Privacy & Compliance
Nothing Stored.
Nothing to Breach.
Lendlytics is built on a zero-storage architecture for all deal data we control. This page explains exactly what that means for your dealership, your customers, and your compliance posture — including how our AI processing partner handles data on your behalf.
The Short Version
Everything You Need to Know in Three Points.
We do not store deal data.
No applicant information, no credit data, no deal structure, no financial figures entered into The Desk are ever written to a Lendlytics database. Deal data exists only in your active browser session until the Generate button is clicked — at which point it is transmitted to our AI processing partner to generate the narrative and then permanently cleared from our systems.
We cannot produce what we do not have.
There is no Lendlytics database containing consumer financial information to subpoena, breach, audit, or produce. Our AI processing partner retains transmitted data for a maximum of 7 days per their standard API policy before automatic deletion — and never uses it for model training under any circumstances. This is not a policy we maintain — it is a contractual guarantee from our AI provider.
Your compliance exposure from Lendlytics is zero.
Because Lendlytics retains no consumer financial data, it does not create GLBA compliance obligations for your dealership beyond what you already manage. No vendor data agreement is required. No security audit is triggered. No consumer data is at risk.
What Lendlytics Processes
What Happens to Deal Data When You Use The Desk.
When you enter deal information into The Desk, that data is processed in real time by our AI engine to calculate deal metrics and generate Murphy's narrative. Here is exactly what happens at each step:
You enter deal data into The Desk
Financial and structural deal information is entered into your active browser session. This data lives only in your browser — it has not been transmitted anywhere yet.
The Desk calculates metrics locally
Deal Score, LTV, DTI, PTI, and The Fix calculations happen natively in your browser. No data leaves your device for these calculations.
Murphy generates the narrative
When you click Generate, the deal data is transmitted to our AI processing partner over an encrypted connection to produce the narrative. Per our AI provider's API policy: this data is never used for model training under any circumstances, and is automatically deleted within 7 days. No personally identifiable information is required or recommended to be included in this transmission — The Desk does not contain fields for PII by design.
The session ends
When you clear the desk, navigate away, or close the browser, all data is permanently gone from your session. Nothing is written to a Lendlytics database at any point in this process. There is no record of the deal in our system.
Our AI Processing Partner
How Anthropic Handles Data on Our Behalf.
Murphy — the AI engine inside Lendlytics — is powered by Anthropic's Claude API. When deal data is transmitted to generate a narrative, it passes through Anthropic's infrastructure. Here is exactly what their API policy guarantees:
Never Used for Training
Anthropic's API policy guarantees that data submitted through the API is never used to train Claude or any other AI model — under any circumstances. This is a flat policy with no exceptions.
7-Day Maximum Retention
API inputs and outputs are automatically deleted within 7 days per Anthropic's standard commercial API policy. No long-term storage of transmitted deal data occurs.
Encrypted Transmission
All data transmitted to the Anthropic API is encrypted in transit. Anthropic is SOC 2 Type II certified and maintains enterprise-grade security infrastructure.
For dealerships that require the highest level of data assurance, Anthropic offers a Zero Data Retention (ZDR) arrangement for qualifying enterprise API customers — meaning data is not stored at rest at any point after the API response is returned. If your compliance requirements demand ZDR, contact us directly and we will work with you to accommodate that requirement.
Our Recommendation
We strongly recommend that users do not enter any personally identifiable information into The Desk — including applicant names, social security numbers, dates of birth, or addresses. The Desk is not designed to collect PII and does not include fields for it. Murphy produces accurate, professional narratives using financial range data and deal structure data only — no PII is required or helpful.
What We Do Not Collect
The Data We Were Designed to Never Have.
The Desk does not include fields for personally identifiable information. The following data types are not part of our platform by design:
The data Murphy works with is financial range data and deal structure data only — income amounts, debt amounts, credit score ranges, and vehicle values. This is the minimum information needed to produce a professional narrative and nothing more.
GLBA & Regulatory Compliance
How Lendlytics Fits Into Your Compliance Framework.
The Gramm-Leach-Bliley Act requires financial institutions and their service providers to protect the privacy and security of consumer financial information. Dealerships engaged in financing transactions are subject to GLBA requirements and must ensure that any vendor or service provider they use handles consumer data appropriately.
Lendlytics does not store or retain consumer financial data in its own systems. Deal data transmitted to our AI processing partner for narrative generation is subject to Anthropic's commercial API policy — which prohibits training use and provides for automatic deletion within 7 days. Because no personally identifiable consumer information is required to use The Desk, the practical compliance exposure from using Lendlytics is minimal.
For dealerships that require a formal vendor review process before onboarding new software, this page and the downloadable compliance summary are designed to provide everything your compliance team needs to complete that review — including a clear description of how our AI processing partner handles transmitted data.
No Data Custodian Relationship
Lendlytics does not hold, store, or maintain consumer financial data on behalf of your dealership. No custodian relationship is established.
No Vendor Data Agreement Required
Because no consumer data is retained, a formal vendor data sharing agreement or data processing addendum is not triggered by the use of Lendlytics.
No Security Audit Exposure
There is no Lendlytics data environment containing consumer information to include in your dealership's security audit or annual GLBA compliance review.
Important Note
This page is provided for informational purposes and does not constitute legal advice. Dealerships with specific compliance questions should consult with their legal counsel or compliance officer. Lendlytics' compliance posture is based on our current zero-storage architecture — any future changes to data handling will be communicated to subscribers in advance.
Your Account Information
The Only Data We Actually Keep.
To operate your subscription, Lendlytics maintains the following account information:
Name and Email
Required to create and manage your account, send billing notifications, and provide support.
Subscription and Billing Status
Your plan tier, billing cycle, and payment status are maintained to manage your subscription. Payment processing is handled by Stripe — Lendlytics does not store payment card information.
Usage Data
Your monthly deal counter tracks how many narratives have been generated against your plan limit. This is a count only — no deal content, applicant data, or narrative text is associated with this count.
For Your IT Team
The One-Page Answer to Every Question They Have.
If your IT director or compliance team needs to review Lendlytics before your store subscribes, the downloadable compliance summary below is designed for exactly that conversation. It covers our data architecture, what we process, what we do not store, and how that affects your dealership's compliance posture — in plain language, on one page.
Lendlytics Compliance Summary
Zero-Storage Architecture & GLBA Position Statement
One page · PDF · Shareable with your team
Still Have Compliance Questions?
We are happy to answer specific questions about our data architecture and compliance posture directly.