cookies/analytics.
A) Contact & profile
Name, email, phone, address, company, role
States of interest, check size, target yields (investors)
Note facts (payment amount, months remaining, pay history, property state) (sellers)
B) Deal diligence (as applicable)
Proof of funds range; NDA status
Note/mortgage documents, recorded assignments, payment histories
Tax/HOA status, insurance proof, valuation snapshots (BPO/AVM)
For international investors: KYC/OFAC screening data; tax forms (W‑9/W‑8)
C) Website/analytics
IP address, device/browser, pages viewed, time on site
Cookies/pixels (e.g., Google Analytics 4, Meta Pixel) for usage and ad measurement
D) Sensitive/regulated data
“Nonpublic personal information” (NPPI) within loan files (e.g., borrower names on instruments, loan numbers). We minimize, redact for marketing, and process NPPI only for diligence/closing via secure vendors under confidentiality.
We do not knowingly collect information from children under 16.

How we use information
Evaluate and respond to seller submissions and investor buy‑box requests
Underwrite deals (title/O&E, valuation, taxes/HOA, doc chain checks)
Open and complete closings with escrow; coordinate servicing transfers
Verify identity, KYC/OFAC screening (as required), prevent fraud
Provide communications, downloadable guides, and event/deal updates
Operate, secure, and improve our website and services; measure marketing performance
Comply with legal, regulatory, tax, and recordkeeping obligations
Enforce agreements and protect rights and safety
Legal bases (EU/UK GDPR, where applicable): contract performance, legitimate interests (deal evaluation, security, analytics), consent (marketing cookies/emails where required), legal obligation (KYC/OFAC, tax, court orders).

How we share information
We do not sell personal information. We share only as needed to operate and close transactions:
Service providers: escrow/title companies, licensed servicers, attorneys, O&E/title search vendors, valuation/BPO providers, document custodians, IT/cloud/CRM/email platforms, analytics/ad platforms
Transaction counterparties: investors/sellers involved in a specific deal (limited, purpose‑bound)
Compliance and safety: KYC/OFAC, fraud prevention, law enforcement requests, court orders
Business transfer: merger, acquisition, or asset sale (with appropriate safeguards)
We require vendors to protect information and use it only for our instructions.

Cookies, analytics, and ads
We use first‑/third‑party cookies and pixels (e.g., GA4, Meta) to understand site usage, improve content, and measure/retarget ads. You can control cookies in your browser, use the site’s cookie banner (if present), and opt out of interest‑based ads via:
NAI: https://optout.networkadvertising.org/
DAA: https://optout.aboutads.info/
Your device’s ad settings
We currently do not respond to Do Not Track (DNT) signals. If you are in California and use a browser Global Privacy Control (GPC), we will treat it as a “Do Not Sell/Share” signal for cookie‑based “sharing” where applicable.
Data security
We use reasonable technical and organizational measures (encryption in transit, access controls, least‑privilege, vendor NDAs, segregated data rooms for loan files). No system is 100% secure. If we discover a breach, we will notify affected individuals and/or authorities as required by law.

Data retention
Deal files and related communications: typically 7 years (or longer if required by law or litigation hold)
Marketing leads with no engagement: typically 24 months
Cookies/analytics: per technology provider settings
We delete or de‑identify data when no longer needed, subject to legal retention requirements.

Your choices & rights
A) Email/SMS marketing: You can unsubscribe via the email footer or by contacting us.
B) US State privacy rights (e.g., CA/VA/CO/CT/UT) where applicable:
Right to know/access, correct, delete, and portability
Right to opt out of “sale” or “sharing” for cross‑context behavioral advertising (we do not sell; cookie‑based “sharing” may occur—use cookie banner/GPC and contact us)
Right to limit use of sensitive personal information (we do not use SPI for advertising)
Non‑discrimination for exercising rights
Note: Personal information subject to GLBA (loan NPPI) is generally exempt from CCPA/CPRA.

C) EU/UK GDPR rights:
Access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests
Withdraw consent where processing is based on consent
Lodge a complaint with a supervisory authority
To exercise rights: email hello@obsidianprive.com with your name, the right you wish to exercise, and your relationship (seller, investor, visitor). We may request additional information to verify your identity. Authorized agents may submit requests with appropriate authorization.

GLBA financial privacy (NPPI)
For loan‑related nonpublic personal information (NPPI), we follow the Gramm‑Leach‑Bliley Act (GLBA) and applicable state analogs:
We collect NPPI only as necessary (diligence, closing, servicing transfer)
We do not disclose NPPI to non‑affiliated third parties except as permitted by law (e.g., escrow/title, loan servicers, attorneys, custodians) and only under confidentiality
We safeguard NPPI via administrative, technical, and physical measures
We redact NPPI in marketing materials and data rooms until NDAs/need‑to‑know are in place
International transfers
We may process/store information in the United States and other countries. Where EU/UK personal data is transferred to a country without an adequacy decision, we use appropriate safeguards (e.g., Standard Contractual Clauses) and supplementary measures where needed.

Third‑party links
Our site may link to third‑party websites/services. We are not responsible for their privacy practices. Review their policies before providing personal information.

Changes to this Policy
We may update this Policy from time to time. We will post the updated version and change the effective date. Material changes will be highlighted for a reasonable period.

Contact us
Email: hello@obsidianprive.com
Company: Obsidian Prive LLC, Florida, USA
If you are in the EU/UK and wish to contact us about GDPR matters, please email and include “GDPR” in the subject line.

California Notice at Collection (summary)
Categories collected: Identifiers (name, email, phone), commercial info (deal preferences), internet activity (site analytics), professional info (entity), geolocation (coarse via IP). For transactions, we may collect financial documents for proof of funds and NPPI within loan files (GLBA‑regulated and exempt from CCPA).
Purposes: Evaluate offers, diligence/close transactions, servicing coordination, security/fraud prevention, marketing (with consent where required), analytics.

Retention: As outlined in Section 7.
“Selling/Sharing”: We do not sell personal information. We may “share” identifiers/internet activity for ad measurement; opt out via cookie banner/GPC or email us.
Sensitive PI: We do not use or disclose SPI for cross‑context advertising.

State‑specific addendum
Residents of California, Virginia, Colorado, Connecticut, and Utah may have additional rights under their state laws. We will honor verifiable requests consistent with applicable law.