Privacy Policy

1. Scope and who this policy applies to

This Privacy Policy applies to personal information we collect from or about individuals who visit our websites, download or use our mobile applications, submit forms, communicate with us, or otherwise interact with the Services. It does not apply to information we process solely as a processor on behalf of another business where that business’s privacy notice governs, except as required by law. If you apply for or obtain credit from a third-party lender, that lender’s privacy notice will also apply to information you provide in the lending process.

We aim to comply with applicable U.S. federal and state privacy and consumer-protection laws, including, where applicable, the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Fair Credit Reporting Act (FCRA), Federal Trade Commission (FTC) rules, and similar state laws. Certain rights described in this Policy may not apply to data governed by GLBA or other statutes that limit privacy rights for specific categories of financial information. This Policy is directed to individuals located in the United States. It does not apply to our employees, contractors, or job applicants in their capacity as such, or to third-party sites and services we do not own or control.

2. Categories of personal information we collect

Depending on how you interact with us, we may collect the following categories of information (not all categories will apply to every user):

• Identifiers: Name, postal address, email address, telephone number, online identifiers (such as IP address, device IDs, advertising identifiers), and account credentials if you create an account.
• Customer records: Information you submit on applications or forms, which may include employment, income, housing status, requested loan amount, and similar fields.
• Protected classifications: Where permitted and voluntarily provided, age or date of birth to verify that you are old enough to use the Services.
• Commercial information: Records of products or services considered, obtained, or purchased through our partners.
• Internet or network activity: Browsing history on our Services, interaction with pages, referring/exit URLs, and similar diagnostic data.
• Geolocation data: General location derived from IP address; precise geolocation only if you grant permission in your device settings.
• Professional or employment-related information: Employer name, job title, or income range when you choose to provide it.
• Inferences: Profiles or preferences inferred from the information above, such as likelihood of interest in certain financial products.
• Sensitive personal information: We do not intend to collect Social Security numbers through optional website contact forms. If you pursue a loan or account with a lender or their vendors, you may be asked for government-issued identifiers (such as SSN or driver’s license), bank account and routing numbers, and similar data on their systems—subject to their notices, consents, and safeguards.

When you contact support or upload documents, we may receive communications, identification images, bank statements, or other materials you choose to send. Login credentials, security questions, and records of consents or e-signatures may be processed when you create an account or complete flows on our Services or partners’ systems.

3. Sources of information

We collect personal information from: (a) you, when you submit forms, create an account, communicate with us, or use the Services; (b) automatically, through cookies, pixels, and similar technologies; (c) third-party service providers and analytics partners; (d) social networks if you choose to connect or share; (e) lead distribution partners or lenders with whom you interact after we facilitate an introduction; and (f) publicly available sources where permitted by law.

4. How we use personal information

We use personal information for the following business and commercial purposes:

• Operating, maintaining, and improving the Services, including troubleshooting, data analysis, testing, and research;
• Processing your requests, facilitating connections between you and prospective lenders or marketing partners, and delivering requested communications;
• Authenticating users, detecting security incidents, and protecting against malicious, deceptive, fraudulent, or illegal activity;
• Debugging to identify and repair errors that impair functionality;
• Complying with legal obligations, including responding to lawful requests from public authorities;
• Enforcing our Terms of Use and other agreements, and defending legal claims;
• Marketing and advertising our own Services and, where permitted, third-party products that may be of interest, subject to your choices;
• Measuring the effectiveness of advertising campaigns and performing analytics;
• Aggregating or de-identifying information so it no longer reasonably identifies you, and using such information for any lawful purpose.

Legal bases for processing

Depending on your jurisdiction and the activity, we process personal information on one or more of the following bases: your consent where required; steps at your request before entering into an agreement or to perform our agreement with you; compliance with legal obligations; and our legitimate interests in operating the Services, security, fraud prevention, and improvement, where permitted by law.

We will not use sensitive personal information for purposes other than those permitted by applicable law without obtaining any consent required by law.

5. How we disclose personal information

We may disclose personal information to the following categories of recipients:

• Service providers and contractors who perform services on our behalf under written contracts that require appropriate security and restrict use to the services provided (e.g., hosting, analytics, customer support tools, email delivery, fraud prevention);
• Lenders, lead buyers, and loan marketers when you request to be matched or when necessary to fulfill a transaction you initiate;
• Advertising networks and technology partners for cross-context behavioral advertising and measurement, subject to your opt-out rights described below;
• Corporate transactions: In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections;
• Legal and safety: When we believe disclosure is required by law, subpoena, or court order, or to protect the rights, property, or safety of the Company, our users, or others;
• With your direction or consent.

