Privacy Policy

Last updated: October 13, 2026

Claude for Compliance (“we,” operated by CF Synergies, LLC) provides an open library of U.S. mortgage-compliance materials, an MCP server that lets AI assistants look up that library, and optional email alerts when regulations change. We collect as little as possible and never sell your information. This policy explains what we collect and why.

What we collect

• Your email address — when you sign up for regulation-update alerts.
• An optional name — only if you choose to provide it.
• What you asked to follow — the regulation, bundle, or topic tied to your signup, and the page/URL where you signed up.
• A one-way hashed, salted IP address — we store a truncated cryptographic hash of your IP (not your IP itself) solely to detect signup abuse. We cannot recover your IP from it.
• A referral tag — if you arrived through a partner’s link, we record which partner referred you so we can credit them. Your contact information remains ours and is not handed to the partner.
• Share-button clicks — only if you opt in. This is off by default. If you turn it on (at signup or in your preferences), and only then, we record when you click a “Share on LinkedIn” button on the site, so we can credit you for sharing. We never see who you forward or share to — only that you clicked. If you do not opt in, your browser sends us no signal at all when you click those buttons, and nothing is recorded. You can turn this off anytime in your preferences.

Downloading any material from the site (regulations, kits, templates) does not require an account and is not tied to your identity.

The MCP server and the C4C: Mortgage Industry Regulations app

C4C: Mortgage Industry Regulations is our MCP server and the apps built on it: the connector for Claude and ChatGPT, and the agent for Microsoft 365 Copilot (listed as C4C: Mortgage Regs). This section covers all of them.

If you connect an AI assistant (such as Claude, ChatGPT or Microsoft 365 Copilot) to our MCP server, the assistant sends the server the requests it makes on your behalf: search terms, citations to look up, and passages to check against the regulator’s text. The server does not receive the rest of your conversation. At the standard address (mcp.claudeforcompliance.com) it requires no account and stores no name, email address, IP address, or other identifier. Files you share in the conversation, such as loan files for a playbook review, stay with your AI assistant and are not sent to the server.

The server does not store the text of your searches, citations or passages. It keeps only:

• Aggregate daily counts — for example, how many sessions started (including whether the session started from the server link on our website), and how many times each tool was used, with its result type. These counts contain no search text and no identifiers.
• Which library documents are used — daily counts of how often each regulation or document in our library is opened, recorded by our own document ID. These counts contain no search text and are not linked to you.

The sign-in address

Some apps require a sign-in before they connect to an MCP server. For them we run a sign-in version of the same server at mcp-auth.claudeforcompliance.com. To connect there, you enter your email address and we send you a one-time link (through our email provider, Resend). When you approve the connection, we store:

• Your email address, with the date you first connected and the date you last connected, so the connection is tied to a verified address and we can reach you about the service.
• Sign-in tokens for the app you connected, so it can keep using the server without asking again. Access tokens expire after an hour; the app renews them until you or we revoke the connection.
• Short-lived abuse counters: a one-way hash of your IP address and of your email address, counting sign-in emails per hour, deleted automatically after the hour.

The sign-in address receives the same lookups as the standard address and nothing more: not the rest of your conversation and not your files. Signing in does not subscribe you to our newsletter.

API keys

Companies can also reach the same regulation library through our API, at mcp.claudeforcompliance.com/v1, using a key we issue. For each API customer we store:

• The company’s name and a contact email address, so we can manage the account and reach you about it.
• A one-way hash of each key, never the key itself. We show you the key once, when we create it, and cannot recover it afterward.
• Daily counts of calls per key and tool, for example how many searches a key made on a given day, so we can apply your plan’s limits and bill accurately.

We do not store the questions or other inputs sent with an API call, and we do not link them to your key. Don’t put borrower information or other personal data in API calls. See our API Terms.

Don’t put borrower information or other personal data in your questions. Your conversation itself is handled by your AI provider under its own privacy policy, not ours.

How we use it

We use your email solely to send the regulation-update alerts you requested and to operate and secure the service. We use double opt-in: after you sign up, we email you a confirmation link, and we only send alerts after you confirm. We do not use your information for advertising.

Who we share it with

We do not sell or rent your information. We use a small number of service providers strictly to run the service, who process data on our behalf under their own terms:

• Cloudflare — website and MCP server hosting, our databases, and network security. To deliver traffic and enforce rate limits, Cloudflare processes network information such as IP addresses under its own terms; our server does not record them.
• Resend — sending the confirmation and alert emails.

We may disclose information if required by law or to protect the service from abuse.

Cookies & analytics

The site sets no advertising or cross-site tracking cookies. If you confirm a subscription or manage your preferences, we set a functional cookie that securely identifies you to the site so features like share-button crediting work; a second small cookie records whether you opted in to share-button crediting, so that if you did not, your browser never sends the signal. These are functional, first-party, and not used for advertising or cross-site tracking. If we use website analytics, we use a privacy-first, cookieless measurement tool that does not fingerprint you or track you across sites. Our own page counter records the page you viewed, the website that linked you here (its domain only), any campaign tag in the link, your country, and the name of the organization that runs the network you’re on, such as your internet provider or employer. It uses no cookie and stores no IP address. If we send you a link personally, it may carry a tag that lets us see that you opened it. We also count clicks on our install buttons (such as “Add to Claude,” “Add to ChatGPT,” and “Copy server URL”) as a daily total per button and page. These button counts use no cookie and record no IP address or other identifier, and they are not tied to you. This is separate from share-button crediting, which is tied to your subscription and happens only if you opt in.

We also use your browser’s local storage to remember that you’ve already subscribed or dismissed a sign-up prompt, so we don’t ask you again. That flag stays on your device, is not sent to us, and is not used to track you. You can clear it anytime through your browser settings.

How long we keep it

We keep your subscription information until you unsubscribe, after which we delete it within 30 days, except where we must retain limited records to comply with law.

The MCP server keeps no search text. We keep its aggregate daily counts indefinitely; they are not linked to you.

We keep page-counter records (the page, referring domain, campaign tag, country and network organization) for 2 years, then delete them. Install-button counts are daily totals with no identifier, and we keep them indefinitely.

For API customers, we keep the company name, contact email, key hashes and daily call counts while the account is in use, and for 2 years after its last API call, then delete them.

For the sign-in address, we keep your email address and connection dates until you ask us to delete them; deleting them also ends your connections. Unused one-time links expire after 15 minutes.

Your choices

You can unsubscribe at any time using the link in any alert email or by emailing us. You may also ask us to access or delete the information we hold about you, including the email address you used at the MCP sign-in address. Email [email protected] and we’ll take care of it.

Security

Information is stored in parameterized databases, IPs are hashed, and we follow least-privilege practices. No method of transmission or storage is perfectly secure, but we work to protect the limited data we hold.

Children

The site is intended for compliance professionals and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes

We may update this policy; the “last updated” date above reflects the current version.

Contact

CF Synergies, LLC
122 Wepawaug Drive, Milford, CT 06460
Email: [email protected]

Terms of Use