We do not sell personal information for monetary consideration in the ordinary sense of selling a standalone mailing list for cash. We also do not “sell” personal information as that term is defined under applicable state privacy laws in the way some ad-tech businesses do; however, certain disclosures to third-party partners for cross-context behavioral advertising or lead distribution may be treated as a “sale” or “sharing” under those laws. California residents and others may opt out as described in Section 9 and on our Do Not Sell or Share My Personal Information page. For email, SMS, and similar marketing practices, see our Marketing Practices disclosure.

6. Cookies and similar technologies

We and our partners use cookies, web beacons, pixels, local storage, and similar technologies to recognize your browser or device, remember preferences, understand how the Services are used, measure ad performance, and deliver relevant advertising on our Services and third-party sites. You can control cookies through your browser settings; disabling cookies may limit certain features. Industry opt-out tools such as the Digital Advertising Alliance’s WebChoices tool (for web) and AppChoices (for mobile) may also be available depending on your region.

7. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or anti-fraud requirements). Criteria used to determine retention include the nature of the data, the potential risk of harm from unauthorized use, the purposes for which we process the data, and applicable legal requirements. When retention is no longer necessary, we will delete or de-identify the information in accordance with our internal policies and applicable law.

Without limiting the generality of the foregoing, account and servicing-related records are often retained for the duration of your relationship with us and for an additional period that may extend multiple years to meet legal and operational requirements; marketing-related records may be retained for a shorter period after your last interaction or until you opt out; and server logs and analytics data may be retained for a limited period (for example, on the order of twelve to twenty-four months) for security and performance, subject to our technical capabilities and legal holds.

8. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, or destruction. These measures may include encryption in transit (such as TLS/SSL for website connections described as “256-bit SSL” in our marketing materials), access controls, employee training, and vendor diligence. No method of transmission over the Internet or electronic storage is completely secure; we cannot guarantee absolute security.

9. U.S. state privacy rights

Depending on where you live, you may have rights regarding your personal information under state law. This section summarizes certain rights for California residents and provides a general framework; residents of Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws may have similar rights subject to statutory exceptions.

9.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to: (1) know the categories and specific pieces of personal information we have collected about you; (2) delete personal information we collected from you, subject to exceptions; (3) correct inaccurate personal information; (4) opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising; and (5) limit the use of sensitive personal information where applicable. You may not be discriminated against for exercising these rights.

To submit a request, email [email protected] with the subject line “Privacy Request,” or use our webform on the Do Not Sell or Share My Personal Information page where applicable. Please include your full name, state of residence, and a brief description of your request. We will verify your request using information you provide; for certain requests we may require additional verification. You may designate an authorized agent to make a request on your behalf with written permission, unless you have provided the agent with power of attorney under California Probate Code sections 4000 to 4465.

We may deny requests where we cannot verify your identity, where exceptions apply (such as information needed to complete a transaction you requested), or where the law otherwise permits denial. You may appeal a refusal by contacting us at the same email address with “Privacy Appeal” in the subject line.

9.2 Shine the Light

California Civil Code Section 1798.83 permits California residents to request certain information regarding disclosure of personal information to third parties for their direct marketing purposes once per calendar year. We do not share personal information with unaffiliated third parties for their own direct marketing without offering an opt-out where required.

10. Children’s privacy

The Services are intended for adults. You must be at least 18 years old (or the age of majority in your state) to use the Services. The Services are not directed to children under 16 (or under 13 where applicable under the Children’s Online Privacy Protection Act), and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will take steps to delete such information promptly.

11. International users

The Services are intended for users located in the United States. If you access the Services from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States where data protection laws may differ from those in your country.

12. GLBA, FCRA, and financial/credit information

Some information we or our partners handle may qualify as nonpublic personal information under GLBA. Where GLBA applies, separate or supplemental privacy notices from a financial institution may govern, and certain rights in this Policy may be limited for that information.

If consumer reports or credit-related information are used in connection with your request, your rights under the FCRA may apply to those reports. We do not place hard inquiries on your credit file without appropriate authorization and disclosures as required by law; lenders make their own determinations. Always review disclosures from any lender or credit provider before you authorize a credit pull or accept an offer.

13. Third-party links and services

The Services may contain links to third-party websites, applications, or loan application flows. This Privacy Policy does not apply to those third parties. We encourage you to read the privacy policy of every site you visit or every lender with whom you apply for credit.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the “Effective date” at the top. If changes are material, we will provide additional notice as required by law (such as a prominent notice on the Services or email where appropriate). Your continued use of the Services after the effective date constitutes your acknowledgment of the revised policy, subject to applicable law.

15. Contact us

For privacy-related questions or requests, use the contact information below.